0

I ask this question because i am not happy with the answer here

In a normal attack such as fluxion.

  1. You send DEAUTH packets to the victim wifi.
  2. Clone their access point and host an open wifi.
  3. Let the victim connect and serve them a web portal where you ask for the password(social engineering)
  4. Compute and check the password and only let them pass when the password matches.

But wouldn't this attack be wayy more authentic if you could just tweak the router/card to host an access point that grabs the credentials when authenticating to the wifi itself.My question is based on my assumption that the router must get the password when a device tries to connect with it.

@thorium touches on the subject by saying

They cannot create a twin WPA network without knowing the password of the legitimate one

But you dont have to know the password it could contain any password when the device authenticates you grab those credentials and check them.

IS SUCH AN ATTACK POSSIBLE AND WORTH LOOKING INTO?

Improve this question
8
  • That's not how WPA authentication works, though. You're not really sending the password; you're proving you know it, and it's done in such a way that you "can't" figure out the password or how to prove it just from watching the transaction. In practice, like anything else, through enough computers at it and you'll get it eventually, and certain forms of WPA are less secure than others, but that's the theory of it.
    – anon
    Jul 6, 2019 at 15:40
  • 1
    Well, the router has to know the password, obviously, but my understanding is that no, it's never sent. It's hard for me to explain because I don't really understand what's happening.
    – anon
    Jul 6, 2019 at 16:02
  • 2
    There is a multi-step negotiation process that occurs between a PC and the wifi router/access point to authenticate. This process is skipped on open (non-encrypted) wifi points; anyone can connect to them. The negotiation handshake uses the secret key known by both sides to derive (create) a session key to make a login request. Someone without the key (the MITM) can't create a valid session/login key, so they can't connect. The password is never sent to the router, just the session key.
    – Mark Ripley
    Jul 7, 2019 at 10:56
  • 1
    @MarkRipley That sounds like an answer to me.
    – anon
    Jul 7, 2019 at 11:24
  • 1
    @Nic Hartley: I know just enough about this subject to be dangerous, but don't know enough to give a complete (good) answer.
    – Mark Ripley
    Jul 7, 2019 at 11:30

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .