the same as evil twin fluxion but without captive portal so the victim connects to our fake Wep Wifi that accepts any password after getting disconnected from his Wpa 2 Wifi so we sniff data from the WEP Wifi to get the password that the victim has entered in clear text

  • This sounds like a mix of a downgrade and de-authentication attack... clever. – SomeGuy Mar 6 at 18:04
  • Mod your own WRT WAP to do it? – DarkMatter Mar 6 at 19:27
  • i believe WEP keys are used to encrypt the contents, so if the password is wrong, communication can't happen. You might still be able to sniff out the password, but it won't be easy to avoid arousing suspicion as the user's password won't actually work and the OS will complain. – dandavis Mar 6 at 21:49
  • @DarkMatter "Mod your own WRT WAP to do it?" like how ? the answers section is down there⬇ ⬇ waiting for good answers ... – mina nageh Mar 8 at 14:34
  • @dandavis "You might still be able to sniff out the password" as long as we sniff the correct password ... the rest is no problem... – mina nageh Mar 8 at 14:35

Nope, it has to be an open network. The problem lies on the second message of the WEP authentication which is generated with the password, and later used for data encryption.

To achieve this somehow you need beforehand to know the password the user will use to send him the challenge encrypted, then he'll answer correctly the challenge in message 3 and that's it.

That's how WEP authentication works :(

  • ....oh.. this broke my high ambitions .... do you have any suggestion that can be related to this ? thanks for the very good but sad answer :) – mina nageh Mar 8 at 14:40
  • TBH I can't think of any way this can be achieved... other than open network with captive portal, then after the user inputs the password, change the open network to shared key with the password the user inputs.... but it's to troublesome, and quite fishy for the user. – Azteca Mar 8 at 19:37
  • can you please check this wifi-libre.com/… and if so updated your answer – mina nageh Apr 22 at 11:48
  • This is a WEP Downgrade Attack, and it uses social engineering. Social engineering you can also trick the user into connecting into an open network and show a captive portal telling him to put his WEP password. Or whatever you feel like. – Azteca Apr 22 at 20:03
  • Yup WEP Downgrade attack to hack a wpa wifi network ! ..... so in this method it accepts any password ? – mina nageh Apr 26 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.