TheXero

So you’re sitting in your local café, laptop open, and you connect to the free Wi-Fi.

One of the most common questions I still receive is: “What WiFi adapter should I use for pentesting?”

Hidden SSIDs are one of those security measures that feel effective but provide almost no real protection against a determined attacker.

Even the most secure wireless deployments — including EAP-TLS with client certificate validation — can become entry points when endpoints are exploited in less secure environments.

We wrapped up Cohort 1 of the WiFi Attacks Specialist course last week and I wanted to take a moment to say thank you to everyone who joined.

TL;DR – EAP-TLS Wi-Fi Authentication in a Nutshell EAP-TLS provides strong mutual authentication using client/server digital certificates.

TL;DR – Evolution of Wi-Fi Security: WEP was the first Wi-Fi security protocol but was quickly broken due to weak encryption and IV reuse.

TL;DR – Enterprise Wi-Fi Authentication Explained Enterprise Wi-Fi networks rely on the Extensible Authentication Protocol (EAP) to manage secure client access.

TL;DR – Control and Data Frames in 802.11 Wi-Fi Control frames manage the coordination of transmissions (e.g., ACK, RTS/CTS, Block ACK), ensuring smooth traffic flow and collision avoidance.

TL;DR – 802.11 MAC Frame Explained The MAC frame is the foundation of Wi-Fi communication, defining how data is transmitted across the wireless medium.

Before diving into the main content, let’s quickly recap the essentials of Protected Management Frames (PMF).

Understanding Protected Management Frames (PMF) in Wi-Fi Before delving into Protected Management Frames (PMF), it’s essential to understand what management frames are and their role in Wi-Fi communication.

A lightweight Python wrapper that automates the full PMKID capture-to-crack workflow using hcxdumptool and hashcat.

If you’ve been through the Worldmail exploit write-up or spent any time developing shellcode, you’ve run into bad characters.

If the stack-based buffer overflow is where exploit development starts, Structured Exception Handler overflows are where it gets more interesting.

Stack-based buffer overflows are the foundational technique of Windows exploit development.

People had warned me.

Metasploit is great.

Housing providers hold a significant amount of sensitive personal data — tenant records, financial information, maintenance histories — and increasingly rely on digital systems to deliver critical services.

Note: OS Command Injection vulnerability allows command execution on the underlying operating system.

Note: Local Privilege Escalation vulnerability in SEMS <= 3.3.2 MP12 allowing for escalations of privileges to that of the root superuser.

Note: LDAPS Service Heap Memory Corruption vulnerability in SEMS <= 3.3.2 MP12 allowing for reads to from or writes to a memory location outside the buffer’s intended boundary.

ConScan has been updated.

ConScan has been updated.

BSides London 2014 was a milestone for me.

Web application pentests almost always involve a CMS.

Note: Stored XSS vulnerability in the DEXs PM System WordPress plugin v1.0.1 allows attackers to inject malicious JavaScript via the message subject field with potential for full WordPress admin compromise.

Real pentesting doesn’t always look like the tutorials.

Web server enumeration is one of those tasks that every pentester does, but almost nobody enjoys doing manually.

So you’ve worked through the stack overflow.

Most people learning pentesting focus on TCP.

If you want to find vulnerabilities in software, fuzzing is one of your best friends.

Hidden SSIDs come up constantly in conversations about WiFi security.

If you’ve worked through Episode 2 and Episode 3, you can already crack WEP.

If you’ve watched Episode 2, you know how to crack a WEP network using the clientless ARP replay attack.

WEP is dead.

Every wireless pentester has to start somewhere.