1

Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What kind of thing should we watch out for? Apart from the obvious things like don't let anyone see you with your laptop running AirCrack.

0

It is hard to give you an answer based on your information. Depending on attacks you are carrying out you might have to interact with the WiFi router or not.

If you have to interact with the WiFi router (e.g. you try to bruteforce the WiFi password): It is theoretically possible that WiFi traffic is monitored through e.g. dedicated WiFi-monitoring security hardware actions, or Wifi AP that report actions to a security software that evaluates those actions to find suspicious actions. However, the usage of something like that is quite exotic. Personally I have never seen or heard of anybody using that in practice and I doubt that any company that doesn't have very high security requirements would use that.

If you don't have to interact with the Wifi router (e.g. when you perform well-known attacks against WEP) you obviously don't have to worry about detection.

TLDR; Its rather unlikely that you get detected anyways.

| improve this answer | |
  • I believe their endpoints are WPA2, and if I understand it correctly I don't need to keep interacting with the router for that attack, is that right? – trallgorm Feb 12 at 15:52
  • 1
    However, the usage of something like that is quite exotic. - Security and reporting features of some sort are almost always included in any major enterprise wireless offering as part of the management platform if not the base system itself. Saying it is quite exotic in a business environment is simply not true. The question is if anyone is actively monitoring the information provided by the system. – YLearn Feb 13 at 5:19
0

A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What kind of thing should we watch out for?

You don't mention the actual wireless vendor or the security (PSK or 802.1X?) used by the wireless network at the site in question. Knowing the vendor will help indicate what capabilities are available to the client to protect their wireless network and detect any attack (examples are rogue detection and WIPS among others) as well as the likely tools used to monitor/report on the wireless network. Knowing the security will determine what types of attacks may be useful/successful.

Without this information, it is difficult to give anything but generalities.

  • Avoid spoofing a client MAC address for a client currently connected to the wireless network.
  • Avoid multiple failed attempts to connect (especially in a relatively short period of time).
  • Be very careful performing any sort of MitM attack by cloning the target SSID.
  • The more passive you can make your attacking device(s) (i.e. listening/monitoring rather than transmitting), the less likely you are to be detected.
  • When active, try to make sure your devices behave as similar to actual client devices as possible.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.