Wireless penetration testing services
A wireless penetration test checks whether your Wi-Fi lets the wrong people in or across: weak encryption and authentication on corporate and guest SSIDs, rogue or misconfigured access points, and guest networks that reach the corporate VLAN. Because the tester has to be within radio range of your access points, BERRY9 carries out wireless testing in India on-site by arrangement, from its one office in Hyderabad.
- Delivery
- On-site by arrangement, from Hyderabad
- Networks
- Corporate and guest SSIDs
- Covers
- WPA2, WPA3, rogue access points
- Starts from
- INR 27,000 + 18% GST
Last reviewed
Illustrative One office floor, as a wireless test sees it
Reception
Visitors join an open network through a captive portal. F-01: a guest laptop can open a file share on the corporate VLAN.
Meeting room
F-02: a small access point that IT never installed is plugged into a wall port and broadcasts a network of its own.
Open-plan office
Staff laptops sign in to WPA2-Enterprise with domain accounts. F-03: they accept any authentication server, so a look-alike network can collect those sign-ins.
Comms room
One switch carries the guest and corporate VLANs to the same firewall, where a single missing rule is what makes F-01 possible.
Example floor plan, not client data: two SSIDs, one unauthorized access point and the shared switch where guest and corporate traffic meet.
01 / What it is
What a wireless penetration test is, and who needs one
A wireless network ends where its signal fades, which is rarely at your front door. A wireless test looks at your Wi-Fi from where an outsider could be, in the parking lot, the lobby or the office next door, and checks what that person could join, overhear or reach.
A wireless penetration test, also called a Wi-Fi security assessment, examines the wireless side of your network: the SSIDs you broadcast, how each one encrypts traffic and decides who may join, the access points that carry them, and where each network leads once a device is on it. It also looks for wireless equipment that should not be there, such as an access point someone plugged in without telling IT. The work happens inside your premises and around them, because that is where the radio signal is.
Few wireless findings are exotic. Most are settings chosen years ago for convenience, a guest network that was meant to stay separate, or devices that trust any network presenting the right name. The test turns each of those into a finding with evidence and a fix.
Organizations usually ask for one in these situations:
An office with guest Wi-Fi
Visitors, contractors and delivery staff get a password or a portal page every day. The question is whether that network gives them the internet and nothing more, or a path to the printers, file servers and consoles your own staff use.
Plants, warehouses and logistics sites
Handheld scanners, label printers, vehicle terminals and line equipment often connect by Wi-Fi, and many are older devices that support only weaker security modes. Keeping them working without leaving the plant network open is a common reason to test.
Hospitals, clinics and campuses
Large buildings, many people coming and going, shared devices, and several networks layered on the same access points. Patient, student, staff and visitor networks are meant to stay apart, and a wireless test checks whether they do.
A move, a refit or a new controller
New access points, a different wireless controller or a switch to WPA3 is when old settings are copied across unexamined and new ones are left at their defaults. A test after the change confirms the network matches its design.
Card payments near the wireless network
If card data crosses Wi-Fi, or a wireless network sits close to the cardholder data environment, PCI DSS has requirements written specifically for wireless. The compliance section further down lists them.
Shared and multi-tenant buildings
In a co-working space, a business park or a floor shared with other companies, your signal reaches strangers and theirs reaches you. Look-alike networks and access points nobody claims are more likely in a crowded radio environment.
02 / What we test
What a Wi-Fi security assessment covers
The scope is set site by site and SSID by SSID. A full wireless test spans the six areas below; a smaller one may cover only the guest network or only the corporate SSID.
Encryption and authentication per SSID
For every network you broadcast: which security mode it runs (open, WPA2, WPA3, or a transition mode that accepts both), how users or devices prove who they are, and whether those choices fit what the network carries. Corporate, guest, device and hidden SSIDs are all in view.
Shared keys on Personal networks
Where a network relies on one pre-shared key, we check how strong it is, whether it can be recovered from captured traffic, and how far it has spread: printed on a reception card, still saved on former staff phones, or unchanged since the day the network went live.
Enterprise sign-in (802.1X)
On WPA2-Enterprise and WPA3-Enterprise networks: which authentication method is in use, whether devices verify the authentication server's certificate before handing over credentials, and what one stolen or reused sign-in would give an attacker.
Rogue and misconfigured access points
Access points missing from your inventory, look-alike networks broadcasting one of your names, and your own access points left on default settings, old firmware or management pages reachable from the wireless side.
