Read the airspace.Cap the corporate VLAN.
Wireless work isn't a Wi-Fi scan. SecureLayer7 walks the airspace by hand, deauths the client, captures the 4-way handshake, cracks PMKID offline, stands a same-SSID evil twin, harvests PEAP without a server cert, walks WPS PIN, and lands on the corporate VLAN. Every finding ships with the captured handshake, the PSK, and the controller / RADIUS / NAC config diff your team can deploy.
DISCOVER · SNIFF · CRACK · PIVOT
Four surfaces
802.11 · 802.1X / EAP · Rogue / Evil Twin · Captive / BYOD, one engagement, the whole airspace.
Captured evidence
EAPOL handshake, cracked PSK, PEAP relay credential, evil-twin client, not a screenshot of a scanner.
Re-test included
We verify your fixes, controller config, RADIUS profile, MFP, NAC, at no extra cost.
The window from vulnerability discovery to exploitation has gone from weeks to hours.
Trusted by security teams across Fintech, SaaS & Education, Enterprise & Telecom, Security & Critical Infrastructure
On record
What we test —
The whole airspace. Not just the SSID list.
Each layer of your wireless estate is reviewed by hand against its real attack surface — corporate Wi-Fi, 802.1X / RADIUS, the rogue-AP boundary, and the BYOD / guest edge. Intensity tunes per scope.
802.11 — WPA2 / WPA3 / WPS
PMKID capture via hcxdumptool, 4-way handshake collection under deauth, offline crack with hashcat, WPS PIN brute force (Pixie Dust), WPA3 SAE downgrade (Dragonblood), MFP / 802.11w not enforced, PMF-not-required client trap.
802.1X — EAP-TLS / PEAP / EAP-MSCHAPv2
Server-cert validation off on clients, PEAP outer-tunnel bypass, EAP-MSCHAPv2 cleartext relay, EAP-TLS cert-pinning gaps, RADIUS shared-secret re-use across SSIDs, MAC-RADIUS bypass, NPS / FreeRADIUS misconfig.
Rogue AP — Evil Twin / KARMA / Deauth
Same-SSID rogue stood up with hostapd-mana, broadcast-PROBE-RESPONSE KARMA, captive-portal harvest of corporate creds, MAC randomization detection bypass, Wireless IDS / WIPS evasion, deauth flood under MFP-off.
Captive / BYOD — Guest VLAN / NAC / MDM
Captive-portal UAM bypass, guest-to-corporate VLAN escape via DHCP / IPv6 abuse, NAC posture-check bypass, MDM-issued client cert lift, BYOD MAC-allowlist spoof, Wi-Fi Direct lateral pivot, hidden-SSID probe-leak reveal.
Why a Wi-Fi scan misses the airspace
An SSID list is not a captured handshake.
A scanner reports SSIDs, signal strength, encryption mode, and stops there. SecureLayer7's operators take it further. A deauth flood under MFP-off rips the next client off the AP, the 4-way handshake lands on the wire, and the PMKID cracks against your corporate wordlist offline. A same-SSID evil twin with a self-signed cert catches the laptop whose 802.1X profile skipped server-cert validation and replays PEAP-MSCHAPv2 to your real RADIUS server. A hidden SSID gives itself away the moment a roaming client probes for it. Every finding ships with the captured handshake, the relayed credential, and the controller / RADIUS / NAC config diff your team can deploy.
WHAT LANDS IN SCOPE.
Counted, not claimed.
A wireless engagement at SecureLayer7 covers the airspace your users actually live in. Numbers below describe what's in scope on a typical engagement. Not market-size claims.
802.11 / 802.1X / Rogue / Captive. Each reviewed by hand with HackRF, hcxdumptool, hostapd-mana, eaphammer, and bettercap.
Plus SOC 2 Type II, HIPAA, ISO/IEC 27001, GDPR, NIST CSF, and FedRAMP. Finding-to-control crosswalk on every engagement.
Controller config change, RADIUS profile diff, NAC posture rule, MFP enforcement. We verify the path is closed and ship written confirmation.
RF COVERAGE.
The airspace techniques that turn a scanner ping into a foothold.
- 01PMKID offline crack
Capture a single PMKID frame from the AP with hcxdumptool, crack the WPA2 PSK offline with hashcat on rented GPUs.
- 02PEAP credential harvest
Stand up an evil-twin RADIUS with hostapd-wpe, downgrade clients without proper CA pinning, collect MSCHAPv2 challenges.
- 03802.11w MFP bypass
Find APs that signal MFP-capable but allow legacy clients, deauth with KARMA-style frames to force re-association onto rogue SSIDs.
- 04Captive portal to corp VLAN
Escape the BYOD captive portal via ICMP tunneling or DNS rebinding, reach segments that trust the wireless source IP range.
- 05Sub-GHz protocol replay
Record proprietary 433 or 868 MHz traffic with an RTL-SDR, demodulate with Universal Radio Hacker, replay sensor or door commands.
Wireless bands tested.
WIRELESS METHODOLOGY.
Eight phases. Discover to re-test.
Threat-modelled to your SSIDs, RADIUS topology, controller fleet, and BYOD posture. Not a checklist run against every airspace.
