Security protocol (IEEE 802.11i) developed by the Wi-Fi Alliance to protect wireless networks.

learn more… | top users | synonyms

0
votes
0answers
26 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
4
votes
1answer
62 views

Evil Twin attack: How to make client send WPA2-PSK password when asked for AP-password? [closed]

How can an Evil Twin attack be set up, so that the client will be prompted for a password and send it in plain text? Is the above even possible? I have already set up the fake AP, but it must be ...
1
vote
1answer
39 views

How can systems recognize different wifi AP with the same SSID and MAC address

I'm testing, for studying purpose, an evil twin attack. In my scenario I have both the rogue AP made by my laptop and the real AP with the same SSID and MAC address, but with different security ...
0
votes
1answer
86 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
0
votes
1answer
59 views

Why isn't WPA2 more secure?

Follow-up from this question. I just learned that all one needs to decrypt WPA2 traffic is the network key. So for example if I go to a coffee shop and they have the key on the wall I can listen to ...
1
vote
2answers
71 views

How does WPA2-PSK prevent evil twin password phishing?

Let's say we have a WPA2-PSK secured AP and there are several clients like smartphones and notebooks that automatically connect to it. Now if someone was to create another AP that looked completely ...
3
votes
1answer
64 views

MITM over WPA2 (e.g. with ettercap)

I've read on a few sites that it's possible to conduct MITM attacks over WPA2-secured connections. So for example I could replace the content of a site a user tries to access over HTTP. Is this true? ...
0
votes
3answers
99 views

Is it possible to obtain the WPA key of a wireless network while connected to it with an Ethernet cable?

I know that there are ways to view saved WPA keys, but I am trying to figure out how to get the WPA key of an access point while connected to the same domain over Ethernet. Also, what if the router ...
2
votes
1answer
91 views

What is the difference between key mechanism in wep and wpa

I haven't found the resources explaining about exact authentication mechanism about wpa-psk in the internet. finally i found securitytube videos i found one video regarding the wpa-psk concepts.in ...
7
votes
2answers
295 views

If WPA2-PSK is insecure, what other options do home users have?

from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
1
vote
1answer
46 views

Scapy WPA2 packet forging

Can I use scapy to forge custom packets on WPA2 network? Can I even pack the IEEE 802.11 headers?
1
vote
2answers
64 views

How to forge custom IEEE 802.11 packets?

I read about 802.11 networks and found out that all the frames from client are directed to the AP. How can I forge IEEE 802.11 packets so that I can send them directly to the clients using the group ...
0
votes
0answers
1k views

reaver - [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null))

I am familiar with dict-password cracking but I recently moved on to reaver. When I run reaver, it pops up with an error [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null)). I ...
4
votes
1answer
91 views

Wi-Fi asks to accept (self-signed) certificate – What is it used for?

When I tried to connect to my University's Wi-Fi for the first time, it asked me to accept a (probably self-signed) certificate. Luckily they published the fingerprint so I was sure it is safe to ...
1
vote
2answers
594 views

What would be the most efficient way of brute forcing a wifi key [duplicate]

I was wondering how can a brut force of my wifi be prevented so I want to know the best technique that can be used to brute force it first, so protection isn't my question. My question is: What brute ...
2
votes
1answer
178 views

Can't decrypt captured HTTP connection from WPA Network

Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption". Currently I can only view the ...
0
votes
1answer
97 views

Which method of WPA2 enterprise is more secure: TTLS or PEAP [closed]

Say we have two WPA2 enterprise setups using a RADIUS server. If both implementations use MSCHAPV2 and the same credentials. Which of the two would be more secure and how are these two implementations ...
2
votes
2answers
428 views

What is “anonymous identity” in enterprise WPA?

When connecting to an enterprise WPA protected network, I have the option the add an "anonymous identity" (see related screenshot). I don't understand what's the point though. Who get to see this ...
1
vote
1answer
46 views

Enabled WPS methods

I would like to know if there are tools available to identify what WPS method is actually enabled on an AP? I would like to know also if there is a way by looking at packets to know which WPS method ...
0
votes
1answer
52 views

Are there any pen testing tools/methods for wpa2 networks that don't require using an adapter that supports monitor mode? [closed]

I really enjoy reading and researching about networking and pentesting. Recently I heard from a friend that there are ways that can be used to get into wireless networks without needing an adapter ...
2
votes
2answers
923 views

If password is super long, your wpa / wpa2-psk is safe?

sorry im kinda clueless with this stuff... I heard if you set your wifi password to more than 10 or so digits (and make it complicated), then your wpa / wpa2 psk would be safe. Is that true? If not, ...
3
votes
2answers
51 views

WPA with PSK and with Radius Server

In case of WPA2 using the Radius server, every client gets its own username and password. But what is the case in the WPA2 using a PSK without the authenticating server. In this case also we have a 4 ...
1
vote
1answer
93 views

Why can't I have WPA handshake on aircrack? [closed]

I know this might seems general question to be googled first and I have tried. I have successfully de-authenticated the client or clients multiple times but I didn't get the message of WPA handshake ...
3
votes
1answer
175 views

Is it possible to steal WPA2 key using a rogue AP?

Without using a 'fishing' homepage explicitly asking for the user to retype the WPA key. Is it possible to catch the WPA key wich is sent to a rogue AP in the initial connection phase ?
2
votes
1answer
2k views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
3
votes
1answer
109 views

Can a wifi network have WPA encryption, WEP cipher and OPEN authentication?

Can a wifi network have WPA encryption, WEP cipher and OPEN authentication?
4
votes
2answers
288 views

ASUS RT-AC68 login page is redirecting to some Amazonaws page?

Has my ASUS router been hacked or just glitchy? When I tried to login to 'router.asus.com' it would redirect to "[censored just in case].us-west-2.compute.amazonaws.com/find/device.html" and it said ...
5
votes
2answers
168 views

Does a WPA2-PSK authentication only succeed if both parties know the pre-shared key?

Normally people think of WiFi authentication as the client proving to the AP that it knows the pre-shared key. But does the AP also prove to the client that it knows the pre-shared key? Is it ...
1
vote
2answers
363 views

Hashcat does 1-7 numeric characters on brute force attack when specifying 8

I have Hashcat 0.49 on Kali Linux 1.1.0a and I have a .hccap file. It's a WPA2 Network in the file so I chose a mask of 8 numeric characters (?d?d?d?d?d?d?d?d) and instead of starting at 8 numeric ...
2
votes
2answers
219 views

“Sniffing” Wifi Password? [duplicate]

I wonder if the follwing is possible: Assume you want to gain access to the AP "ap". Isn't it possible to set up a hotspot with the same BSSID, so that clients think that you are ap and send the ...
1
vote
2answers
78 views

How to use Aircrack-ng when knowing part of the password?

Let's say I know the password starts with "1234" and after that there is a commonly used password. I would like to use the word list I have for the second part of the password, but to include somehow ...
0
votes
2answers
240 views

Is WPA(2)/AES or some derivative really perfectly secure?

It is said they are uncrackable for now, but my question is how much uncrackable are they? Of course, it requires a situation to answer this, so here comes an assumed situation(the worst possible ...
1
vote
3answers
111 views

Which kind of Wifi is safe to use ?

I travel a lot, so I most of the time get Wifi from Hotel or Cafes. I payed attention to the fact that some Wifi does not have security password ! Here is a screenshot of the type of security I found ...
5
votes
2answers
1k views

WiFi security using IEEE 802.1X - how secure is it?

My company's set-up involves a single AP (TPlink) that is configured to authenticate clients using RADIUS. All works well, but: on a regular WPA/WPA2 network, once you have the PSK, you are able to ...
1
vote
0answers
99 views

How do TSC (TKIP sequence counter) calculate into WPA?

I'm reading about 802.11, from IEEE's pdf (IEE pdf), from page 1191, and in particularly I'm reading about TKIP. And to decrypt and to encrypt used a TSC (TKIP Sequence Counter) as you can see in ...
1
vote
1answer
84 views

How can I get EAPOL packet's number?

I need to work with EAPOL packets, and I have to distinguish between first, second, third and fourth... If I'm using WPA2 I can use the first 2 bytes of Key Information field, and I can use Key MIC, ...
25
votes
0answers
608 views

WPA2 ephemeral key derivation

I'm trying to learn how ephemeral keys in WPA2 4-way handshake are derived. Starting from 4 EAPOL packets sniffing, I successfully derived PMK and PTK reading ANonce, SNonce, and knowing ASCII-PSK ...
0
votes
2answers
265 views

Is it possible for hackers hack my PC by creating fake AP that my PC probed

I heard that hackers can create fake AP that my PC is probing. As soon as my PC found the Fake AP, it will connect automatically. So To clarify, is it possible for hackers create the Fake AP that my ...
4
votes
1answer
6k views

How does Dumper program get default WPS without bruteforcing them?

Today I tried a program called Dumper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below: I had to cover BSSID and ESSID of the ...
1
vote
0answers
104 views

get a key HEX from wpa/wpa2 handshake [closed]

Can I get a key HEX from wpa/wpa2 handshake, or from the network in another way without knowing the passphrase? Example: Network SSID: linksys54gh WPA passphrase: radiustest Hexadecimal key: ...
2
votes
1answer
138 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
0
votes
1answer
130 views

WPS and WPA2 connection methods

Do clients use WPS every time when they connect to a WPS-enabled AP? Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange? If the latter, it's possible for ...
0
votes
0answers
56 views

Usefulness of checking MS-CHAP-Challenge by TTLS Server

I've spotted what may be a "missed opportunity" in the EAP-TTLS specification for "Challenge"-based authentication protocols (for instance MS-CHAP-V2). The client initiates MS-CHAP-V2 by tunneling ...
2
votes
1answer
189 views

Is it possible to prevent an attacker from capturing my WI-FI handshake on WPA-2 AES?

For quite a while I've been experimentally hacking wireless routers by capturing handshakes and Decrypting them using oclHashcat on my computer. even the most complicated passwords won't take longer ...
0
votes
3answers
145 views

Can the packets of a wireless network be sniffed by a user who is not present in that network?

1.If an user knows the frequency used by a wireless network, is he able to collect the packets from that network? Those packets may be encrypted, but can he collect those packets? 2.If the user has ...
1
vote
2answers
3k views

can wpa2 wifi be hacked by capturing data on an evil twin?

If I copied the wifi essid and channel and did a de-authentication to the clients of the wifi that I want to hack and started a wifi of my own with the same essid, bssid and channel and I started ...
9
votes
5answers
1k views

Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?

So I'm looking into public WiFi security in places such as hotels, coffee shops etc. It seems the current standard is just to use open wi fi connections in many of these locations. I would assume this ...
34
votes
3answers
18k views

What is the best home wireless network encryption algorithm to use?

What is the best home wireless network encryption algorithm to use? I realize the best answer will probably change over time, and hopefully people can provide updated answers as new standards come ...
0
votes
1answer
937 views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
-1
votes
1answer
135 views

WPA and WPA2 Help [closed]

I'm trying to hack my own WPA and WPA2 network for learning purposes. I used A 10 characters length password with only numbers, I know if I had to create the word list file it will be Huge, So I ...