Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While stress testing my router using MDK3, I got the message "REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!"

I viewed the tool source and it showed that the WPA2 key is sent in plain text, after repeatedly being rejected due to MDK3 denying all WPA traffic. How can I view the packet containing the cleartext WPA2 key in Wireshark? I tried wlan_mgt.rsn.akms.type but it was not helpful.

MDK3 is a Wi-Fi testing tool from ASPj of k2wrlz. It uses the osdep library from the aircrack-ng project to inject frames.

edit
i may have misinterpreted the source code of mdk3. can anyone make things clear by specifying the origins of this warning and its causes.(am not a c programmer but i can still figure out what the algorithm is doing).

if (wpa_old < wpad_cycles) {
if (wep_old < wpad_wep) {
    if (!warning) {
    printf("REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!\n");
    warning = 1;
    }
}
}
share|improve this question
    
Do you have the config (drivers/antennae) to fully capture the wireless network (eg hostap driver, airsnort)? It sounds like you will need this to look at the packet that's causing this message. –  adric Sep 17 '12 at 14:46
    
the packets are dumped into a file during all of the test phases, it contains encrypted WPA2 handshakes plus the data am interested in (which i couldn't find), to be honest i really hope its not there, and am all just mistaken ?! –  sarepta Sep 17 '12 at 14:53
    
@sarepta Can you edit your question with relevant outputs from the tool you are using? It really is hard to answer your question in its current form. –  Terry Chia Sep 18 '12 at 10:46
    
Can't you work backwards and search your pcaps for the key? Then you'd know what frame to look for in the future. –  schroeder Sep 19 '12 at 17:45
1  
@sarepta You used the String Finder (Ctrl-F) and still could not find the packet? –  schroeder Sep 19 '12 at 22:36

4 Answers 4

up vote 3 down vote accepted
+100

Have you found the cleartext? If not, there seems to be a bug in the code that could explain this.

The interesting code is:

  //Is encrypted?
  if (! (pkt_sniff[1] & 0x40)) {
      if ((pkt_sniff[30] == 0x88) && (pkt_sniff[31] == 0x8e)) { //802.1x Authentication!
          wpad_auth++;
      } else {
          wpad_wep++;
      }
  }
  //Check WPA Enabled
  if ((pkt_sniff[27] & 0xFC) == 0x00) {
      wpad_wep++;
      return rtnpkt;      
  }

This code is intended to increment wpad_wep whenever MDK3 identifies either an non-encrypted packet or a WPA encrypted packet sent by a client to the AP - and this will cause the "REALLY BIG WARNING!!!" to be output on the next status update.

But there's at least one bug in the code. If the packet is a QoS data packet then the packet header has an additional two bytes in which case both the frame type and the WPA indication would be two bytes later in the raw packet - and the current MDK3 code is looking at the wrong bytes in the packet. So it's quite possible that the warning you're getting is a false positive due to a client using QoS data packets.

share|improve this answer
    
that's super reasonable, i was very much in doubt that any key will appear anyway. WPA2 is flawless at the time. –  sarepta Sep 22 '12 at 18:17

If you don't have too many clients, you can connect one client at a time until you find the offender. Until there's more info this will have to do. I hope this helps.

share|improve this answer
    
there is no offender, It's all a test :-) regards –  sarepta Sep 22 '12 at 18:09

Its all in this link Display Filter Reference: 802.1X Authentication.
regards

share|improve this answer

If you select the proper field name in Wireshark Expressions menu, you can then do a 'contains' or a 'matches' relation. #example for http -> ( http.host contains "192.168" ). That could help you narrow it down.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.