0

I ask this question because i am not happy with the answer here

In a normal attack such as fluxion.

  1. You send DEAUTH packets to the victim wifi.
  2. Clone their access point and host an open wifi.
  3. Let the victim connect and serve them a web portal where you ask for the password(social engineering)
  4. Compute and check the password and only let them pass when the password matches.

But wouldn't this attack be wayy more authentic if you could just tweak the router/card to host an access point that grabs the credentials when authenticating to the wifi itself.My question is based on my assumption that the router must get the password when a device tries to connect with it.

@thorium touches on the subject by saying

They cannot create a twin WPA network without knowing the password of the legitimate one

But you dont have to know the password it could contain any password when the device authenticates you grab those credentials and check them.

IS SUCH AN ATTACK POSSIBLE AND WORTH LOOKING INTO?

  • That's not how WPA authentication works, though. You're not really sending the password; you're proving you know it, and it's done in such a way that you "can't" figure out the password or how to prove it just from watching the transaction. In practice, like anything else, through enough computers at it and you'll get it eventually, and certain forms of WPA are less secure than others, but that's the theory of it. – Fund Monica's Lawsuit Jul 6 at 15:40
  • 1
    Well, the router has to know the password, obviously, but my understanding is that no, it's never sent. It's hard for me to explain because I don't really understand what's happening. – Fund Monica's Lawsuit Jul 6 at 16:02
  • 2
    There is a multi-step negotiation process that occurs between a PC and the wifi router/access point to authenticate. This process is skipped on open (non-encrypted) wifi points; anyone can connect to them. The negotiation handshake uses the secret key known by both sides to derive (create) a session key to make a login request. Someone without the key (the MITM) can't create a valid session/login key, so they can't connect. The password is never sent to the router, just the session key. – Mark Ripley Jul 7 at 10:56
  • 1
    @MarkRipley That sounds like an answer to me. – Fund Monica's Lawsuit Jul 7 at 11:24
  • 1
    @Nic Hartley: I know just enough about this subject to be dangerous, but don't know enough to give a complete (good) answer. – Mark Ripley Jul 7 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.