📶 Sherlocked Security – Wireless Network Security Assessment
Secure Your Airspace – Defend Against Rogue Access & Signal Hijacking
📄 1. Statement of Work (SOW)
Service Name: Wireless Network Security Assessment
Client Type: Corporate Offices, Financial Institutions, Healthcare, Educational Campuses, Government
Service Model: On-site Testing Only
Compliance Coverage: ISO 27001, NIST 800-153, PCI-DSS, HIPAA, CIS Controls
Scope Includes:
- Office Wi-Fi & Guest Networks
- APs, Controllers & SSID Configs
- Rogue AP Detection
- Wireless Authentication & Encryption
- Signal Leakage & Segmentation Testing
- BYOD Risk Assessment
🧠 2. Our Approach (with Visual)
🔹 Signal Mapping & Rogue AP Detection
🔹 Encryption Cracking & Credential Harvesting
🔹 Guest Segmentation Testing & Network Isolation
[Wireless Signal Mapping] → [SSID Enumeration] → [Encryption Analysis] → [Authentication Bypass] → [Data Interception] → [Rogue AP Detection] → [MitM Tests] → [Reporting & Recommendations]
🧪 3. Methodology
[Kickoff Meeting] → [Signal Survey & Mapping] → [SSID Discovery] → [Encryption Strength Test] → [Credential Harvesting] → [Guest & Corp Segmentation Validation] → [Rogue Device Detection] → [PoC Development] → [Report & Retest]
📦 4. Deliverables to the Client
- ✅ Heatmap of Wireless Coverage & Rogue Signals
- 🧾 Statement of Work (SOW)
- 📘 Technical Report with:
- SSIDs Discovered
- Authentication/Encryption Issues
- Signal Bleed & Guest Isolation Gaps
- Captured Packets (optional)
- Exploit PoC & Mitigation Plan
- 📊 Rogue Access Point Identification
- 🧑💻 Advisory Support (via Slack/Teams)
- 🔁 One Round of Free Retesting
- 🎓 Penetration Test Certification (Post Fixes)
🤝 5. What We Need from You (Client Requirements)
- ✅ On-site access to test locations
- ✅ List of official SSIDs & credentials (if available)
- ✅ Wi-Fi controller info (if managed)
- ✅ Guest Wi-Fi credentials (if separate)
- ✅ Floor plan (if available)
- ✅ IT Point of Contact on-site
🧰 6. Tools & Technology Stack
- 📶 WiFi Pineapple, Alfa AWUS036ACH
- 📡 Kismet, Airodump-ng, Wireshark
- 🔓 Aircrack-ng, Wifite
- 📟 Bettercap, EvilAP, RogueAP Tools
- 🧠 Custom scripts for deauth & EAP attacks
- 🔧 WPA/WPA2/WPA3 handshake crackers
- 🛡️ Spectrum Analyzer (optional)
🚀 7. Engagement Lifecycle (Lead → Closure)
1. Initial Consultation → 2. NDA & Scope → 3. On-site Schedule Finalization → 4. Wireless Recon & Attack Simulation → 5. Report Generation → 6. Remediation Assistance → 7. Final Report & Certificate Issued
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 📶 Heatmap Visualization | Accurate signal boundary mapping |
| 🕵️♂️ Rogue Device Detection | Live monitoring + mitigation tips |
| 🔓 WPA/WPA2/WPA3 Crack Testing | Real-world password audit |
| 🧑💻 Segmentation Bypass Testing | Detect flat or misconfigured networks |
| 🛡️ Deauth & Captive Portal Attacks | Proof-based exploitation |
| 🎓 Wireless PenTest Certificate | Post-hardening validation |
📚 9. Real-World Case Studies
🔓 Guest Wi-Fi Lateral Access
Issue: Guest SSID was bridged to corporate VLAN
Test: ARP poisoning allowed file server access
Fix: VLAN segmentation enforced, ACLs applied
📡 Rogue Access Point in Office
Detected: Fake AP cloned internal SSID (evil twin)
Impact: Multiple employee creds captured
Fix: MAC-based filtering, WIDS activated
🛡️ 10. SOP – Standard Operating Procedure
- Kickoff Meeting & Area Identification
- SSID Enumeration & Signal Survey
- Encryption & Auth Testing (WPA/WPA2/WPA3)
- Credential Harvesting Attacks (Deauth/EvilAP)
- Guest vs Corporate VLAN Segmentation Tests
- Rogue AP Identification
- Reporting & Fix Consultation
- Retesting + Certificate Issuance
📋 11. Wireless Security Checklist (Preview)
- Identify all access points and clients.
- Test for weak encryption (WEP/WPA/WPA2/Enterprise).
- Capture and crack handshake for password strength.
- Assess rogue access points and evil twin attacks.
- Test MAC spoofing and bypass techniques.
- Evaluate SSID broadcasting policies.
- Assess signal leakage and physical security.
- Analyze RADIUS and EAP configurations.
- Detect deauthentication and jamming vulnerabilities.
- Evaluate guest network isolation.
📬 Contact Us or 📅 Book a Consultation