Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
2

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks.

If it can, how, but if not, is there another tool that could be used to accomplish this?

Also, what can be done to prevent this type of attack on a network?

share|improve this question
I'm not sure, but I remember reading somewhere about WPA2-PSK vulnerabilities, the same source also claimed that because of relatively fast key rotation in WPA-Ent, they are secure (both 1st and 2nd version). Don't quote me on that though. – Hubert Kario Jan 23 at 22:16

2 Answers

up vote 8 down vote accepted

Not alone like a WPA/2 PSK attack, where you can simply capture the handshake and bruteforce.

You'll need to capture the "Enterprise" authentication attempt. To do this, you can perform an "Evil Twin" attack that captures the authentication attempt, which can then be subsequently cracked.

Here's an excellent presentation by Matt Neely of SecureState that details the attack: http://www.slideshare.net/NEOISF/attacking-and-securing-wpa-enterpris

Specific Steps of the Attack:

  • Attacker sets up a Fake AP
    • Mirror the target SSID, encryption type and band
    • Configure the AP to accept Enterprise authentication
    • Enable AP, ensure it is visible to the target
  • Connect the AP to a FreeRADIUS (with password Wireless Pwnage Edition patch) server that captures auth
  • Deauth any target you can get within range of your fake AP
  • Wait for targets to attach to the the fake AP, capture their authentication
  • Crack the challenge / response pair to recover the password

Hope this helps!

share|improve this answer
up vote 1 down vote

According to my knowledge it is only possible to crack WPA/WPA2 PSK or Pre Shared Keys. During authentication handshake. It is possible to capture eapol handshakes. This can be accomplished either actively or passively. However, just aircrack is not sufficient. It is used in a last stage.

However it is not recommended to use PSK or similar lower level security for enterprise networks. And it is not compatible with compliance requirements. Most of these networks have main components such as radius servers, PKIs with protocol support such as EAP_TLS (Transport Layer Security). This ensure the authentication and trust among devices. With AES encryption standards, data communication is highly secure. So it is not possible to crack if it is up to its standards.

However, there may be vulnerable spots. Like mixed protocol usage, obsolete clients who are allowed to use other mechanisms. Nothing is 100% secure.

share|improve this answer
If there is a username and password, how can you attack if you know the username? Is that possible? – yentup Jan 24 at 0:51
jcran had provided the answer to the rest of the question. :) – Lasith Jan 24 at 20:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.