5

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP)

Another question is about Reaver-WPS, what if an access point doesn't support WPS, or is disabled? Will Reaver work on such AP

Improve this question
3
  • 1
    I don't have sources so I won't write an Answer, but no - you can go past WPA without brute-forcing it. It just that the math is complicated enough that running through the most common passwords first is probably faster for the intruder in many cases.
    – shieldfoss
    Commented Jul 30, 2013 at 7:03
  • 2
    If WPS is disabled then the exploit against WPS won't work. If you have questions about WPA I suggest you do some research on the algorithm.
    – Ramhound
    Commented Jul 30, 2013 at 11:42
  • Yes, WPA can be cracked without brute force. news.dice.com/2014/03/20/…
    – user69354
    Commented Mar 1, 2015 at 0:45

1 Answer 1

Reset to default
6

WPA can be used with different protocols. Using WPA-TKIP, there are alternative attacks than the common handshake-bruteforce, but those will not grant you access to the AP. These attacks focus on RC4 weaknesses (similar to WEP, but far less effective due to successful countermeasures).

I assume that you want to acces an AP. In this case, bruteforcing is the only possible way to crack WPA. You capture a handshake between client and accesspoint, and perform the challenge-response yourself with different passwords, until your result matches the one you captured.

This can be sped up by using rainbow-tables, although you will have to find a target using a popular SSID in order to have an existing rainbow table.

Thus, to protect against intruders, you should choose an uncommon SSID along with a fairly long and complex password.

And no, you can not attack WPS when WPS is disabled or not supported. There may be bugs preventing a user from disabling WPS, but i consider these APs WPS-enabled.

Improve this answer
3
  • You might want to add a reference the "shoulder-surfing" (and similar) class of attacks to your answer: that usually the easiest way to grab a WAP/WEP password.
    – Stephane
    Commented Oct 30, 2013 at 10:37
  • @Stephane a legitimate user will not type password everytime, however social engineering attacks always works
    – Mark Evans
    Commented Oct 31, 2013 at 3:48
  • @MarkEvans That pretty much what I meant: brute-forcing the WAP key is usually not the easiest way in.
    – Stephane
    Commented Oct 31, 2013 at 8:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .