Wi-Fi networks (on site)
Pentest of your Wi-Fi network
Your Wi-Fi is a door into the whole organization: a poorly separated guest network or a fake access point can leave your internal systems exposed without anyone noticing. We spend a day at your site, review it with controlled tests and tell you what to close, without stopping your operation.
On-site Wi-Fi security audit for 1 site and up to 2 networks: passive inspection and authorized active tests on encryption, authentication, segmentation, rogue access points and access controls. We work with controlled tests and reproducible evidence.
- Duration
- 1 day on site
- Start
- Coordinated with your availability and operating window
from US$1,200
Buy it on its own or add it to an audit. Retests: added to an audit, the same as that audit; on its own, 3 months at no charge. The price is a starting point and does not include travel. Travel costs are quoted based on the distance between your site and the auditor; write to us with the location and we send you that cost before confirming.
Review my Wi-FiOpening a new office or adding a new network? Write to us and we review it before the team uses it.
It is for you if
- You have an office, plant or branch with a corporate and a guest network.
- You are not sure the guest network is really separated from your internal systems.
- A customer, your insurer or an internal audit asks you to review the wireless network.
What we check
How strong the passwords are and how someone gets onto the network.Encryption and access: WPA2/WPA3, SAE, PMF (802.11w), TKIP, WPS, PSK strength and captive portals.
Whether corporate authentication properly validates each person and device.Authentication: 802.1X/RADIUS, EAP methods, certificate validation, identity leakage and access policies.
Whether someone can set up a fake network so your people connect to it and hand over their passwords.Rogue AP and evil twin: unauthorized access points, twin SSIDs, deauth and configurations that ease impersonation.
Who manages the equipment, with what controls, and whether there is a record of what happens.Management and logging: MAC filtering as a weak control, default accounts, exposed management interfaces, firmware, controller and AP logs.
How we work
Before the visit
Scope and authorization
We confirm the site, the 2 networks and the work window, and sign the authorization. We review any information you have at hand.
Scoping, rules of engagement and signed authorization; remote preparation with the available configuration.
The day on site
Survey
One day on site: first we listen to the network without touching anything, then we test what is authorized, with no tests that cut service. If something is serious, we tell you the same day.
Passive survey (Kismet and Wi-Fi analyzers to inventory SSIDs, channels, security, APs and clients) and authorized active tests: Aircrack-ng, hcxtools, Hashcat on the captured PSK, Wireshark, Nmap and, depending on the case, Bettercap, Scapy and EAPhammer (the latter only for authorized rogue AP and evil twin tests).
Afterwards
Report
A second Lop reviews every finding and we hand you what to close, in which order, with a meeting to explain it.
Correlation of captures, configurations and observed behavior; review by a second Lop; technical and executive reports; wrap-up meeting.
What you get
- The findings ordered by severity, with the evidence for each one.
- Findings with CVSS and word severity, evidence (captures and observed configurations), impact and recommendation.
- The inventory of what we found on the air.
- Inventory of SSIDs, APs and clients observed, with channel and security for each.
- What to fix and in which order, for your team or your vendor.
- Recommendations prioritized by impact and effort, with a technical report and an executive one.
- Every fix tested again.
- Retest on the corrected network; terms depend on how it is bought.
Scope limits
Includes
- 1 site and up to 2 Wi-Fi networks.1 physical location and up to 2 networks (SSIDs) at that site.
- 1 day of work on site, with remote preparation and the report afterwards.On-site day plus prior remote preparation and later report delivery.
- Authorized tests, without cutting your operation.Authorized passive and active tests; no denial of service or destructive tests unless expressly agreed.
Does not include
- It does not include travel: travel costs are quoted based on distance.Travel and lodging outside the city are separate, quoted before confirming.
- We do not touch the wired network or the devices inside: that is Warren.No pentest of the wired network, endpoints or applications.
- We do not implement the changes: your team or Lop Fix does. It is not continuous monitoring either.No remediation (available with Lop Fix), no full physical security and no continuous monitoring.
More than 2 networks, several sites or monitoring? We give you a fixed price before signing.
Questions before you buy
Do you need authorization?
Yes. Without a signed authorization we do not run any active test. It is your network and everything is in writing.
Is the operation interrupted?
No. We coordinate the window, prioritize the tests that listen without touching and do not cut service without your express permission.
What if we are outside the city?
Travel and lodging are quoted based on the distance between your site and the auditor. Write to us with the location and we send you that cost before confirming.
What if I have more than 2 networks or several sites?
We quote the extra scope before signing, with the same methodology.
How long since anyone reviewed your Wi-Fi?
We spend a day at your site, review up to 2 networks with controlled tests and tell you what to close.