MDK3 warns about WPA2 downgrade - how do I find the key in Wireshark?

Question

While stress testing my router using MDK3, I got the message "REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!"

I viewed the tool source and it showed that the WPA2 key is sent in plain text, after repeatedly being rejected due to MDK3 denying all WPA traffic. How can I view the packet containing the cleartext WPA2 key in Wireshark? I tried wlan_mgt.rsn.akms.type but it was not helpful.

MDK3 is a Wi-Fi testing tool from ASPj of k2wrlz. It uses the osdep library from the aircrack-ng project to inject frames.

edit
i may have misinterpreted the source code of mdk3. can anyone make things clear by specifying the origins of this warning and its causes.(am not a c programmer but i can still figure out what the algorithm is doing).

if (wpa_old < wpad_cycles) {
if (wep_old < wpad_wep) {
    if (!warning) {
    printf("REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!\n");
    warning = 1;
    }
}
}

Answer 1

Have you found the cleartext? If not, there seems to be a bug in the code that could explain this.

The interesting code is:

  //Is encrypted?
  if (! (pkt_sniff[1] & 0x40)) {
      if ((pkt_sniff[30] == 0x88) && (pkt_sniff[31] == 0x8e)) { //802.1x Authentication!
          wpad_auth++;
      } else {
          wpad_wep++;
      }
  }
  //Check WPA Enabled
  if ((pkt_sniff[27] & 0xFC) == 0x00) {
      wpad_wep++;
      return rtnpkt;      
  }

This code is intended to increment wpad_wep whenever MDK3 identifies either an non-encrypted packet or a WPA encrypted packet sent by a client to the AP - and this will cause the "REALLY BIG WARNING!!!" to be output on the next status update.

But there's at least one bug in the code. If the packet is a QoS data packet then the packet header has an additional two bytes in which case both the frame type and the WPA indication would be two bytes later in the raw packet - and the current MDK3 code is looking at the wrong bytes in the packet. So it's quite possible that the warning you're getting is a false positive due to a client using QoS data packets.

Answer 2

If you don't have too many clients, you can connect one client at a time until you find the offender. Until there's more info this will have to do. I hope this helps.

Answer 3

Its all in this link Display Filter Reference: 802.1X Authentication.
regards

Answer 4

If you select the proper field name in Wireshark Expressions menu, you can then do a 'contains' or a 'matches' relation. #example for http -> ( http.host contains "192.168" ). That could help you narrow it down.