the same as evil twin fluxion but without captive portal so the victim connects to our fake Wep Wifi that accepts any password after getting disconnected from his Wpa 2 Wifi so we sniff data from the WEP Wifi to get the password that the victim has entered in clear text

  • This sounds like a mix of a downgrade and de-authentication attack... clever.
    – SomeGuy
    Commented Mar 6, 2019 at 18:04
  • Mod your own WRT WAP to do it?
    – DarkMatter
    Commented Mar 6, 2019 at 19:27
  • i believe WEP keys are used to encrypt the contents, so if the password is wrong, communication can't happen. You might still be able to sniff out the password, but it won't be easy to avoid arousing suspicion as the user's password won't actually work and the OS will complain.
    – dandavis
    Commented Mar 6, 2019 at 21:49
  • @DarkMatter "Mod your own WRT WAP to do it?" like how ? the answers section is down there⬇ ⬇ waiting for good answers ...
    – mina nageh
    Commented Mar 8, 2019 at 14:34
  • @dandavis "You might still be able to sniff out the password" as long as we sniff the correct password ... the rest is no problem...
    – mina nageh
    Commented Mar 8, 2019 at 14:35

1 Answer 1


Nope, it has to be an open network. The problem lies on the second message of the WEP authentication which is generated with the password, and later used for data encryption.

To achieve this somehow you need beforehand to know the password the user will use to send him the challenge encrypted, then he'll answer correctly the challenge in message 3 and that's it.

That's how WEP authentication works :(

  • ....oh.. this broke my high ambitions .... do you have any suggestion that can be related to this ? thanks for the very good but sad answer :)
    – mina nageh
    Commented Mar 8, 2019 at 14:40
  • TBH I can't think of any way this can be achieved... other than open network with captive portal, then after the user inputs the password, change the open network to shared key with the password the user inputs.... but it's to troublesome, and quite fishy for the user.
    – Azteca
    Commented Mar 8, 2019 at 19:37
  • can you please check this wifi-libre.com/… and if so updated your answer
    – mina nageh
    Commented Apr 22, 2019 at 11:48
  • This is a WEP Downgrade Attack, and it uses social engineering. Social engineering you can also trick the user into connecting into an open network and show a captive portal telling him to put his WEP password. Or whatever you feel like.
    – Azteca
    Commented Apr 22, 2019 at 20:03
  • Yup WEP Downgrade attack to hack a wpa wifi network ! ..... so in this method it accepts any password ?
    – mina nageh
    Commented Apr 26, 2019 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .