0

I have a small network infrastructure in my home on which I'm hosting some services such as a website, file server and such.

Many of those services have an administration web interface which isn't using HTTPS or doesn't support it.

I'm currently using a laptop in my home network using Wi-Fi to login into those internal HTTP administration pages.

So, user and password are probably sent in cleartext inside my home network. Since this is a WPA2 protected wireless connection between my laptop and my home router, credentials should pass in the air encrypted as I know. Other servers are connected using wired.

I know there are a set of public tools, such as airmon-ng, to capture packets which are sent over the air. Is it possible for someone who is using such passive capture tools to get my credentials?

I mean, the attacker captures the WPA2 traffic from the air (without being connected on the network) while I'm logging to HTTP-only internal web pages. So, I'm pretty sure the credentials are present (encrypted) in the capture. Could the attacker use brute-forcing to get some key and decrypt the WPA2 traffic, so get the credentials from such capture?

Improve this question
7
  • Your title and what you end up asking in the end are different. Putting the specifics of what data is being passed, your question boils down to: "Is it possible for someone who is using aircrack-ng to get view unencrypted traffic between 2 devices on my network?" The answer is "yes".
    – schroeder ♦
    Apr 29, 2019 at 14:31
  • How they use the tools can be different from the specific attack that you mention (recording and cracking packets).
    – schroeder ♦
    Apr 29, 2019 at 14:35
  • So, from all this, what do you want to know? Do you want to know about the specific attack you ask about? Is the boiled down question basically what you meant to ask?
    – schroeder ♦
    Apr 29, 2019 at 14:36
  • I want to know by the question if it is possible for someone to (a neighboor for example), to capture raw traffic from air, decrypt it and get credentials from the decrypted capture. If a specific attack exists, the question is mostly answered. It would not be safe to login using HTTP on an WPA2 protected network. However, I'm curious to know what is that specific attack, so I could verify the scope of it on my network.
    – pmbonneau
    Apr 29, 2019 at 15:24
  • Lots of different attacks. Aircrack provides some tutorials of some different methods: aircrack-ng.org/doku.php?id=newbie_guide#active_attacks
    – schroeder ♦
    Apr 29, 2019 at 15:40

1 Answer 1

Reset to default
0

I think you already know everything you need to answer yourself.

The only layer of security it's the WPA2 encryption, so, basically any attack against it would show the credentials since it's plain HTTP, so... there's capturing the four-way handshake and breaking it to decrypt the traffic*, there's the Downgrade attack, there's the KRACK attack and pretty much any other MITM Wi-Fi attack, UPnP on your router, etc.

So... It all comes down to your security practices, and the hardening of your home router.

*To your question: Yes if he captures the four-way handshake and the traffic in which you logged in, he's ready to bruteforce for the password and decypher the traffic he captured (Offline).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .