I am running an evil twin attack with eaphammer, by default it seems to capture mschapv2 authentication which contains the username and NETNTLM hashes. I have manually created a WiFi connection (on Windows) and manually select not to verify CA and to use PAP authentication. When I connect to this new connection, I am able to grab the cleartext password. This is what I want.
My knowledge on wireless communication is limited, but is it possible to force a client to connect to EAP-TTLS/PAP or is this controlled by the client or through client profiles?
Or a better technical question, how is the authentication type controlled?