Security for 802.11 wireless networks.

learn more… | top users | synonyms

2
votes
3answers
43 views

Building an info sec VM lab - safe to keep on my home network?

I'm a new member making my first post here. I had a very quick, and admittedly basic, question. I'm setting up an info sec lab for the first time at home. I'm trying to build some more technical ...
1
vote
2answers
48 views

Sniffing packet on wireless connection (airodump-ng)

Short Question: Is it important for a sniffing device to be in the broadcasting range of a client (NOT THE ROUTER) to sniff its packets? Complete Scenario: I assume that a wireless sniffing tool, ...
1
vote
2answers
58 views

Cannot capture frames other than broadcast or multicast in Wireshark

My problem is that I cannot capture any frames other than broadcast or multicast over Wireshark on my WLAN interface (eg. no ICMP packets, no HTTP packets, etc.) Please follow details below: OS: ...
4
votes
1answer
50 views

When prompted to add a certificate or profile to connect to a secured WiFi network, how can I tell if it's safe to install it?

Sometimes when I connect to secured WiFi networks on my computer, such as my internet provider's WiFi hotspots around the city, I'm asked to add a certificate to my certificate store. When I'm on my ...
3
votes
1answer
60 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
2
votes
1answer
57 views

How to provide user friendly WiFi access to gym members with WPA2 Enterprise?

Background A friend of mine is the owner of a medium sized gym. He wants to provide WiFi to his customers and asked me to come up with a concept and eventually also deploy it. As a computer scientist ...
1
vote
1answer
110 views

Can Passpoint X.509 certificates be used to MITM SSL connections on Passpoint networks?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication. Can these certificates be used by the provider to execute man-in-the middle ...
0
votes
1answer
43 views

How to sniff 802.11 packets without going into monitor mode?

Is it possible to sniff or capture 802.11 packets which sends my computer to the router (AP). I know that I can't sniff packets which have a other destination MAC address without going into monitor ...
0
votes
1answer
29 views

Can an AT&T router's firmware be changed to a malicious one just by logging in?

Or would an attacker need to know the special Device Access Code to do that? I can't figure how to set an admin password so would I be vulnerable if a hacker knows my WiFi password? Or would they need ...
0
votes
1answer
26 views

How effective is MAC whitelisting on a Wireless Access Point?

For the sake of context, let's say I set up my home router with WPA2, a strong passphrase and I whitelisted all of my devices. I know the data is encrypted, but is the layer 2 header encrypted as ...
0
votes
1answer
158 views

How to enable WiFi while using two wireless cards one in monitor mode and other in managed mode?

I have two wireless adapters, one is internal PCI wireless adapter (wlan0) while other is USB wireless adapter (wlan1). I put wlan0 in monitor mode and wlan1 is in managed mode. But, after running ...
0
votes
1answer
93 views

airodump-ng mon0 device

My laptop is in monitoring mode. I need to get the details of a client that makes probes and not include other bssid and their station. I run sudo airodump-ng -w s3 --bssid 74:de:2b:45:ed:d4 mon0 ...
-1
votes
1answer
59 views

Using old router as wi-fi extender/extra security on shared network?

I just moved into a building with three apartments, all of which split an internet subscription. There is only one router, however, in one of the other apartments. For security/privacy purposes, I'd ...
4
votes
0answers
184 views

Is the GTK or MIC in the unencrypted portion of a WPA protected frame?

In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to ...
3
votes
0answers
70 views

Broadcasting 10k SSIDs

How hard would it be, and or is it possible, to configure a router or PC to broadcast ten thousand SSIDs. If it is possible what repercussions would it have? Would this be a form of DOSing or is there ...
3
votes
0answers
38 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
3
votes
0answers
60 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
3
votes
0answers
73 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e....
2
votes
0answers
796 views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
2
votes
0answers
106 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
2
votes
0answers
43 views

PMK/s and Keys/s: Which is faster?

I'm practicing on Kali Linux and was struck with the fact that almost all tutorials on the internet specified speed of aircrack-ng in Keys per second and the speed of pyrite as PMKs per second. So, ...
2
votes
0answers
229 views

Does EAP-TLS provide a two-factor authentication?

I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS. I have therefor created a user certificate and a user within the FreeRADIUS user ...
2
votes
0answers
115 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
1
vote
0answers
33 views

Is AirPlay at attack vector into a private network?

