Security for 802.11 wireless networks.

learn more… | top users | synonyms

1
vote
3answers
28 views

Building an info sec VM lab - safe to keep on my home network?

I'm a new member making my first post here. I had a very quick, and admittedly basic, question. I'm setting up an info sec lab for the first time at home. I'm trying to build some more technical ...
1
vote
2answers
43 views

Cannot capture frames other than broadcast or multicast in Wireshark

My problem is that I cannot capture any frames other than broadcast or multicast over Wireshark on my WLAN interface (eg. no ICMP packets, no HTTP packets, etc.) Please follow details below: OS: ...
4
votes
1answer
33 views

When prompted to add a certificate or profile to connect to a secured WiFi network, how can I tell if it's safe to install it?

Sometimes when I connect to secured WiFi networks on my computer, such as my internet provider's WiFi hotspots around the city, I'm asked to add a certificate to my certificate store. When I'm on my ...
3
votes
1answer
57 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
1
vote
1answer
95 views

Can Passpoint X.509 certificates be used to MITM SSL connections on Passpoint networks?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication. Can these certificates be used by the provider to execute man-in-the middle ...
0
votes
1answer
96 views

How to enable WiFi while using two wireless cards one in monitor mode and other in managed mode?

I have two wireless adapters, one is internal PCI wireless adapter (wlan0) while other is USB wireless adapter (wlan1). I put wlan0 in monitor mode and wlan1 is in managed mode. But, after running ...
0
votes
1answer
83 views

airodump-ng mon0 device

My laptop is in monitoring mode. I need to get the details of a client that makes probes and not include other bssid and their station. I run sudo airodump-ng -w s3 --bssid 74:de:2b:45:ed:d4 mon0 ...
4
votes
0answers
182 views

Is the GTK or MIC in the unencrypted portion of a WPA protected frame?

In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to ...
3
votes
0answers
66 views

Broadcasting 10k SSIDs

How hard would it be, and or is it possible, to configure a router or PC to broadcast ten thousand SSIDs. If it is possible what repercussions would it have? Would this be a form of DOSing or is there ...
3
votes
0answers
37 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
3
votes
0answers
58 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
3
votes
0answers
72 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e....
2
votes
0answers
754 views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
2
votes
0answers
104 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
2
votes
0answers
33 views

PMK/s and Keys/s: Which is faster?

I'm practicing on Kali Linux and was struck with the fact that almost all tutorials on the internet specified speed of aircrack-ng in Keys per second and the speed of pyrite as PMKs per second. So, ...
2
votes
0answers
211 views

Does EAP-TLS provide a two-factor authentication?

I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS. I have therefor created a user certificate and a user within the FreeRADIUS user ...
2
votes
0answers
112 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
1
vote
0answers
25 views

Is AirPlay at attack vector into a private network?

Our software dev team has an Apple TV and we want to have it connected to the corporate network to be able to reach internal resources while testing custom apps. Our ops team does not want it ...
1
vote
0answers
74 views

How to get 802.1X credentials with hostapd-wpe?

I've been using hostapd-wpe to create fake access points and trick clients into connecting to them. This plan always worked very well for "normal" WPA2-Enterprise networks, as I've always been able to ...
1
vote
0answers
30 views

MAC spoofing under a OPN Access point HTTP does not work

I want to do a demo on the wifi security. So, I have one Wifi router and two client. I configured my router without security (OPN) and with a MAC filter. One of the two client is connected to the ...
1
vote
0answers
309 views

WifiPhisher not creating a fake access point

I recently came to know about WifiPhisher. To test it, I set up an access point using my Windows laptop and tried to obtain its password using this tool in my Ubuntu machine. So, when I run the ...
1
vote
0answers
144 views

How do TSC (TKIP sequence counter) calculate into WPA?

I'm reading about 802.11, from IEEE's pdf (IEE pdf), from page 1191, and in particularly I'm reading about TKIP. And to decrypt and to encrypt used a TSC (TKIP Sequence Counter) as you can see in ...
1
vote
0answers
166 views

Neutralizing or Migitating ARP spoofing once detected

I've seen a few methods to detect ARP Spoofing attacks through code(such as this), and ways to defend against these attacks through software and switches (like arp spoofing protection on LAN). How ...
0
votes
0answers
42 views

ARP spoofing on WLAN: seeing only traffic coming back

I am attempting to capture network traffic of my mobile device connected to switched network via WIFI, utilizing arpspoof. I did all steps tutorials mention. What I see in Wireshark is only a half ...
0
votes
0answers
28 views

Sniffing packet on wireless connection (airodump-ng)

Short Question: Is it important for a sniffing device to be in the broadcasting range of a client (NOT THE ROUTER) to sniff its packets? Complete Scenario: I assume that a wireless sniffing tool, ...
0
votes
0answers
18 views

How to tell if a hotspot is encrypted with Passpoint on iOS

Is it possible to see if a hotspot is using WPA2 encryption as part of the Passpoint protocol on iOS? If I understand it right you'll connect to the hotspot without needing to enter a WPA2 PSK, but ...
0
votes
0answers
36 views

Get the Probe Request of My iphone6

I want to track my iPhone6 device for the probe requests it is sending to connect to the WiFi router. This is my current setup: I have kept the WiFi on and have forgotten the network, in the phone ...
0
votes
0answers
56 views

Domain redirection when using Evil Twin method?

When clients are connected to my fake access point, is there a way to redirect their requests to a different domain (eg.: google.com --> hotmail.com)? Could this be achieved maybe via iptables or the ...
0
votes
0answers
131 views

Changing the SSID of the fake AP created by linset

As per the title I described above, I know that linset basically created a fake AP for the victim to connect then steal their Wi-Fi password or any other credentials. What I want to know is how do we ...
0
votes
0answers
133 views

Generate password list with specific keywords and length

I need to generate a list of passwords to try penetrating into a wi-fi network. I have a pretty big list of keywords and I want to use them to generate as many possible passwords as possible, which ...
0
votes
0answers
40 views

Open WiFi Network Where All Confidential Communication is Encrypted Through Other Means

Imagine the following scenario: Users connect to an open WiFi network (no password, no encryption) All users stick to secure transmission protocols for all confidential data (HTTPS, SSH, VPN, etc.) ...
0
votes
0answers
311 views

Victim loses Internet connection during MITM attack

I tried to do MITM attack on my network. I enabled ettercap, marked my router as TARGET1 and my second computer as TARGET2. Then I enabled 'ARP Spoofing'. I do not know why - but after this operation ...
-1
votes
0answers
37 views

Not able to capture credentials when sniffing WiFi packets

I have an open access point nearby with a captive portal asking me to enter credentials which I don't have. I observed that the login page of captive portal doesn't use SSL protection and decided to ...
-1
votes
0answers
23 views

Cisco any connect home wifi use

While Cisco Any Connect is logged into VPN on my work computer over my home private wifi...can web searches made on an iPhone that is also connected to the same private wifi be monitored by the VPN ...