Questions tagged [wireless]

Wireless security topics including 802.11, Bluetooth, and others.

Filter by
Sorted by
Tagged with
1 vote
0 answers
207 views

Is the keystream recovered by tkiptun-ng the same key used to encrypt all data frames between the client and the AP?

Looking at the manual for tkiptun-ng,(http://www.aircrack-ng.org/doku.php?id=tkiptun-ng) The output saves the keystream in the example near the end of the program. Is this the same keystream used to ...
0 votes
1 answer
589 views

Which key is actually used for encrypting data traffic in WPA after the 4WHS?

Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true? From what I understand, this can have very ...
6 votes
3 answers
4k views

How to setup a Virtual Wireless Router?

I need to teach some students about cracking WEP and WPA passwords, as I don't have a real wireless router to use, is there any VM that I could use to simulate a wireless network? Like a Virtual ...
0 votes
1 answer
2k views

What are the roles of PSK and GTK in a WPA setting?

I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
6 votes
1 answer
13k views

What's the difference between pixie attack and other attacks on WPS?

I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
1 vote
2 answers
2k views

Why are cryptographic algorithms implemented in the data-link layer in wireless networks?

Could someone please tell me why cryptographic algorithms are placed in the data-link layer for wireless networks?
0 votes
1 answer
2k views

Fear of mac Spoofing. Two Mac addresses appearing on Router page with only 1 digit variation

I have tried looking into Info Sec's posts for a related issue but couldn't find a solution as my problem is a bit specific. I have been having connectivity issues, and as paranoid as I can get, i ...
1 vote
2 answers
1k views

Is there any way to send malicious keystrokes to wireless keyboard USB dongle?

I have read many blogs on how to intercept wireless keyboard keystrokes. Similarly is there any way where we can send keystrokes to any keyboards USB receiver module? can we kick out the existing ...
5 votes
6 answers
5k views

Can one steal data using electric wire?

If I would like to keep my work secret in my computer and I don't use Internet, is it possible for a cracker to steal my data via electric wires or a wireless connection?
0 votes
2 answers
142 views

When I receive data in this scenario, how many times is it encrypted?

Right now I'm using a Web browser under the following circumstances: I am making this post over HTTPS I am connected to a password-protected Wi-Fi network with WPA/WPA2, EAP-PEAP, and MSCHAPV2 ...
10 votes
3 answers
4k views

How safe is a standard wireless keyboard from a MITM attack?

And are there any mitigations except using a wired keyboard?
2 votes
1 answer
4k views

What does SSI signal does mean in captured packets in wireshark?

In the packet captured below, captured by wireshark does the SSI Signal in dBm represents the power at which the sniffing network adapter (say USB network adapter wlan1 on Raspberry Pi3) received ...
2 votes
1 answer
345 views

Deauth as a protection

In the case that there is an ongoing attack in my network, where the attacker is using WLAN to access my network and I recognize it, would it be possible to send a broadcast deauth in my network to ...
3 votes
1 answer
6k views

How to prevent WiFi jammer attack? [duplicate]

How can I prevent a WiFi jammer attack on my wireless network? For example if I send a deauth (deauthentication) packet with aircrack-ng on Kali Linux for a specific client, he/she can't use WiFi. ...
2 votes
1 answer
5k views

Security of Wi-Fi vs Bluetooth

I am preparing a project for a client. It is a wireless device to be used inside a factory so the workers can interact with the factory without having to go to a terminal. In order to connect the ...
1 vote
1 answer
1k views

Capture Handshake with WPS disabled

I just got into exploring network cracking. Honestly, just to learn how the process works. I am not curious about cracking the handshake as much as capturing it. It seems when I set up a test ...
3 votes
1 answer
1k views

Why do public wifi networks often have a click screen to join? [closed]

At many if not most coffeeshops and other public Wi-Fi locations, even though Wi-Fi is free and not password protected, there are click screens with "join" buttons that need to be tapped to access the ...
0 votes
1 answer
3k views

WPS Why Can't Pin be Bruteforced Offline

I don't totally understand how the WPS protocol works but why cannot a user get the hash of the WPS pin from the router and crack it in the same way a WPA2 handshake is cracked? (Not pixiewps but ...
0 votes
1 answer
238 views

In Real-Time, where do we deploy Extensible Authentication Protocol(EAP) in Wireless Networks?

