Performing AP-less Attacks

AP-less attacks are a type of wireless-based where the penetration tester sets up an access point to mimic a legitimate wireless network without the need to immediately access the legitimate targeted network. Sometimes, this type of attack is used to determine whether users unknowingly connect to malicious wireless networks that are pretending to be legitimate. In addition, this attack type can be used to capture the WPA handshake from a wireless client that contains the legitimate key for accessing a targeted wireless network.

In an AP-less attack, the access point or wireless router is not present in the vicinity but a wireless client such as a laptop or even a smartphone is broadcasting probes, seeking to establish a connection with a targeted wireless network that within its preferred network list. Penetration testers can attempt to retrieve the password/passphrase of a wireless network, even if the wireless router or access point is not present...