Guest separation and client isolation
From a device on the guest network, what else answers: the corporate VLAN, management interfaces, other guests' laptops and phones, or anything beyond the internet connection the network exists to provide.
Captive portals
The sign-in page many guest networks put in front of the internet. We check whether it can be sidestepped, for instance by borrowing the identity of a device that has already signed in or by sending traffic out before the portal steps in, and what the portal collects about visitors.
Two families of security mode cover nearly every network you will meet. In neutral terms:
| Question | Personal (WPA2-PSK, WPA3-SAE) | Enterprise (802.1X) |
|---|---|---|
| How people get on | Everyone shares one password or passphrase | Each user or device signs in with its own credentials or certificate, checked by an authentication server |
| What one leak exposes | The whole network, until the key is changed on every device that uses it | One account or certificate, which can be revoked without touching anyone else |
| What WPA3 changes | SAE replaces pre-shared key authentication, resists offline guessing of the password, and protected management frames are mandatory | 802.1X stays, protected management frames are mandatory, and a 192-bit mode is available |
| What a test looks at | Key strength, whether the key can be recovered, transition mode and how widely the key is known | The sign-in method, certificate checking on devices, and look-alike networksCorporate SSIDs often sign in with directory accounts |
| Where it usually fits | Small offices, guest networks, and devices that cannot do 802.1X | Staff laptops and phones in organizations with a central directory |
Many networks run a transition mode so that WPA2 and WPA3 devices can share one SSID. That keeps older equipment working, but it usually lets a client be pushed onto the weaker protocol, so the test treats a transition network as WPA2 until it shows otherwise.
03 / On site
Why wireless testing happens on site, and what the visit involves
Wireless is the one test that cannot be run from a distance. It only works where the signal does, so a tester has to be inside your premises and around them, within range of the access points.
Show details for Why wireless testing happens on site, and what the visit involves
BERRY9 is based in a single office in Hyderabad, and almost every other test it runs is delivered remotely from there. Wireless cannot be: the tester needs to stand where your signal reaches, so wireless testing takes place at your premises by arrangement. Dates, site access and the person who will accompany the tester are agreed before the visit, together with the floors, buildings and outdoor areas in scope.
Cities covered on site. Offices in Hyderabad and in other cities are tested on site in the same way; outside Hyderabad, the travel terms in the price section apply.
What the visit usually involves:
- A walk through each floor in scope, noting every network and access point that can be heard from each area.
- Checks from the edges of the site, such as entrances, parking lots, shared corridors and the floors above and below, where an outsider could sit unnoticed.
- Tests against each SSID in scope from the agreed spots, and time on the guest network to see what it reaches.
- Matching the access points heard on site against your inventory, with your network team's help to trace unknown ones.
Travel and on-site terms are covered with the price further down.
What we need from you
- The SSIDs you own and want tested, and any that belong to a landlord, a neighbor or another tenant, so those are left alone.
- Floor plans, or a rough sketch, of the areas in scope, with access point locations if you have them.
- Written authorization from someone entitled to give it, and from the building owner where common areas are involved.
- Your access point inventory, even a spreadsheet, so anything missing from it stands out.
- A guest pass and a standard staff test account, where the scope includes testing as a signed-in user.
- A contact on site to open meeting rooms and comms cupboards and to let reception and security know a test is under way.
- Agreed times for checks that can briefly disconnect devices, so none of them lands in a shift change or a busy clinic.
04 / Method
How a wireless penetration test runs
Five steps take a wireless test from a signed scope to a report. The first two involve no interaction with your network at all.
Show details for How a wireless penetration test runs
Step 1
Scope, authorization and rules
Which sites, floors and SSIDs are in scope, which nearby networks are not yours, whether checks that can briefly knock devices off an access point are allowed and when, and whom to call if something looks wrong. All of it goes into a signed document before anyone travels.
OutputSigned scope and rules of engagement
Step 2
Passive survey
Listening only: every network and access point audible from the areas in scope, how far your own signal carries beyond your walls, and which security modes each SSID advertises. Nothing is sent to your network during this step.
OutputMap of SSIDs and access points
Step 3
Authentication and encryption
Each SSID is tested against its own security mode: how strong a shared key is and whether it can be recovered, whether a transition network can be pushed onto its weaker protocol, and whether enterprise devices give their credentials to a network that only looks like yours.
