Ethical › Module 16 › Lesson 4
Lab — Audit YOUR Home Wi-Fi Settings
Write encryption mode and guest-network status for a network you administer.
Visual · wifi_audit_lab
Open YOUR router or hotspot settings. Write encryption mode and guest-network status. Hypothetical you own if you administer none. chmod 600. Never café or neighbor.
Opening
The lab is a locked audit of a network YOU administer. If you administer none, you write a hypothetical you own plus an ethics line — you do not audit the café.
Lessons 1–3 named the lock, the lookalike you refuse, and the hardening ticket. This lab is the hands: open the settings UI of a Wi-Fi network THE USER ADMINISTERS (home gateway, travel router, phone hotspot you created) and write encryption mode and guest-network status into $HOME/cyberlium-lab/ceh-wifi-audit-lab.txt, then chmod 600. No passphrase. No hallway scan. No neighbor 192.168.1.1. If you administer no Wi-Fi — dorm that forbids it, no router — you still complete: label a hypothetical you would own, fill the two facts as you would set them, and write an ethics line that you did not audit café, campus, hotel, or neighbor. That hypothetical is a passing artifact. A café survey is a failing one. This is original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. Next is Quiz — Wireless, then Module 17: phones YOU own.
1. Lab surface: a network YOU administer — or a labeled hypothetical you own
“Administer” means you may open the router, ISP app, or hotspot settings and change them without asking a school, employer, café, or neighbor. Pick that network. Write a private label (“home gateway,” “lab AP,” “phone hotspot”) — not a campus asset tag, not the shop’s SSID. If you cannot change any wireless settings, you do not “borrow” the café. You switch to the hypothetical path in heading 3. Easy is the point: you are proving you can read YOUR encryption mode, not filling a binder with other people’s radios.
One network. Yours. Do not nmap the LAN “to find more APs.” Do not enable monitor mode. Do not list every SSID the phone picker shows. Those extra names are other people’s labels (Lesson 1). The checker will not award extra credit for a hallway census. It will fail if café/neighbor/campus bait phrases show up as the audited target.
Command guide
Network YOU administer — WHAT/WHY
═══ COMMANDS ═══
Command — copy this
cat > "$NOTES" << 'EOF' === WIFI AUDIT LAB (Cyberlium M16 L04) === ASSET: (MY home SSID / hypothetical I own) ENCRYPTION_MODE: (WPA3/WPA2/other — fill; NEVER paste PSK) GUEST_NETWORK: (Y/N/n/a) ETHICS: not cafe, not neighbor EOF
2. Required rows: encryption mode and guest-network status — plus ethics, no PSK
Required keys: DISCLAIMER, DATE_UTC, NETWORK_I_ADMINISTER (or HYPOTHETICAL_I_OWN), ENCRYPTION_MODE, GUEST_NETWORK, ROUTER_ADMIN, FIRMWARE, ETHICS. ENCRYPTION_MODE is WPA3, WPA2-Personal, mixed, open (if that is honestly a guest you isolated), or “vendor UI said secured — I did not crack to find out.” GUEST_NETWORK is on, off, or not offered. ROUTER_ADMIN: unique password set or skip-with-reason — never the secret. FIRMWARE: updated or check date. ETHICS: no café/neighbor/campus audit, no aircrack, no public rogue AP.
DISCLAIMER must include: original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. Do not paste the passphrase, QR, or admin cookie. Mode 600 so another local account does not read even the mode row. Sibling notes stay; they are not substitutes for this filename.
Command guide
Required rows, no PSK — WHAT/WHY
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
grep -E "ENCRYPTION_MODE|GUEST_NETWORK|ETHICS" "$NOTES"
python3 - << 'PY'
from pathlib import Path
t = (Path.home()/'cyberlium-lab'/'ceh-wifi-audit-lab.txt').read_text(encoding='utf-8','replace').lower()
print('FAIL psk dump' if 'psk=' in t or 'wifi password:' in t else 'PASS: no PSK dump language')
PY3. If you administer no Wi-Fi: hypothetical you own + ethics line — never café or neighbor
Dorm bans, hotel-only travel, locked work laptop, no hardware: you still pass. Set the network row to HYPOTHETICAL_I_OWN and describe a home lab you would run (WPA3, guest on, unique admin password, firmware habit). Write ETHICS: I do not administer Wi-Fi today; I did not audit café, campus, hotel, or neighbor as a substitute. That pairing is the assigned completion — not a lesser grade. It is how this course keeps Module 1’s permission line when the radio is not yours.
