I setup an access point to perform an "evil twin" attack on an existing WPA2 Enterprise network (I have permission to do this).
I am using hostapd-wpe. Within a short period of enabling the access point my devices see the network and attempt authentication and I receive a challenge and reponse.
When I take the challenge and response and attempt to run a dictionary attack on them I am unsuccessful. Even if I connect to the access point with a password of password or manually add a real password to my wordlist.
With jtr I am using the following:
john --wordlist=/usr/share/wordlists/rockyou.txt.gz hash.txt john --format=netntlm-naive --wordlist=/usr/share/wordlists/rockyou.txt.gz hash.txt
When I try mschapv2 or netntlmv2 in jtr or hashcat it loads 0 hashes. hashcat provides an error regarding salt-length.
hostapd-wpe indicates that the challenge and response is mschapv2.
Looking for a simple answer but any advice is greatly appreciated. Does getting the challenge and response indicate that these machines just sent their credentials to the evil twin AP, and I am just need to keep working on figuring out how to crack mschapv2? Or does getting a challenge and response not necessarily mean success and I may need to continue working on the evil twin AP?