Skip to main content

Lab 1.4: Management and Security of Wi-Fi Credentials

Learning Objectives​

By the end of this lab, you will be able to:

  • Understand how Windows stores Wi-Fi passwords
  • Manage the network profiles saved on your system
  • Identify the risks associated with credential storage
  • Apply security measures to protect your information
  • Evaluate the importance of physical security of machines

Estimated Duration​

25 minutes

Prerequisites​

  • Labs 1.1, 1.2, and 1.3 completed
  • Windows computer with Wi-Fi connection (or Wi-Fi connection history)
  • Administrator access

Professional Context​

Credential management is a critical aspect of computer security. On Windows, Wi-Fi passwords are stored to allow automatic reconnection, but this poses security risks if:

  • A device is stolen or compromised
  • An attacker gains temporary physical access
  • Malware with elevated privileges runs

This lab teaches you to:

  • Audit stored credentials on a system
  • Understand attack vectors related to credential storage
  • Apply security best practices

Professional use cases:

  • Security audit of workstations
  • Forensic investigation
  • Compliance management (GDPR, ISO 27001)
  • Risk assessment related to device loss or theft

READ BEFORE STARTING:

The techniques presented in this lab allow access to Wi-Fi passwords stored on a Windows system. These commands are legitimate administration tools, but their use must comply with the following rules:

AUTHORIZED:

  • On your own personal computer
  • On systems you own or are the authorized administrator
  • As part of a security audit with written authorization
  • In the lab environment provided as part of the course

PROHIBITED AND ILLEGAL:

  • On another person's computer without their explicit consent
  • On corporate systems without formal authorization
  • To access networks without authorization
  • To share or sell Wi-Fi access

Legal consequences: Unauthorized access to computer systems and networks is a crime in Canada (Criminal Code, sections 342.1 and 430(1.1)) and can lead to:

  • Criminal prosecution
  • Significant fines
  • Imprisonment
  • Criminal record
  • Expulsion from the educational institution

Ethical commitment: By completing this lab, you commit to using this knowledge ethically and legally, respecting others' privacy and property.

Part 1: Understanding Wi-Fi Credential Storage​

Step 1.1: Network Profile Concept​

When you connect to a Wi-Fi network for the first time, Windows creates a "profile" that contains:

  • The SSID (network name)
  • The security type (WPA2, WPA3, etc.)
  • The password (security key)
  • The automatic connection settings

These profiles are stored to allow automatic reconnection without re-entering the password.

Storage location: Profiles are stored in the Windows registry and in encrypted XML files in:

C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\

Step 1.2: Security Implications​

Risks:

  1. Physical access: Someone with access to your computer can retrieve all your Wi-Fi passwords
  2. Malware: Malicious software with admin privileges can exfiltrate these credentials
  3. Theft/Loss: If your computer is stolen, the attacker can access your networks
  4. Forensics: Credentials remain even after disconnecting from the network

Questions:

  1. Why do you think Windows stores Wi-Fi passwords?
  2. What are the advantages and disadvantages of this system?

Part 2: Listing Saved Wi-Fi Profiles​

Step 2.1: View All Saved Profiles​

Open the command prompt (no need to be admin for this command)

Run:

netsh wlan show profiles

Observe:

  • The list of ALL Wi-Fi networks you have connected to
  • This includes networks from your home, work, cafes, airports, etc.

Questions: 3. How many Wi-Fi profiles do you have saved? 4. Do you recognize all these networks? 5. Are there networks you no longer connect to?

Step 2.2: Analyze the List​

For each profile, note:

  • Trusted networks (home, work)
  • Public networks (cafes, libraries)
  • Networks you do not recognize or no longer use

Security best practice: Delete profiles of networks you no longer use to reduce the attack surface.

Part 3: Extracting Passwords​

Step 3.1: Retrieve a Password​

IMPORTANT: Open a new command prompt as administrator

Run (replace "MY_WIFI" with the exact name of one of your networks):

netsh wlan show profile name="MY_WIFI" key=clear

Observe the "Security settings" section:

Security settings
-----------------
Authentication         : WPA2-Personal
Cipher                 : CCMP
Security key           : Present
Key Content            : YourPassword123

The password appears in clear text on the "Key Content" line.

Questions: 6. Were you able to retrieve your Wi-Fi network password? 7. Is the password complex and secure? 8. What do you think about Windows allowing this?

Step 3.2: Profile Security Information​

In the same output, also observe:

  • Authentication type: (WPA2, WPA3, WEP - obsolete)
  • Cipher type: (CCMP, TKIP)
  • Automatic connection: (Yes/No)
  • Connect even if the network is not broadcasting: (Yes/No)

Questions: 9. What is the security type of your main network? 10. Is automatic connection enabled? 11. Is it a good practice to automatically connect to public networks?

Step 3.3: Test with Multiple Networks​

Repeat the operation for 2-3 other networks:

For a cafe/public network:

netsh wlan show profile name="Starbucks_WiFi" key=clear

For a work network:

netsh wlan show profile name="Office_Secure" key=clear

Questions: 12. Do public networks generally have complex passwords? 13. Is there a security difference between your different profiles?

Part 4: Exporting Profiles​

Step 4.1: Create an Export Folder​

Create a temporary folder:

mkdir C:\Temp\WiFi_Export

Step 4.2: Export All Profiles with Passwords​

Run (as admin):

netsh wlan export profile key=clear folder="C:\Temp\WiFi_Export"

This command creates an XML file for each Wi-Fi profile.

Go to the folder:

explorer C:\Temp\WiFi_Export

Open an XML file with Notepad:

  • Look for the <keyMaterial> tag
  • The password is in clear text between the tags!

Questions: 14. How many files were exported? 15. Is the password in the XML in clear text? 16. What would happen if someone copied these files to a USB drive?

Step 4.3: Security Implications​

Attack scenario:

  1. Attacker gains physical access (30 seconds)
  2. Executes the export command
  3. Copies the XML files to a USB drive
  4. Now they have all your Wi-Fi passwords

Time required: Less than 60 seconds if the computer is unlocked.

Questions: 17. How could you protect yourself against this type of attack? 18. Why is it important to lock your computer when you step away?

Part 5: Scanning Nearby Networks​

Step 5.1: View Available Networks​

Run:

netsh wlan show networks mode=bssid

Observe:

  • SSID: Network name
  • Network type: Infrastructure (access point) or ad-hoc
  • Authentication: Open, WPA2, WPA3, etc.
  • Cipher: CCMP, TKIP, or none
  • Signal: Signal strength (%)
  • BSSID: MAC address of the access point
  • Channel: Radio frequency used

Questions: 19. How many Wi-Fi networks are currently in range? 20. How many networks are "Open" (no password)? 21. Are there any networks using WEP (obsolete and insecure)?

Step 5.2: Analyze Network Security​

For each visible network, note:

  • Name (SSID)
  • Security type
  • Signal strength

Create a table:

SSID              | Security | Signal | Secure?
------------------|----------|--------|----------
MyWiFi_5G         | WPA2     | 100%   | Yes
Cafe_Public       | Open     | 75%    | No
Neighbor123       | WEP      | 50%    | No (obsolete)

Questions: 22. What percentage of visible networks are "Open"? 23. Would you be tempted to connect to an open network? Why or why not?

Step 5.3: Active Interface Information​

Run:

netsh wlan show interfaces

Observe:

  • Name of your Wi-Fi adapter
  • State (connected/disconnected)
  • Current SSID
  • BSSID of the access point
  • Radio type (802.11n, 802.11ac, 802.11ax/Wi-Fi 6)
  • Channel used
  • Receive/transmit speed
  • Signal (%)

Questions: 24. Which network are you currently connected to? 25. What is your current signal strength? 26. What Wi-Fi standard are you using (802.11n/ac/ax)?

Part 6: Secure Profile Management​

Step 6.1: Delete an Unused Profile​

To delete a profile:

netsh wlan delete profile name="OldNetwork"

Best practice: Delete profiles of:

  • Networks you no longer use
  • Former residences
  • Hotel and public place networks
  • Networks you don't remember

Questions: 27. Why is it recommended to delete old profiles? 28. How many profiles have you deleted?

Step 6.2: Disable Automatic Connection​

For a public network, it's better to disable automatic connection:

  1. Go to Settings → Network & Internet → Wi-Fi
  2. Click on Manage known networks
  3. Select a public network
  4. Uncheck Connect automatically when in range

Or via command line (more complex, via XML editing).

Questions: 29. Which networks should have automatic connection? 30. Which networks should NOT have it?

