Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I know that there are ways to view saved WPA keys, but I am trying to figure out how to get the WPA key of an access point while connected to the same domain over Ethernet.
Also, what if the router settings page is password protected? Assume admin privileges on the local machine have already been gained.
If the key is not already saved on the computer you have access to (which you exclude) and you don't have a way to sniff WiFi traffic (which you don't explicitly exclude but probably meant to) then your only choice is to extract the key from any device which knows the key and which are reachable from your system. Such devices include the router but often include other PC's, printers, phones, devices to stream music and other IoT gadgets. Protection of these devices is often weaker then you might expect, i.e. no password or standard passwords. And there are lots of backdoors, backdoors and more backdoors.
Because you are not accessing the wireless communications that would contain the key in an encrypted form, what you are trying to do is to extract a setting from a network device (the AP).
You say that the AP is password protected, so the only way to get the key is to get the login credentials to the AP and read the configuration.
Being physically connected to the network through ethernet generally will not help you obtain the network's wireless password, unless there is some other kind of vulnerability - for insance, an unprotected router admin page, or perhaps a vulnerable client connected to WiFi that you can break into and extract the password from (fairly unlikely).
Authentication between wireless clients and the access point occurs over the air; this communication does not travel over the wired portion of the network so being connected to ethernet does not give you a significant advantage. Plus, even if you capture the authentication packets you'd still have to perform a brute force attack on the wirelessly-transmitted WPA handshake to obtain the original password, something that can be done without connecting to the network at all.
