is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks.

If it can, how, but if not, is there another tool that could be used to accomplish this?

Also, what can be done to prevent this type of attack on a network?

  • I'm not sure, but I remember reading somewhere about WPA2-PSK vulnerabilities, the same source also claimed that because of relatively fast key rotation in WPA-Ent, they are secure (both 1st and 2nd version). Don't quote me on that though. Commented Jan 23, 2013 at 22:16

2 Answers 2


Not alone like a WPA/2 PSK attack, where you can simply capture the handshake and bruteforce.

You'll need to capture the "Enterprise" authentication attempt. To do this, you can perform an "Evil Twin" attack that captures the authentication attempt, which can then be subsequently cracked.

Here's an excellent presentation by Matt Neely of SecureState that details the attack: http://www.slideshare.net/NEOISF/attacking-and-securing-wpa-enterpris

Specific Steps of the Attack:

  • Attacker sets up a Fake AP
    • Mirror the target SSID, encryption type and band
    • Configure the AP to accept Enterprise authentication
    • Enable AP, ensure it is visible to the target
  • Connect the AP to a FreeRADIUS (with password Wireless Pwnage Edition patch) server that captures auth
  • Deauth any target you can get within range of your fake AP
  • Wait for targets to attach to the the fake AP, capture their authentication
  • Crack the challenge / response pair to recover the password

Hope this helps!

  • 4
    Question: Doesn't WPA2-Enterprise feature certificate verification of APs, i.e. my device won't attempt to authenticate with an AP until it sees a signed certificate?
    – StockB
    Commented Jun 6, 2016 at 12:55
  • 2
    Yes, depending on the configuration it can verify the AP certificate.
    – maggick
    Commented Nov 20, 2018 at 16:38

According to my knowledge it is only possible to crack WPA/WPA2 PSK or Pre Shared Keys. During authentication handshake. It is possible to capture eapol handshakes. This can be accomplished either actively or passively. However, just aircrack is not sufficient. It is used in a last stage.

However it is not recommended to use PSK or similar lower level security for enterprise networks. And it is not compatible with compliance requirements. Most of these networks have main components such as radius servers, PKIs with protocol support such as EAP_TLS (Transport Layer Security). This ensure the authentication and trust among devices. With AES encryption standards, data communication is highly secure. So it is not possible to crack if it is up to its standards.

However, there may be vulnerable spots. Like mixed protocol usage, obsolete clients who are allowed to use other mechanisms. Nothing is 100% secure.

  • If there is a username and password, how can you attack if you know the username? Is that possible? Commented Jan 24, 2013 at 0:51
  • jcran had provided the answer to the rest of the question. :)
    – Lasith
    Commented Jan 24, 2013 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .