Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose there are three devices:

  • WPA2 protected AP
  • linux laptop, accessing internet through tha AP
  • linux laptop, not connected to the AP

I own the third device and do not know the AP's password. I have sufficient signal strength.

Can I port-scan the authenticated laptop? Provided there is an open e.g. telnet port, can I attempt to log in? Lastly, can I spoof the AP i.e. perform a MITM attack? All those without knowing the password.

share|improve this question

When somebody connects to a wireless access point, their communication happens only through that access point. If you want to communicate with a member of that network, you must get the access point to route/forward your signals to that device. To do that, you must be part of the network; in other words, to associate and get authenticated by the access point.

So, no, you cannot port-scan the devices inside that network unless you somehow create a network with them (some wireless ad-hoc network) or by exploiting the access point from the Internet (using its public IP address). For the same reason you also can't login to one of the devices using telnet or any other service.

As for spoofing the network, yes it's possible. You just need to use some social engineering, i.e. create another network with the same SSID and trick the others to connect to it. You might also do some trickery like pulling the AP's power plug so the other users will only have your network to connect to.

share|improve this answer
Sounds like fun :) When saying spoofing I was thinking more of injecting packets in the network, forged to be coming from the AP. aircrack-ng package does something similar to deauthenticate the client, no? aireplay-ng -0 1 -a 00:14:6C:7E:40:80 -c 00:0F:B5:FD:FB:C2 ath0 – Vorac Sep 5 '13 at 9:38
@Vorac 'deauth' packets are a bit different. They don't require authentication and they're not protected under the crypto layer in WPA/WPA2. They don't require any kind of association, just a packet that basically says "I'm AP X, disconnect from me and connect again. No time explain, just do it". That's why they can be easily spoofed. – Adi Sep 5 '13 at 9:59
What other packets share this characteristic? – Vorac Sep 5 '13 at 10:02

What you are trying to do is like trying to connect to a wired PC connected to a switch with cable and from a laptop that is not connected to that switch in anyway. You have to have a connection with the machine before attempting to connect on a port on that machine. in your case, AP is the switch and for outside world, you have no access to the communication channel. All you can do is interfer with the signals (jamming) of the AP and disrupt the communication between the machine and the AP.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.