This phase consists of gathering information about the SSIDs that are within scope. This phase will implement wireless sniffing and identification tools to discover which types of security are being used for authentication against the network.

The Exploitation phase will begin once the security protocols of the wireless network are discovered. The attacks paths will use a variety of different techniques to assess the baseline security of the wireless network, including rogue access point creation, de-authentication of wireless clients, authentication interception, certificate spoofing, and hash cracking. Once an initial foothold within the network has been gained, SNT will move into the Post-Exploitation phase. This phase combines Reconnaissance and Exploitation phases to determine the likely attack paths of real-world threat actors. Analysis of segmentation, host isolation, and access from within the wireless network be completed.

The Reporting phase will occur after attack paths and vulnerabilities have been exploited and validated. Reports will consist of relevant attack paths and TTPs that were executed against the customer environment. SNT does not create reports based on vulnerability scanner output or CVSS scores, but instead uses extensive experience and expertise to assign risk to individually exploited vulnerabilities, misconfigurations, and relevant attack paths to give the customer an immediately actionable report. Mitigation techniques are included in details of findings, where applicable, to provide guidance and a starting point to reduce the overall risk to the customer environment.