Fails the course: ENCRYPTION_MODE from a café picker; “auditing” the neighbor because their name is visible; a handshake file as proof; a rogue AP you stood up “so I would have something to administer.” Still passes if you tell the truth: ISP app shows “secured”; you write “secured — vendor UI did not name WPA2 vs WPA3 — I did not crack to find out.” Honesty without a stranger’s radio is the lab.
4. How to look without attacking: YOUR settings UI, not a sniffer and not a hallway
Home gateway: ISP app or the LAN address on YOUR sticker, from a device already on YOUR network. Phone hotspot: YOUR hotspot settings. Travel router: the UI you set up. Record encryption and guest from those screens. Do not aircrack “to confirm.” Do not capture a handshake. Do not Wireshark the radio (Module 8’s only capture lab was loopback HTTP you started). Do not log into 192.168.1.1 on a network you joined as a guest. Guest on café Wi-Fi is a customer, not an admin.
OS “properties” panels may show “secured” without naming WPA3. Prefer the router UI you administer. If you only have the client panel, write what it said and that you did not escalate into a stranger’s AP. Stop when notes are filled. Do not leave an admin session open on a shared browser. Do not screenshot a passphrase QR into the lab folder.
5. Hygiene and lockdown: chmod 600, no PSK, no extra radios
chmod 600 on Unix-like systems; WSL/Git Bash or NTFS ACLs on Windows. World-writable 777 fails. Notes that list other people’s SSIDs as the audited network fail ethics even if Python printed PASS. If the checker refused because you left placeholders or café bait, fix YOUR file and rerun. Do not “fix” it by pasting a hallway survey.
Keep the wireless note set mode 600. Empty any file that accidentally got a passphrase. A lookalike of YOUR SSID is Lesson 2 recognition plus Lesson 3 passphrase change on YOUR box — still not a deauth war. This lab does not unlock monitor mode. It unlocks a mode-600 file that says you read settings you are allowed to read.
6. Wrong vs right: café/neighbor audit vs YOUR UI (or a hypothetical plus ethics)
Worked failure — same word “audit,” opposite target. Right never needs a second building when your own gateway (or a labeled hypothetical) can fill two rows.
Wrong
Audit café, campus, hotel, or neighbor. Aircrack or hashcat to “see the mode.” Attach a handshake. Stand up a public rogue AP so you have an SSID. HOST/SSID from argv pointing at the hallway. Notes chmod 777 with the house PSK. Call the lab incomplete without a stranger’s radio. This course is not official CEH training and does not grade that hunt.
Right
Open settings of a network YOU administer; write ENCRYPTION_MODE and GUEST_NETWORK (no passphrase). If you administer none: HYPOTHETICAL_I_OWN plus ethics (no café/neighbor). Fill ceh-wifi-audit-lab.txt, chmod 600 under $HOME/cyberlium-lab. Next: Quiz — Wireless.
7. Hands-on: write the audit, check headings, chmod 600, do not scan others
Follow the block. Fill YOUR words. Run the checker. chmod 600. Windows notes sit at the bottom of the script comments. There is no monitor mode, no handshake, no extra host.
Mission: ceh-wifi-audit-lab.txt — YOUR mode + guest status, chmod 600
1) Open settings of a Wi-Fi network YOU administer and write ENCRYPTION_MODE and GUEST_NETWORK (no passphrase). If you administer none, write HYPOTHETICAL_I_OWN plus an ethics line. 2) Fill $HOME/cyberlium-lab/ceh-wifi-audit-lab.txt, run the checker, chmod 600. 3) Ethics: never café, campus, hotel, or neighbor. No aircrack, no hashcat, no public rogue AP. Original Cyberlium teaching, not official CEH training, not a cert.
Stuck? Ask Cyberlium AI Mentor
If “the lab is incomplete without a café or neighbor SSID” still feels true, ask for a hint — not a target. Try: "Hint only: why ENCRYPTION_MODE and GUEST_NETWORK come from MY router UI, why a hypothetical I own plus ethics is a pass if I administer no Wi-Fi, and why café/neighbor/aircrack fail?" You still fill ceh-wifi-audit-lab.txt. No handshake. No hallway survey.
You audited wireless without leaving authorization: YOUR settings UI or a labeled hypothetical you own, encryption mode and guest status, locked notes, no passphrase, no stranger radio. That is authorized wireless practice as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Wireless — ten APPLY items. Then Module 17: Mobile as a High-Value Endpoint — phones you own, still not a stranger’s device.
Knowledge Check
APPLY: You do not administer any Wi-Fi (dorm rules). What is the ethical completion, and what is not?
Multiple choice
Knowledge Check
APPLY: True or False: If your ISP app is boring, the ethical lab is to open 192.168.1.1 on café Wi-Fi and hashcat a neighbor handshake.
True or False
Knowledge Check
APPLY: Which note file pairing matches this lab’s ethics and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice