Evil-twin / rogue AP (enterprise credential harvesting)

When it applies

An authorized assessment of a WPA2-Enterprise (802.1X) network, or a captive-portal Wi-Fi, where clients can be lured to a look-alike AP. pentest-only, in-scope SSIDs recorded in scope.txt, and coordinated so you only capture test/consenting users' credentials per RoE.

Why it works

WPA2-Enterprise authenticates users to a RADIUS server, but many clients don't properly validate the RADIUS server's certificate. A rogue AP advertising the same SSID can complete enough of the PEAP-MSCHAPv2 exchange to capture each user's username + MSCHAPv2 challenge/response, which cracks offline to the domain password. Captive portals simply hand you the credentials the user types.