OutputFindings for each SSID
Step 4
Rogue and look-alike access points
The access points heard on site are compared with your inventory. Unknown ones are located and, where your network team can help, traced to the wired port they use; networks imitating your names are recorded the same way.
OutputList of unknown and look-alike access points
Step 5
Separation, isolation and reporting
From the guest and device networks we check what is reachable on the wired side and whether clients can see one another. The write-up then ties every finding to an SSID, a spot on the floor and a fix.
OutputExecutive and engineering reports
The VAPT methodology page describes the five-phase approach behind every BERRY9 test; on a wireless engagement the survey and the time on site are what change.
05 / Rogue access points
Rogue access point detection
A rogue access point is any wireless device that opens a way into your network without IT having put it there. A few are hostile; most are somebody's well-meant shortcut, and both kinds are found the same way.
Show details for Rogue access point detection
Plugged into a wall port
An inexpensive access point or travel router connected to a spare network socket, often to improve signal in a meeting room. It bridges your wired network to anyone in range, usually behind a weak or factory password.
Bridged by a staff device
A laptop or phone connected to the corporate network that shares its connection as a hotspot at the same time. It works like a rogue access point even though nobody installed one.
A look-alike network
Equipment outside your control that broadcasts the name of one of your SSIDs so that devices join it on their own. Enterprise laptops that skip the server certificate check are the ones most exposed to this.
Yours, but forgotten
An access point that does belong to you yet is missing from the inventory: left by a previous vendor, still on old firmware or default settings, or broadcasting a test network nobody turned off.
Detection starts from the inventory you share. Every access point heard on site is matched against it, and the unknown ones are located by signal strength and, with your network team, traced to a switch port. An access point that turns out to belong to a neighboring business is not a rogue one: it is noted and left alone.
One sweep or repeated. Rogue access point detection can be a one-time sweep during the visit or can be repeated on a schedule.
How often detection happens matters most when card data is involved, because PCI DSS sets a frequency for it; the compliance section gives the requirement.
06 / Common findings
Wireless weaknesses that keep turning up
Seven kinds of weakness account for most of what wireless tests report. Almost all of them are configuration rather than missing patches, which also makes them quick to fix once someone has seen them.
Show details for Wireless weaknesses that keep turning up
| Finding | What we see | Severity | What the report gives you |
|---|---|---|---|
| A guest network that reaches the corporate VLAN | A device on the guest SSID can open connections to file servers, printers or admin consoles, usually because one rule between the two VLANs is missing or written too broadly. | VariesFound from the guest network itself. | The exact route from guest to corporate, the VLAN or firewall setting that lets traffic through, and the change that closes it. |
| No client isolation on guest Wi-Fi | Guests can see and connect to each other's devices, so one compromised laptop in the lobby can probe every other visitor. | Varies | Where isolation is switched on, on the access points or the controller, and how to confirm it took effect. |
| A weak or long-lived shared key | A WPA2-Personal passphrase short enough to recover from captured traffic, or one unchanged for years and known to former staff and past visitors. | Varies | The SSIDs affected, a key policy that suits how each network is used, and the case for moving staff devices to Enterprise sign-in. |
| Enterprise devices that skip the server certificate check | Laptops and phones set to accept any authentication server, so a look-alike network can collect their sign-ins, which are often directory credentials. | VariesOne setting in the device profile. | The profile settings that pin the expected server certificate, and the device groups still missing them. |
| Transition mode left on longer than needed | An SSID still accepts WPA2 alongside WPA3 after the last WPA2-only device has gone, so a client can be pushed onto the weaker protocol. | Varies | Which SSIDs can move to WPA3 only, and which devices still hold the others back. |
| A captive portal that can be sidestepped | The guest sign-in page can be avoided by taking on the identity of a device that has already signed in, or by sending traffic out before the portal intercepts it. | Varies | The routes around the portal that worked, and the controller and DNS settings that close them. |
| Unauthorized access points on the wired network | A device nobody in IT installed, connected to a wall port and bridging the wired network to anyone within range. | Varies | Where it was found, the switch port it used, and port controls that stop the next one. |
A guest network that reaches nothing is a nuisance; one that reaches the payroll server is a serious problem. Because the same weakness weighs so differently from one site to the next, the table rates none of them, and each finding in your report is scored for your site.
07 / What you receive
What you receive from a wireless test
The report is written for two readers: whoever decides which fixes get budget, and whoever changes the controller and switch settings. Each finding is placed on your floor plan as well as in your network.
Show details for What you receive from a wireless test
- An executive report that says plainly which networks let an outsider in or across, and what to fix first.
- An engineering report for your network team, with every finding tied to an SSID, an access point and a spot on the floor plan.
- A proof of concept for each finding, so your team can see the issue for themselves before changing a setting.
- Severity scored with CVSS 3.1, weighed against what the network in question leads to.
- A per-SSID coverage matrix: encryption, segmentation and client posture for each network, side by side.
- Any shared keys recovered during the test, listed with the networks they open, so they can be changed.
- Unknown and look-alike access points with where on site each one was heard.
- A remediation roadmap and a remediation matrix: the route toward WPA3-only networks, and every fix ranked in order.
The sample VAPT report shows how a full BERRY9 report is laid out.
Finding F-01 · Wireless
Guest Wi-Fi clients can open a corporate file share through the shared switch
- Severity
- High
- CVSS 3.1
- 7.1
- Affected
- Guest SSID, guest VLAN to the corporate file server
- Tested as
- Guest device, signed in through the captive portal
Steps to reproduce
- A laptop joins the guest SSID and signs in through the captive portal like any visitor.
- From its guest VLAN address, a scan of the corporate address range finds a file server that answers.
- The server accepts a file-sharing connection from the guest device, traffic the guest network should never pass.
Fix
Deny all traffic from the guest VLAN to internal ranges on the firewall that joins them, allow only internet-bound traffic, and repeat the check from a guest device.
Example layout, not client dataCVSS 3.1 · AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
09 / Price
What a wireless penetration test costs
A wireless penetration test starts from INR 27,000 + 18% GST; the final price is set in a written proposal after scoping. Wireless is an advanced scope, and the number of sites, floors and networks changes the work more than anything else.
Wireless penetration test
Starts fromINR 27,000 + 18% GST
The starting figure for an on-site wireless test; the price for your sites is set after scoping and written into a proposal.
Request a scoping call- Sites and floors. Every building and floor in scope is more ground to walk and more access points to account for.
- Networks. Each SSID is tested against its own security mode, and an enterprise network with several device profiles takes longer than a single guest network.
- Depth on the wired side. Seeing what the guest network reaches is part of the test; following that route deeper into the internal network is network testing, scoped alongside.
- Days on site. Time at your premises, and the travel needed to get there, are part of the scope.
Duration. The schedule, on-site days plus reporting, is set in the written proposal after scoping.
Travel. For a site outside Hyderabad, getting the tester there and the hotel nights are billed at cost, with the total set out in the proposal before the survey starts.
How wireless work compares in price with web, network and cloud tests is explained in the VAPT cost guide for India.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
Other tests, city by city
10 / Compliance evidence
Wireless testing for PCI DSS, ISO 27001 and SOC 2
Only one of these frameworks writes requirements for wireless specifically. For the others, a wireless test is evidence about network security in general, and how much it counts is for your auditor to judge.
Show details for Wireless testing for PCI DSS, ISO 27001 and SOC 2
PCI DSS
PCI DSS 4.x has requirements written for wireless. Requirement 11.2.1 asks that authorized and unauthorized wireless access points be detected and identified at least once every three months, and 11.2.2 that an inventory of authorized ones be kept. Requirement 1.3.3 places network security controls between every wireless network and the cardholder data environment, and the penetration testing in 11.4 includes checks that segmentation works where it is used to reduce scope.
ISO 27001
ISO/IEC 27001:2022 lists network security (8.20), security of network services (8.21) and segregation of networks (8.22) among its Annex A controls. A wireless test gives evidence on each of them for the networks it covers. BERRY9 holds ISO/IEC 27001:2022 certificate 26MEQVU27.
SOC 2
SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. Where staff reach production systems from the office, the office Wi-Fi is part of the path to those systems.
BERRY9 runs the wireless test and writes the report. Whether that report meets a requirement is for your QSA, auditor or certification body to decide, so send us their requirement before the test is scoped.
11 / Inquiry
Tell us about your sites and networks
Tell us how many sites and floors are involved, which SSIDs you run and what each is for, whether card payments or regulated data touch the wireless side, and when a visit could happen. That lets us propose a scope and dates for the visit.
To talk it through first, call +91 86868 92922 or email contact@berry9.com.
12 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
What is a wireless penetration test?
