SEC617: Wireless Penetration Testing and Ethical Hacking

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

• CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
• CRITICAL: Apple Silicon devices or devices using ARM-based processors cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
• BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
• 8GB of RAM or more is required.
• 60GB of free storage space or more is required.
• At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
• Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
• A wired Ethernet network adapter is required for this course. This can be either an internal or an external USB-based network adapter but you cannot use wireless networking alone.

Additional requirements for this course:

• You will need a pair of headphones to listen to audio and video components of the labs in this course.
• Additional optional components for this course:
• At times during the labs in this class, your host laptop will be connected to a local-device network. You will NOT have Internet access from your laptop during those labs. If you wish to retain Internet access (to include class Slack access for Live/Live Online students, access to the instructor's session for Live Online students, or access to the OnDemand player for OnDemand students), you may wish to have an additional device with Internet access during those labs.

Mandatory Host Configuration and Software Requirements

• Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
• Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
• Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
• Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
• You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
• Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
• Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. Note that Broadcom now offers VMWare Workstation Pro and VMWare Fusion Pro for free, which are recommended for the best experience.
• On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
• Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact customer service.

SEC617 training is recommended for a diverse range of individuals, including:

• Ethical hackers and penetration testers
• Network security staff
• Network and system administrators
• Incident response teams
• Information security policy decision-makers
• Technical auditors
• Information security consultants
• Wireless system engineers
• Embedded wireless system developers

The GIAC Assessing and Auditing Wireless Networks (GAWN) certification is designed for technologists who need to assess the security of wireless networks. The certification focuses on the different security mechanisms for wireless networks; the tools and techniques used to evaluate and exploit weaknesses; and the techniques used to analyze wireless networks. Candidates will have an understanding of how the tools operate and the weaknesses in protocols that they evaluate.

• Attacking weak encryption, 802.11 fuzzing attacks, and bluetooth attacks
• Bridging the air gap, DoS on wireless networks, high-frequency RFID attacks, and RFID applications
• Hotspots, low-frequency RFID attacks, NFC, practical SDR attacks, and rogue networks
• Sniffing wireless, wireless basics, wireless client attacks, and WPA

More Certification Details

• Step-by-step instructions for all lab exercises
• Cheatsheets used for quick reference to detailed information sources
• Access to associated software, files, and analysis resources
• MP3 audio files of the complete course lectures
• SWAT Hardware Kit
• ALFA AWUS036ACM Wi-Fi card
• Panda PAU0B6 Wi-Fi card
• Bluetooth UD100 adapter
• ACR122U RFID read/writer (2)
• RTL-SDR radio and antenna (R820T2)
• MIFARE Ultralight key fob
• Raspberry Pi 4 (PiPoint) (32gb) (SD Card)
• 4 port powered USB hub
• Note: This comes with a US plug. International students, please obtain an adapter.
• Cat5 Cable Retractable
• String Bag
• ACR122U RFID read/writer #2
• Raspberry Pi 4 (PiSense) (32gb) (SD Card)
• Note: This comes with a US plug. International students, please obtain an adapter.
• MIFARE Classic 1K smart card

This course and certification can be applied to a master's degree program at the SANS Technology Institute.

Wireless hacking refers to the exploitation of vulnerabilities in wireless networks to gain unauthorized access, intercept data, or disrupt connectivity. It involves techniques such as password cracking, packet sniffing, and exploiting misconfigured access points. These tactics are commonly used by threat actors to infiltrate networks without physical access.

Understanding Wireless hacking is essential for defenders. As wireless networks extend beyond physical perimeters, they become prime targets for attackers seeking to bypass traditional security controls. Learning how these attacks work equips cybersecurity professionals to harden wireless environments, implement effective monitoring, and reduce risk.

At SANS, we teach wireless testing not to create attackers, but to emulate their techniques and prepare your organization to stop them. Our courses give professionals hands-on experience with both attack and defense tools, ensuring they can recognize signs of compromise and build more resilient networks.

SEC617: Wireless Penetration Testing and Ethical Hacking gives you hands-on mastery over one of the most overlooked—and vulnerable—attack surfaces in enterprise environments: wireless networks.

If you're a penetration tester, red teamer, or blue team defender, SEC617 will elevate your career by enabling you to:

• Identify and exploit real-world wireless vulnerabilities using tools like Kismet, Wireshark, and Aircrack-ng
• Understand the attacker mindset so you can defend WLAN, Bluetooth, and other RF-based systems
• Build credible offensive security skills trusted by top security teams globally
• Earn the GIAC Wireless Network Professional (GIAC-GAWN) certification to validate your skills and stand out in the job market

In a threat landscape where wireless access often bypasses physical security controls, SEC617 positions you as the expert who knows where others overlook. You’ll bring immediate value to employers by being able to test, secure, and advise on wireless infrastructure that many organizations ignore—until it’s too late.

At SANS, we don’t teach theory—we teach professionals how to solve real-world problems with skill and confidence.