My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to "connect automatically" to those known networks.
I understand from this article that that I should be able to capture the SSIDs my phone knows about by sniffing wireless traffic on another device.
On another computer, I have a wireless adapter put into monitor mode by airmon-ng (channel 6, but all channels seemed about equal in the traffic captured).
Reading the packets with t-shark with the command
tshark -i wlan0mon subtype probereq I can see many probe requests that include the SSIDs of (hidden or not ) wireless access points in my home that other devices are connecting to. I can see other probe requests coming from my Windows phone (based on the MAC address is the same), but the SSID for those probes just says "broadcast".
A probe request is a special frame sent by a client station requesting information from either a specific access point, specified by SSID, or all access points in the area, specified with the broadcast SSID
Can I conclude from this that my phone only sends "broadcast" probe requests and connects automatically to known access points when they identify themselves (rather than my phone sending the specific info "coffee_shop")? If so, can I then conclude that my phone does not reveal access points it knows about unless one responds to a broadcast probe request?
If all mobile devices behaved like my phone, then how would an attacker pull off the type of attack used by Wifi Pineapple, which works by answering "yes" to probe requests from wireless devices sending specific SSIDs?