Data Points

📶 Wi-Fi BSSID

🔗 Analyst pivots

🔍 Lookup

📜 Playbook — Wi-Fi BSSID exploitation

1. Direction — frame the requirement for Wi-Fi BSSID: what decision does this support, by when?
2. Collection — pull the 0 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Wi-Fi BSSID

A Wi-Fi BSSID is the 48-bit MAC address of a wireless access point's radio identifying a specific basic service set. In investigations it geolocates a physical access point through wardriving databases, ties devices to a location and network, and supports rogue-AP, evil-twin, and movement-tracking analysis.

Format: 48-bit MAC format XX:XX:XX:XX:XX:XX; often paired with SSID, channel, and encryption. Multi-SSID radios increment the low bits; OUI identifies AP vendor.

📡 How it is collected

• 802.11 beacon and probe-response frames
• Wardriving captures (Kismet/WiGLE)
• Client device Wi-Fi scan lists
• Geolocation API queries
• Site-survey / spectrum tools
• Device connection logs

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• BSSID-to-geolocation lookup (wardriving DBs)
• Evil-twin / rogue-AP detection (SSID+BSSID mismatch)
• Signal-strength trilateration
• OUI vendor fingerprinting
• Co-located BSSID neighborhood mapping
• SSID history and movement tracking
• Hidden-SSID discovery
• Karma/probe-request correlation

🔧 Tools

• Kismet
• WiGLE (app/API)
• aircrack-ng suite
• airodump-ng
• Wireshark
• wifiphisher
• Wifite

⚡ Workbench actions

• Geolocate BSSID (WiGLE)
• Resolve OUI vendor
• Detect evil-twin/rogue AP
• Map co-located BSSIDs
• Plot signal trilateration
• Track observed-location history
• Correlate associated clients
• Pivot to SSID intelligence

📊 Dashboard KPIs

📂 Open