Scope & threat-model
In-scope SSIDs, BSSID list, building or floor coverage, RADIUS or NPS topology, controller fleet, and call-out windows agreed in writing. Out-of-scope guest tenants and partner SSIDs recorded.
RF survey & discovery
Walk-through capture with directional and omni antennas. Hidden SSID reveal via probe-leak. WPS-enabled APs flagged. Channel plus 5 GHz and 6 GHz coverage mapped. Rogue or unmanaged APs detected and reported separately.
Handshake & PSK capture
4-way EAPOL collection under controlled deauth on PSK SSIDs. PMKID capture via hcxdumptool where AP firmware permits. Offline crack against the corporate wordlist with hashcat (-m 22000).
802.1X exploitation
Server-cert validation tested on a representative client fleet. eaphammer evil-twin run for PEAP or EAP-TTLS credential harvest. RADIUS shared-secret re-use checked across SSIDs. NPS or FreeRADIUS access policy reviewed for MAC-RADIUS bypass.
Evil-twin exploitation
Same-SSID rogue stood up with hostapd-mana. KARMA broadcast-PROBE-RESPONSE engaged for client trap. WIPS and Wireless IDS reaction time measured. MFP and 802.11w enforcement tested under deauth flood.
Captive & NAC pivot
Captive-portal UAM bypass. Guest VLAN escape via DHCP option or IPv6 RA abuse. NAC posture-check bypass via MAC plus cert spoof. MDM-issued client-cert lift where the device permits. Wi-Fi Direct lateral movement.
Remediation guidance
Cisco WLC, Aruba MM, or Meraki dashboard config snippets; NPS or FreeRADIUS access-policy diffs; controller MFP or PMF enforcement; NAC posture rules; BYOD onboarding tightening. Written for wireless engineers, not auditors.
Patch verification
Every finding re-tested after your team ships the fix (controller config push, RADIUS profile change, NAC rule update, AP firmware bump) at no extra cost. Written confirmation each path is closed.
Insights
Wireless & RF Resources.
Enterprise Wi-Fi, BLE, and Zigbee write-ups: rogue-AP detection, WPA3 downgrade tests, and segmentation across guest and corp SSIDs.
Meet our engagement lead
One lead across every SSID in range.
John Dill
vCISO at SecureLayer7
Walk-led
Wireless engagement model
WPA2 · WPA3 · 802.1X
In scope by default
98%
Engagement-lead close rate
John scopes wireless assessments against your SSID list, RADIUS topology, controller fleet, and BYOD posture. He runs kick-off, RF survey planning, and live walkthrough of every captured handshake and harvested credential.
- Scopes Cisco WLC, Aruba (MM, IAP), Meraki, Mist, and Ruckus controller estates against your real RF footprint.
- Owns kick-off, RF survey planning, and live review of every captured handshake, evil-twin trap, and NAC bypass.
- Drives remediation review and re-test until every airspace path is closed and the controller config is verified.
Ready to scope a wireless assessment? Book 30 minutes with John to walk through your SSIDs, RADIUS topology, controller fleet, and timeline.
Book a 30-min callTested by industry.
The bug classes named below come from real engagements in each sector. Pick the closest fit.
HealthTech
Clinic wireless, medical-device pairing, telemetry isolation from patient WiFi.
Built for Australia engagements
What changes when we deliver here.
Regulatory framework
ASD ISM wireless control per SSID
Compliance scoping
ACSC OT-Wi-Fi separation evidence
Local engagements
AU hospital — 4 buildings, 380 APs surveyed
Local pricing
AUD per-site visit, GST itemised
Compliance scoping
PSPF Policy 8 zone annex when applicable
Questions Australian network owners ask first.
Do you cover WPA3 and Enhanced Open?
Yes. WPA3-SAE and OWE Transition Mode are tested. Downgrade and dragonblood-class issues are scored against ISM wireless controls.
How do you handle 802.1X EAP?
PEAP-MSCHAPv2 weakness, EAP-TLS certificate pinning, and RADIUS shared-secret strength are tested. Each gap cites the ISM control ID.
Do you test OT-Wi-Fi separation?
Yes. Industrial Wi-Fi rings are tested for segmentation from corporate. Findings reference ACSC OT guidance and ASD ISM network controls.
Is the report usable for PSPF environments?
Yes. PSPF-classified zones get a separate annex listing every SSID and broadcast control gap against PSPF Policy 8.
Delivery in Australia
ASD ISM wireless. ACSC mobility.
Authentication, segmentation, and rogue-AP findings cite ASD ISM wireless controls. Guest, BYOD, and OT-Wi-Fi gaps map to ACSC enterprise mobility guidance.
- Direct line
- +61-2-0000-0000
- Office
- Sydney, Australia
Frameworks scoped: ASD Essential 8 · APRA CPS 234 · Privacy Act · ISO/IEC 27001.
Sample engagement report
See what arrives in your inbox.
A pre-vetted sample report: airspace narrative, captured handshake, cracked PSK, evil-twin transcript, and the controller or RADIUS config diff your team can deploy. Sent on request after a 5-minute scoping call.