With regard to the distance from which an attacker could maintain such access, the office WiFi network appears to have a relatively strong signal, which extends to the street out front: {photograph of location} Figure 1: WiFi signal strength from a nearby location {screenshot of WiFi strength} Material that may be Useful: Tutorial: “How to Crack WPA/WPA2” (Aircrack-ng Wiki) “Aircrack-ng” (Aircrack-ng Wiki) Documentation: “Aireplay-ng” (Aircrack-ng Wiki) Documentation: “Airodump-ng” (Aircrack-ng Wiki) Recommendation WPS PIN CRACKING Summary WPS was built as an addition to WPA to make it easier to add devices without typing in secure passwords, but this ease of use means that a malicious actor can pose as a device and effectively reduce the potentially very difficult passwords WPA allows down to a simple numeric-only 8 character PIN. Further, the WPS system allows an attacker to work on this PIN in two parallel chunks, further reducing its security. This, like WEP, is a "live" attack - you have to stay connected to the network - but also like WEP, it is a guaranteed attack; your brute forcing of the WPS system will eventually (2-10 hours) allow you network access. Walkthrough Find the BSSID of the target routerr Use Wash to find WPS Routers Page 50 of 240