Ethical › Module 16 › Lesson 3
Home Lab Hardening
Strong router password, WPA3, guest VLAN, updates.
Visual · home_wifi_hardening
Harden gear YOU own: unique router-admin password, WPA3 (or WPA2 with a long passphrase), guest isolation, firmware updates. Never a neighbor’s AP.
Opening
Hardening is settings on a router YOU administer. It is not a survey of the hallway, and it is not a twin you aim at a café.
Lesson 1 named the lock. Lesson 2 named the lookalike you refuse. This lesson is the fix list for an AP whose admin you are: unique router-admin password (not the sticker default), WPA3 when the box and clients allow it, a guest network so visitors and gadgets do not sit on your full LAN, and firmware updates. Those are defender actions on YOUR gear — not a homework set in cracking the apartment next door. This is original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. No neighbor 192.168.1.1. No café passphrase “help.” Next is the audit lab: encryption mode and guest status for a network you administer, or a labeled hypothetical plus ethics if you administer none. Here you write the hardening list as a ticket, not a weapon.
1. Router admin password: the sticker is not a secret, and the neighbor’s gateway is not yours
Consumer routers ship with an admin UI. The factory password on a sticker is a shared default, not a unique secret. Anyone who can still reach that UI with the default can change YOUR Wi-Fi. On a box you own: set a unique admin password (manager if you use one), do not reuse it as the Wi-Fi passphrase, and do not leave remote-admin from the internet on unless you have a written reason. That is Module 6 hygiene on a radio box — not a scan of every gateway on the floor.
Wrong instinct: “I will try admin:admin on the café router to confirm Lesson 3.” That is unauthorized access. You do not have RoE for that UI, or for a roommate’s extender unless they asked you in writing and you are the admin. If this is a locked ISP gateway you must not reconfigure, write skip-with-reason and complete what you are allowed to change. Do not “borrow” a neighbor because your ISP app felt limited.
Command guide
Router admin password — WHAT/WHY (sticker is not a secret)
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' sticker_password: change it on gear I administer demo_gate: router login at 192.168.0.1 => STOP as a hacking target refuse: hydra neighbor gateway EOF
2. WPA3 (or WPA2 with a long unique passphrase) on the SSID YOU own
Lesson 1 named WPA2/WPA3 as the lock. This lesson makes it a setting: prefer WPA3-Personal when every client you care about can join. If an old device cannot, WPA2-Personal with a long unique passphrase is still a lock — still not open, still not WEP. Do not put the passphrase in notes. Write “long unique passphrase set,” not the secret. Do not reuse it as email or router-admin. If you run an open guest, isolate it from your LAN and treat it as Lesson 1’s threat model for that SSID.
WPS push-button or PIN convenience is a named risk. If YOUR UI offers a disable toggle, turning WPS off is a hardening row — a setting you own, not a stranger-WPS lab. Hidden SSID and MAC filters remain comfort, not the lock. Enterprise settings on a campus AP you do not administer stay out. You are choosing a mode on a radio whose admin you are.
3. Guest network / guest VLAN: visitors and IoT off YOUR full LAN
A guest SSID (sometimes guest VLAN / AP isolation) is a second name whose clients should not browse your printers, NAS, or laptops. Visitors get the path you intend. Gadgets that only need a cloud vendor often belong there too (Module 10: defaults, updates, segment). Lesson 4’s guest-status row means: on, off, or not offered. You do not VLAN-hop a campus. You do not place a neighbor’s IoT on your guest “to help.”
If your gateway has no guest toggle, write “not offered — I do not give visitors the main passphrase” or “I will enable when the ISP adds it.” That is an honest ticket. Inventing a guest by copying a café name is Lesson 2’s failure, not a VLAN. Bridging guest back onto LAN “so Chromecast works” is a trade you may accept on YOUR box with eyes open — write the trade. Do not accept it on a network you do not own.
4. Firmware updates: the radio is software, and neglected firmware is a botnet story
Access points run firmware. Module 10 already said forgotten routers get recruited when defaults and missing updates pile up. Check for a firmware update on a box YOU own, apply it in a window you can recover from, or record the check date. Do not download a random “router tool.” Do not flash a neighbor. Do not hunt Shodan for other people’s gateways. Inventory is YOUR model, YOUR ISP app — not a recruitment kit.
