Rogue APs are the most reliable wireless attack vector in corporate pentesting. Clients trust what they know, and they'll connect to an AP broadcasting the SSID they're looking for. Here's the full operational guide on hacking with rogue access points (APs).