802.1X
802.1X is the IEEE standard for port based network access control: a device connecting to a wired port or a wireless network must authenticate before the port carries any other traffic. Three parties are involved, the client, the switch or access point that enforces the block, and an authentication server that makes the decision.
What travels between the three parties is EAP, and the EAP method decides almost everything about the security of the deployment. Certificate based mutual authentication is the strong option: both sides prove identity with certificates and there is no password to capture. Methods that tunnel a password exchange inside TLS are far more common because they deploy easily, and they are only as strong as the client’s willingness to check the server certificate.
That is the finding we look for first. A client configured to accept any certificate, or to trust a public authority rather than the organisation’s own, completes the tunnel with an evil twin access point we control and hands over the challenge and response for offline cracking. It is a client setting, so it is invisible from the infrastructure side and is pushed by profile to every device at once.
Two more items belong in a report. Fallback for devices that cannot speak the protocol, authenticated by hardware address, which is trivially spoofed from a printer. And what a port grants once authentication succeeds: a device dropped onto a flat network has passed the control and defeated its purpose, so the result should be an assigned segment. The authentication server protocol behind all of this is RADIUS, a component rather than another name for the standard, and the wireless side sits with WPA3. Testing it is the core of the wireless testing where the EAP method and its certificate validation are put under load.