EH-Net

Hey guys. I'm going to be performing a rush wireless pentest next week, and I was wondering if anyone had a framework for how to go about that. I'm a CWNA and will take the CWSP in a few weeks, and I've toyed around with this stuff for years. I'm not too worried about my technical abilities, but I just want to make sure I cover all the bases and provide them with a quality report. I'm going to try to sneak into the OS WiFu course over the weekend as well.

TIA.

Edit: I am looking currently looking at my search results for wireless pentesting framework, so I'm doing alright without the smart-ass answers ;)

If anyone does have any personal experience with any of these, I would love to hear it. Thanks again.

Ok, things have completely changed. These are proprietary 5.8Ghz point-to-point links that connect several remote offices. Any ideas how to go about testing something like this!?

That's difficult, just beginning: normally they use spread spectrum and the same brand with some security feasures (some equipment just understand their equipment) plust because is point to point they atenas sending the signal directly, so you need to be next to one ot the antenas, jajajaaja

I do not think how you can do it

There was a presentation, maybe at Defcon, a year or so ago.  It explained how to unlock certain wireless cards to be able to listen on frequencies outside of the supported manufacturer's ranges.   Obviously there are issues with bricking and FCC, but it could be worth investigating.   

I am not an expert on this, but I think that 802.11a is the closest thing to that spectrum that is readily available.  I think 802.11a operates at 5.75 and 5.85 GHz ranges.   I am not sure if you can match the frequency of the point to point connections, but it's worth a shot. 

I don't know if this is within your scope though.  Unless your point to point connections are using 802.11a or 802.11n, I don't know what hacking your wireless card would prove.  This may be a shortcut, but my approach to these types of proprietary networks is usually to go over the AP and antennae settings to make sure properly authentication, encryption, etc are used.

Again, I am not a wireless expert, but these are my two cents.

Thanks for the responses everyone. Unfortunately, this just isn't going to happen because it's in no way feasible.

However, I was able to speak with an engineer at that company, and I learned that they use proprietary L2 Framing and proprietary encryption (which is scary).

http://www.trangobroadband.com/wireless-products/point-to-point/license-exempt/TrangoLINK-45-5ghz-ethernet-bridge.aspx is what they are using.

Oh well, I managed to score the OffSec WiFu course out of the deal (before we knew what equipment they were using), so it wasn't a total loss :D