I have heard that the EAP protocol has authentication capabilities for wireless networks too. But I am not able to get how it is deployed in real time as I know that whenever I need to connect to my ...
3 votes
1 answer
53k views

Router detecting port scan and ack flood attack

Over the past few days, I'm noticing that the log of my wireless router is showing an ACK flood attack from various IP addresses. I use a D-Link DIR-600L. I've searched through the internet, also ...
2 votes
0 answers
322 views

Getting the current time from wifi networks without connecting [closed]

In a microcontroller powered by a solar cell we need to have the current time. When the sun decrease the micro-controller switch off and all the volatile data vanish. When the sun increase the micro-...
29 votes
1 answer
75k views

EAP-TLS vs EAP-TTLS vs EAP-PEAP

I'm having troubles understanding the differences between the 3. As far as I understand, with EAP-TLS, the client (peer) and the server (authenticator) both need a certificate. The authentication is ...
2 votes
1 answer
1k views

Few questions about group keys family in WPA/WPA2

In my previous question I learnt something about Group Temporal Key (GTK), but after searching the internet I have another questions: 1. How is Group Master Key (GMK) derived? What is GMK derived ...
0 votes
1 answer
987 views

Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks?

I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode). It is my understanding that 802.11 networks using WEP encryption ...
4 votes
1 answer
974 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
0 votes
1 answer
102 views

Wireless devices with default configurations

I have the idea of deploying a product using a Raspberry Pi alike (CHIP) however I am concerned of the security issues getting a wireless device into people's homes The device will be: Using all the ...
1 vote
1 answer
76 views

Does it affect the probability of successful trasmission if a jammer hops channels?

Suppose an attacker tries to jam a wireless communication. There are 10 channels available and the legitimate sender chooses one of them of transmission randomly every 1s. If it transmits data for 5s ...
3 votes
2 answers
2k views

Windows 10 Wi-Fi vs Airplane Mode Security

Does Windows 10 Airplane Mode provide the same level of security/protection as turning off Wi-Fi? I know that turning on Airplane Mode disables Bluetooth; however, as far as connecting to the ...
1 vote
1 answer
150 views

Wireless Adapter + Arduino 'Bug'

First, I am new to ethical hacking. And also I just realized that I need a wireless adapter for wireless attacks. I'm currently mastering Python, and some basic knowledge in Bash and Arduino. What I ...
1 vote
1 answer
3k views

WPS. Output messaging translation to "human readable"

I'm trying to test the wifi security of my router at home. It has WPS activated. I know WPS should deactivated, I'm only testing... Reaver is "spitting" a lot of messages, the question is: What is ...
2 votes
1 answer
1k views

airodump-ng mon0 device

My laptop is in monitoring mode. I need to get the details of a client that makes probes and not include other bssid and their station. I run sudo airodump-ng -w s3 --bssid 74:de:2b:45:ed:d4 mon0 ...
1 vote
1 answer
4k views

Are iPhones immune to deauth attacks?

I was today rumbling a bit with wireless security, and more specific in creating Fake Access-Points to make Wi-Fi users enter their password on a phishing-page (by using the Fluxion tool). One of the ...
3 votes
1 answer
214 views

Are there any signs for an end-user of cellular calls being routed through a Stingray device?

The Stingray is a small device that mimics cellular towers. From the user's endpoint side, is there any way to detect you are being routed through a rogue cellular tower?
0 votes
1 answer
354 views

How can someone determine where a wireless router/SSID originated? [duplicate]

Someone hacked my wifi. I beefed up security. They now have renamed their SSID with a derogatory SSID including my apartment number. I want to find where they are so I can confront them. Is that ...
0 votes
3 answers
849 views

Weird problem on airbase-ng

The situation is pretty simple, I'm trying to create a rogue AP, am I missing something? No matter what I do I get the same error message: I tried using different bssid and essid's with the ...
5 votes
1 answer
2k views

How Hole 196 actually works ? What WPA parameters does it exploit?

While dealing with wireless set I came across the term Hole 196. Got to know that preventions too. But can it still bypass Client isolation and standard preventive approach if packets are crafted at ...
0 votes
1 answer
189 views

Security better between WPA/WPA2 and AP Login Webpage

I silly wonder if we can stand outside and sniff password login webpage in protocol HTTPS or not? And attacker can brute force the WPA or WPA2 but if they change AP:set non-password and redirect ...
0 votes
1 answer
149 views

Wireless Access Point CONF? Edit [duplicate]

Is it possible that for instance I have one access point that it requires a password for authorization to access to modem and internet. I want to edit this step like a user when he/she click to the ...
3 votes
1 answer
853 views

What information can WiFi devices leak without actually connecting?

Mr Paranoid walks from one secure location to another. Mid-journey, he panicks -- his wireless device (laptop, iPad, or other common consumer electronics) is turned on! If it sent any information to ...
2 votes
1 answer
3k views

WPS PBC Security

On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame. There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any ...
1 vote
1 answer
518 views

Prevention against De-Auth Attack for Handshake Capturing [duplicate]

As far as I know about De-authentication attack, the attacker sends de-auth packets to both router and the victim asking the victim to disconnect and reconnect. But I wonder what would happen if I ...
1 vote
0 answers
110 views

What happens when an attacker sends fake nonce in TKIP handshake?

The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
1 vote
2 answers
984 views

scans for WIFI access points

PCI DSS requirement 11.1: "Implement processes to test for the presence of wireless access points (802.11), and detect and identify all authorized and unauthorized wireless access points on a ...
1 vote
0 answers
292 views

mdk3 beacon pwning not detected by other devices

I'm new to wireless security. I'm trying to pwn beacon frames to announce a new access point using mdk3. However, when I run the command I get the following result where the MAC address is not ...
2 votes
1 answer
1k views

Strange behavior when injection wifi packets with aireplay-ng [closed]

When I'm testing packet injection with aireplay-ng I can witness a strange behaviour on my Lenovo T510i. Several blogs report my wireless device to be capable of packet injection. But then look at ...
1 vote
1 answer
1k views

What information does a wireless access point have about connected devices?

Which information about a connected device leaks to the access point it is connected to? What's the minimum amount of information that must be supplied to successfully connect, apart from the password?...
0 votes
2 answers
426 views

Wireless EAP-TLS implementing on Medical Wireless Device

I am new to PKI, digital certificates etc and will be the first time to connect a medical wireless device to a wireless network using EAP-TLS. I am connecting a medical wireless device to our customer'...
0 votes
2 answers
730 views

Does wireless card need to be on same channel as AP to sniff beacon frames?

OBJECTIVE Essentially, my goal is to emulate something like airodump-ng wlan0 Here is a link just in case ... airodump-ng Collects raw 802.11 frames Displays nearby access points and data GAMEPLAN ...
4 votes
1 answer
1k views

Arp replay for cracking WEP key IN Aircrack-ng

I'm pretty new to all of this so it might be a little stupid question... but why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP ...
4 votes
2 answers
352 views

Achieving 'frequency separation' in wireless networks

A popular recommendation from security providers is to ensure wireless networks achieve 'frequency separation' from other wireless networks. What does 'frequency separation' mean in technical terms ...

1
3 4
5
6 7
10