Step 6.3: Clean Up Exported Files​

IMPORTANT - Security:

The XML files you exported contain your passwords in clear text!

Delete them securely:

del /F /Q C:\Temp\WiFi_Export\*.xml
rmdir C:\Temp\WiFi_Export

Best practice: If you need to export profiles to transfer to another PC:

  1. Export only the necessary profile
  2. Transfer via secure method (encrypted USB drive, not by email!)
  3. Delete immediately after transfer
  4. Never leave these files lying around

Part 7: Protection Measures​

Step 7.1: Best Practices - User​

To protect your Wi-Fi credentials:

  1. Automatic lock:

    • Set a lock after 1-2 minutes of inactivity
    • Windows + L to lock manually

  2. Strong password:

    • Windows account with a complex password
    • Avoid simple PINs

  3. Disk encryption:

    • Enable BitLocker (Windows Pro)
    • Protects data if the computer is stolen

  4. Monitoring:

    • Regularly check saved profiles
    • Delete obsolete profiles

  5. Public networks:

    • Use a VPN on public Wi-Fi
    • Do not check "Connect automatically"
    • Forget the network after use

Questions: 31. Does your computer lock automatically? 32. Is BitLocker enabled on your system? (Check in C: drive properties)

Step 7.2: Best Practices - Administrator​

If you manage computers in a company:

  1. Group Policy (GPO):

    • Restrict access to netsh commands for standard users
    • Enforce disk encryption

  2. Antivirus/EDR:

    • Monitor execution of credential dump commands
    • Alert on Wi-Fi profile export

  3. Audit:

    • Log connections to Wi-Fi networks
    • Monitor unauthorized access

  4. Training:

    • Raise awareness among users to lock their session
    • Physical security policy

Step 7.3: Security Check​

Security checklist:

  • Complex and unique Windows password
  • Automatic lock enabled (1-2 min)
  • BitLocker or disk encryption enabled
  • Obsolete Wi-Fi profiles deleted
  • Automatic connection disabled for public networks
  • Antivirus up to date and active
  • Windows Defender Firewall enabled

Questions: 33. How many points on the checklist have you validated? 34. What are your weak points to improve?

Part 8: Risk Analysis - Scenarios​

Scenario 1: Laptop Theft​

Situation: Your laptop is stolen in a cafe. It is not locked and BitLocker is not enabled.

Questions: 35. What information can the attacker obtain? 36. Which networks can they now access? 37. What actions should you take immediately?

Recommended actions:

  • Change the password of all your Wi-Fi networks
  • Change your passwords for important online services
  • Contact the police
  • Inform your employer if it was a work computer

Scenario 2: Temporary Physical Access​

Situation: You leave your computer unlocked for 2 minutes to go to the restroom. A curious "friend" quickly executes the export commands.

Questions: 38. Can they succeed in 2 minutes? 39. How would you notice? 40. How would you have prevented it?

Scenario 3: Malware with Admin Privileges​

Situation: You download infected software that requests admin rights. The malware executes the export command and sends the files to a remote server.

Questions: 41. How could the malware obtain admin privileges? 42. How to protect against this type of attack? 43. What tools can detect this behavior?

Part 9: Practical Lab - Complete Audit​

Exercise 9.1: Create an Audit Report​

Create a batch script audit_wifi.bat:

@echo off
echo ============================================
echo WI-FI SECURITY AUDIT
echo Date: %DATE% %TIME%
echo Computer: %COMPUTERNAME%
echo User: %USERNAME%
echo ============================================
echo.

echo [1] SAVED WI-FI PROFILES
echo.
netsh wlan show profiles
echo.

echo [2] CURRENT WI-FI INTERFACE
echo.
netsh wlan show interfaces
echo.

echo [3] NETWORKS IN RANGE
echo.
netsh wlan show networks mode=bssid
echo.

echo [4] CURRENT PROFILE DETAILS (without password)
for /f "tokens=2 delims=:" %%a in ('netsh wlan show interfaces ^| findstr "SSID"') do (
    set current_ssid=%%a
    goto :show_profile
)

:show_profile
netsh wlan show profile name=%current_ssid%
echo.

echo ============================================
echo RECOMMENDATIONS:
echo - Delete obsolete profiles
echo - Disable auto-connect for public networks
echo - Enable BitLocker
echo - Set up automatic lock
echo ============================================

pause

Run and save:

audit_wifi.bat > audit_wifi_report.txt

Exercise 9.2: Analyze Your Report​

Based on your audit report, answer:

Profiles:

  • How many profiles are obsolete? ___
  • How many should you delete? ___

Network security:

  • How many use WPA2/WPA3? ___
  • How many use WEP or are open? ___

Current configuration:

  • Current signal strength: ___
  • Security type of current network: ___
  • Automatic connection enabled? ___

Exercise 9.3: Action Plan​

Create an action plan with 5 concrete measures to improve your Wi-Fi security:

Deliverables​

To submit:

  1. Wi-Fi audit report (text file generated by the script)

  2. Analysis document (Word/PDF, 3-4 pages) containing:

    • Answers to the 43 questions
    • Table of Wi-Fi profiles with security analysis
    • Answers to the 3 scenarios
    • 5-point action plan
    • Completed security checklist

  3. Screenshots (minimum 4):

    • List of profiles (netsh wlan show profiles)
    • Password extraction (blurred if submitting publicly!)
    • Scan of networks in range
    • Profile export (folder content)

IMPORTANT: Blur or mask actual passwords in your screenshots and documents!

Evaluation Criteria​

CriterionPoints
Understanding of risks related to credential storage25%
Quality of audit and problem identification25%
Relevant analysis of attack scenarios20%
Realistic and applicable action plan15%
Quality of documentation and adherence to instructions15%

Quick Reference Commands​

Profile Management​

netsh wlan show profiles                              # List all profiles
netsh wlan show profile name="SSID"                   # Profile details
netsh wlan show profile name="SSID" key=clear         # With password
netsh wlan delete profile name="SSID"                 # Delete a profile
netsh wlan export profile key=clear folder="PATH"     # Export with passwords

Scan and Information​

netsh wlan show networks mode=bssid                   # Networks in range
netsh wlan show interfaces                            # Interface and current connection
netsh wlan show drivers                               # Driver information

Connection​

netsh wlan connect name="SSID"                        # Connect to a network
netsh wlan disconnect                                 # Disconnect

Troubleshooting​

Problem: "The WLAN AutoConfig service is not running"​

Solution:

net start WlanSvc

Problem: "Access denied" when displaying the password​

Solution: Run the command prompt as administrator.

Problem: No Wi-Fi adapter​

Solution: These commands only work on computers with Wi-Fi. If you are on a desktop without Wi-Fi, you will not see any profiles.

Going Further (Optional)​

Challenge 1: Advanced Automation Script​

Create a PowerShell script that:

  • Lists all profiles
  • Identifies profiles older than 6 months
  • Offers to delete them automatically
  • Generates a PDF report

Challenge 2: Linux Comparison​

On a Linux distribution:

  • Wi-Fi credentials are in /etc/NetworkManager/system-connections/
  • Requires root to access
  • Compare with Windows: which is more secure?

Challenge 3: Research​

Document:

  • How does Windows encrypt Wi-Fi passwords at rest?
  • Which API/function is used?
  • Can this security be improved?

Additional Resources​

Conclusion​

This lab taught you:

  • How Windows stores and manages Wi-Fi credentials
  • The risks associated with this storage
  • How to audit your own system
  • The protection measures to implement

Key lessons:

  1. Physical security = IT security: A few seconds of physical access is enough
  2. Principle of least privilege: Only store necessary profiles
  3. Defense in depth: Multiple layers of security (lock + encryption + antivirus)
  4. Constant vigilance: Regularly audit your systems

Next step: MODULE 2 where you will learn to create isolated virtual environments for your security tests!

The knowledge gained in this lab is powerful. With power comes responsibility.

You now know how to:

  • Extract Wi-Fi passwords from a Windows machine
  • Export credentials in bulk
  • Evaluate network security

Use this knowledge to:

  • Improve your own security
  • Legitimately help others (with permission)
  • Audit systems you are responsible for
  • Raise awareness of risks

NEVER use these techniques to:

  • Access systems or networks without authorization
  • Steal information
  • Harm others

When in doubt, ask yourself: "Do I have explicit permission to do this?"

If the answer is no, don't do it.

Your ethical signature:

"I, ______________, understand the ethical and legal implications of this lab and commit to using this knowledge responsibly and in accordance with the law."

Lab developed as part of the Operating Systems course - MODULE 1