+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Wi-Fi post exploitation? (/showthread.php?tid=6216664)
Wi-Fi post exploitation? - SkunT3llo - Aug 9, 2022
Hello to everyone who's reading this!🙃
After You get connect to target Wi-Fi and scan whole network (MAC + IPv4 + IPv6 + OS + open ports) and If there is no working public exploit for any open port, what's the next thing You do?
And based on experience, what is in your opinion most effective attack in the network?
RE: Wi-Fi post exploitation? - ice_c00l - Aug 11, 2022
Personally I'd monitor for unencrypted traffic with wireshark and also look for POST messages. I would look to use Responder for any user connections if you are on the WiFi. Might be are to pick up some usernames / credentials that way. Use Crackmapexec with any found username/passwords against a range of services of those IPs.
RE: Wi-Fi post exploitation? - ThrillQuks - Sep 1, 2022
(Aug 9, 2022 07:08 PM)SkunT3llo Wrote: Hello to everyone who's reading this!🙃
After You get connect to target Wi-Fi and scan whole network (MAC + IPv4 + IPv6 + OS + open ports) and If there is no working public exploit for any open port, what's the next thing You do?
And based on experience, what is in your opinion most effective attack in the network?
Since you are connected and can access the local panel page, routersploit might be good option
RE: Wi-Fi post exploitation? - SkunT3llo - Sep 1, 2022
(Sep 1, 2022 05:03 AM)ThrillQuks Wrote: Since you are connected and can access the local panel page, routersploit might be good option
Yeah, might be, but what if routersploit fails, what are the other ways/options?
RE: Wi-Fi post exploitation? - AlmightyK - Sep 1, 2022
Well if there is no available exploit for the targets then you would have to attack from a different vector. I'd ARP Ban all clients on the network, then, create a duplicate (fake) access point that is identical to the AP I ARP banned. If users connect to the AP. A capture page can be displayed on the victims browser. This page can be whatever you want, it can ask for credentials or anything else you might need. This is only one of many different options.
RE: Wi-Fi post exploitation? - SIM-5614029 - Feb 18, 2025
bumping this thread for more input
RE: Wi-Fi post exploitation? - Control Alt Elite - Mar 15, 2025
I'd try to deauth the clients and then get them to connect to a WiFi access point that I control - maybe passing them to a captive portal that has an executable that they "need" to download and install. Should be smooth sailing from there.
RE: Wi-Fi post exploitation? - Depicide - Apr 26, 2025
Evil portal is always a good way to collect credentials. If you are on the network already I would start looking into the IP's, and individual connections that are on the network to gain more info. You may capture a phone or computer or their home security system as well and find an open camera.
Running IP's through programs and sites like shodan.io can speed up your process and help you look for more access points as well and other vulnerabilities in their network.
PhoneSploit is also a great program if you end up catching phone data as well.
https://github[.]com/AzeemIdrisi/PhoneSploit-Pro