It is a security test of your Wi-Fi carried out from inside and around your premises. A tester checks the encryption and sign-in method on each SSID, looks for access points that should not be there, and tests whether the guest network and other wireless networks stay separate from the corporate network. The result is a report of findings, each with evidence and a fix. See the section on What a wireless penetration test is, and who needs one above.
How much does wireless penetration testing cost in India?
At BERRY9, a wireless penetration test starts from INR 27,000 + 18% GST; the final price is set in a written proposal after scoping. What drives the figure is the number of sites and floors, the number of SSIDs and how they authenticate users, how far the test follows routes into the wired network, and the days needed on site, including travel. A single office with a guest and a corporate network is a much smaller job than several buildings. See the section on What a wireless penetration test costs above.
Does wireless testing have to be done on-site?
Yes. Wi-Fi can only be tested from within range of the access points, so the tester has to be at your premises. BERRY9 has one office, in Hyderabad, and carries out wireless testing at client sites by arrangement, with the dates, site access and travel agreed in the written proposal before the visit. See the section on Why wireless testing happens on site, and what the visit involves above.
How do you detect rogue access points?
By listening for every access point that can be heard on site and matching each one against your inventory of authorized equipment. Unknown access points are located by signal strength and, with your network team, traced to the switch port they are plugged into. Look-alike networks broadcasting your SSID names are recorded too, while access points that turn out to belong to neighboring businesses are noted and left alone. See the section on Rogue access point detection above.
Can you check that our guest Wi-Fi is separated from the corporate network?
Yes, and it is part of every wireless test that includes a guest network. From a device signed in as a visitor, the tester checks what answers on the corporate address ranges, whether management interfaces are reachable, and whether guests can see each other's devices. If guest traffic reaches the corporate VLAN, the report names the route and the setting that lets it through. See the section on What a Wi-Fi security assessment covers above.
What is the difference between WPA2-Enterprise and WPA2-Personal testing?
A WPA2-Personal network uses one shared key, so testing focuses on how strong that key is, whether it can be recovered from captured traffic and how many people know it. A WPA2-Enterprise network signs each user in through an authentication server, so testing focuses on the sign-in method and on whether devices check the server's certificate, because a device that does not can give its credentials to a look-alike network. See the section on What a Wi-Fi security assessment covers above.
If we use WPA3, do we still need a wireless test?
Usually, yes. WPA3 is designed to resist the offline password guessing that weakened WPA2-Personal, but published research such as the Dragonblood disclosures showed flaws in early implementations, and many networks run WPA3 in a transition mode that still accepts WPA2 devices on the same SSID. Guest separation, rogue access points and device certificate settings are also unaffected by the protocol version.
Will a wireless test disrupt our users?
Most of a wireless test is listening, or joining networks the way any device would. A few checks can briefly disconnect devices from an access point, so whether they are allowed, on which networks and at what times is agreed in writing before the visit. Devices that must stay connected, such as those running a production line or a clinical system, can be excluded from those checks.
Do you test Wi-Fi run by our landlord or a neighboring company?
Only with written permission from whoever owns or runs it. A wireless test covers networks your organization owns or controls and has authorized in writing. Where a building's shared Wi-Fi is run by a landlord or a managed service provider, their permission is needed before it is included; networks that belong to other businesses are left alone.
What do we receive at the end of a wireless test?
Two reports, one for management and one for the network team, with every finding tied to an SSID and a location, a proof of concept and a fix. Findings are scored with CVSS 3.1, and the report adds a per-SSID matrix of encryption, segmentation and client posture, any shared keys recovered so they can be changed, the unknown access points found, and a remediation roadmap and matrix. See the section on What you receive from a wireless test above.
Is wireless testing required for PCI DSS?
PCI DSS 4.x has wireless requirements of its own. Requirement 11.2.1 asks for authorized and unauthorized wireless access points to be detected and identified at least once every three months, and 1.3.3 for network security controls between wireless networks and the cardholder data environment. Which requirements apply to you, and what evidence is enough, is for your QSA to confirm, so it helps to send us their requirement before scoping. See the section on Wireless testing for PCI DSS, ISO 27001 and SOC 2 above.
Can a wireless test be combined with an internal network penetration test?
Yes. The wireless test shows whether an outsider can get onto your network or across from the guest side; the internal network test shows how far someone already on the network could go. They can be scoped in one proposal, and when the internal test is also done at your premises rather than remotely, both can be carried out on the same visit.