Our software dev team has an Apple TV and we want to have it connected to the corporate network to be able to reach internal resources while testing custom apps. Our ops team does not want it ...
1
vote
0answers
89 views

How to get 802.1X credentials with hostapd-wpe?

I've been using hostapd-wpe to create fake access points and trick clients into connecting to them. This plan always worked very well for "normal" WPA2-Enterprise networks, as I've always been able to ...
1
vote
0answers
36 views

MAC spoofing under a OPN Access point HTTP does not work

I want to do a demo on the wifi security. So, I have one Wifi router and two client. I configured my router without security (OPN) and with a MAC filter. One of the two client is connected to the ...
1
vote
0answers
324 views

WifiPhisher not creating a fake access point

I recently came to know about WifiPhisher. To test it, I set up an access point using my Windows laptop and tried to obtain its password using this tool in my Ubuntu machine. So, when I run the ...
1
vote
0answers
151 views

How do TSC (TKIP sequence counter) calculate into WPA?

I'm reading about 802.11, from IEEE's pdf (IEE pdf), from page 1191, and in particularly I'm reading about TKIP. And to decrypt and to encrypt used a TSC (TKIP Sequence Counter) as you can see in ...
1
vote
0answers
166 views

Neutralizing or Migitating ARP spoofing once detected

I've seen a few methods to detect ARP Spoofing attacks through code(such as this), and ways to defend against these attacks through software and switches (like arp spoofing protection on LAN). How ...
0
votes
0answers
13 views

How to tell whether a 802.11 DATA packet uses WEP or WPA?

i am playing with the 802.11 header, trying to figure out the encryption type of incoming 0x08(DATA) packets. 1) I capture the 0x08 type packet (DATA). 2) I find out that a WEP bit is set (2nd ...
0
votes
0answers
20 views

Should I set up additional security on Xfinity wireless gateway?

My sister has an XB3 model dual band wireless gateway from Xfinity which she is using as a wireless router in her house. She currently has it set up so that it appears as an open network. Access to ...
0
votes
0answers
52 views

ARP spoofing on WLAN: seeing only traffic coming back

I am attempting to capture network traffic of my mobile device connected to switched network via WIFI, utilizing arpspoof. I did all steps tutorials mention. What I see in Wireshark is only a half ...
0
votes
0answers
24 views

How to tell if a hotspot is encrypted with Passpoint on iOS

Is it possible to see if a hotspot is using WPA2 encryption as part of the Passpoint protocol on iOS? If I understand it right you'll connect to the hotspot without needing to enter a WPA2 PSK, but ...
0
votes
0answers
57 views

Get the Probe Request of My iphone6

I want to track my iPhone6 device for the probe requests it is sending to connect to the WiFi router. This is my current setup: I have kept the WiFi on and have forgotten the network, in the phone ...
0
votes
0answers
62 views

Domain redirection when using Evil Twin method?

When clients are connected to my fake access point, is there a way to redirect their requests to a different domain (eg.: google.com --> hotmail.com)? Could this be achieved maybe via iptables or the ...
0
votes
0answers
154 views

Changing the SSID of the fake AP created by linset

As per the title I described above, I know that linset basically created a fake AP for the victim to connect then steal their Wi-Fi password or any other credentials. What I want to know is how do we ...
0
votes
0answers
146 views

Generate password list with specific keywords and length

I need to generate a list of passwords to try penetrating into a wi-fi network. I have a pretty big list of keywords and I want to use them to generate as many possible passwords as possible, which ...
0
votes
0answers
41 views

Open WiFi Network Where All Confidential Communication is Encrypted Through Other Means

Imagine the following scenario: Users connect to an open WiFi network (no password, no encryption) All users stick to secure transmission protocols for all confidential data (HTTPS, SSH, VPN, etc.) ...
0
votes
0answers
329 views

Victim loses Internet connection during MITM attack

I tried to do MITM attack on my network. I enabled ettercap, marked my router as TARGET1 and my second computer as TARGET2. Then I enabled 'ARP Spoofing'. I do not know why - but after this operation ...
-1
votes
0answers
56 views

Windows 8 hacking

Can a Windows 8 machine can be hacked, by only knowing the IP address of the victim, without having first penetrated the Wifi? Say I disable the Wifi altogether and start my computer fresh..is it ...
-1
votes
0answers
57 views

Wash and Reaver issues in kali

I don't know if this is a silly question, but here it goes. I am trying to get my hotspot's password with reaver on Kali 1.0. Monitor mode is on, I see the target network on airodump, But wash isn't ...