Retire what cannot be updated: a WEP-only extender you still own is a Lesson 1 retirement, not a crack target. Replace or unplug. Keep admin off the internet if you do not need it. Write the firmware date. Empty “I have a firewall” with a default Wi-Fi passphrase is the same hollow compensate Module 5 already rejected.
5. What you record: four rows for gear YOU own — password, WPA, guest, updates
A home-hardening note is a ticket. Date (UTC). Device: “personal gateway” or “lab AP” — not a café. Router_admin: unique password set or skip-with-reason. Encryption: WPA3 / WPA2 / other — mode only, no passphrase. Guest: on / off / not offered. Firmware: updated or check date. WPS: off if offered. Ethics: NEVER neighbor UI, café change, aircrack, or public rogue AP. Legal line: original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. File: $HOME/cyberlium-lab/home-wifi-hardening-notes.txt, chmod 600.
Do not fill the device row with school Wi-Fi or the shop downstairs. Do not add “handshake I would crack.” Next lesson fills the same rows from YOUR settings UI (or a hypothetical plus ethics). A filled hardening file is a complete Lesson 3. Do not scan the hallway to “compare baselines.”
6. Wrong vs right: hardening the hallway vs a ticket on YOUR gateway
Worked failure — same word “harden,” opposite blast radius. Right never needs a second AP when your own gateway still has a default sticker.
Wrong
Log into a neighbor or café gateway. Reset their passphrase “to help.” Aircrack to prove they used WPA2. Stand up a guest SSID that copies a campus name. Skip chmod. Paste the Wi-Fi secret into a gist. Call the lesson incomplete without a hallway survey. This path is not official CEH training.
Right
On gear YOU administer: unique router-admin password, WPA3 (or WPA2 with a long unique passphrase), guest isolation if offered, firmware check, WPS off if offered. File $HOME/cyberlium-lab/home-wifi-hardening-notes.txt, chmod 600. No neighbor. No café. Next: Lab — Audit YOUR Home Wi-Fi Settings.
7. Hands-on: lock home-wifi-hardening-notes.txt — YOUR settings, not a hallway scan
On a computer you own, create cyberlium-lab if needed. Fill the template for a gateway or AP you administer, or write skip-with-reason plus a labeled hypothetical. chmod 600. The block writes notes only — no scan, no extra SSID, no neighbor UI.
Command guide
Guest network — WHAT/WHY then lock
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' guest_or_iot_ssid: visitors/gadgets off MY full LAN (Y/N/n/a) no_psk_in_this_file: Y EOF
Mission: home-wifi-hardening-notes.txt in cyberlium-lab (mode 600)
1) In your own words: unique router-admin password, WPA3/WPA2 on YOUR SSID, guest isolation, firmware check — no crack commands. 2) Fill $HOME/cyberlium-lab/home-wifi-hardening-notes.txt for gear you administer (or skip-with-reason). chmod 600. Do not write passphrases. 3) Ethics: no neighbor/café UI, no aircrack, no public rogue AP, no hallway survey.
Stuck? Ask Cyberlium AI Mentor
If “I cannot learn hardening without logging into a stranger’s router” still feels true, ask for a hint — not a target. Try: "Hint only: why the sticker default is not a secret, why WPA3 is the lock on MY SSID, what guest isolation is for, and why Lesson 4 stays on a network I administer?" You still fill home-wifi-hardening-notes.txt. No café. No aircrack.
You now treat home wireless as a ticket on gear you own: unique admin secret, WPA3 or WPA2 with a long passphrase, guest isolation, firmware, WPS off if offered. None of those is a hallway scan or a public twin. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. Next — Lab — Audit YOUR Home Wi-Fi Settings — encryption mode and guest-network status for a network you administer, or a hypothetical you own plus an ethics line.
Knowledge Check
APPLY: A teammate wants to “confirm WPA2” by aircracking the café and logging into 192.168.1.1 downstairs. What is hardening here, and what do you do?
Multiple choice
Knowledge Check
APPLY: True or False: The ethical way to learn guest VLANs is to attach a neighbor’s camera to your SSID and disable WPS on the campus AP.
True or False
Knowledge Check
APPLY: Which pairing matches this lesson’s artifact and the next lab?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice