3

If I copied the wifi essid and channel and did a de-authentication to the clients of the wifi that I want to hack and started a wifi of my own with the same essid, bssid and channel and I started capturing the packets, will the clients send the password to my wifi?
Sorry if it's a stupid question or something, but if it's possible how?

  • 1
    Is your question equivalent to "are WPA2 PSKs vulnerable to a man-in-the-middle attack?" – cpast Jan 16 '15 at 18:32
  • @cpast no I meant is it vulnerable to phishing attacks? – RL.AdmiralX Jan 17 '15 at 3:04
3

I'm going to assume you mean WPA2-Personal AES in particular in this answer. If you mean WPA2-Enterprise, it's a whole different kettle of fish, and if you mean anything less, the access point owner (and perhaps users) should upgrade.

Essentially, the answer is no, a MITM "Evil Access Point" never gets the actual passphrase. They pass a nonce (salt) back and forth, information on protocols supported, etc., but both the Access Point and the Station construct the key themselves.

Therefore, an evil access point cannot "phish" the key from the client during 802.11 operations.

You can see this "in action" in sniffer traces at Cisco's 802.11 Sniffer Capture Analysis - WPA/WPA2 with PSK or EAP

Now, an Evil Access Point that can hear both the Good Access Point and the Station can capture 4-way handshakes and then use the usual tools to perform brute-force, mask, and rules-based dictionary attacks, but it doesn't need to broadcast anything to capture that if the clients are authenticating on their own.

For a phishing attack, an attacker is down to sending emails, or having their Evil Access Point not use WPA2, which should be a red flag to users.

If you are using WPA2-Enterprise, perhaps try the surprisingly readable Benefits and Vulnerabilities of Wi-Fi Protected Access 2 (WPA2) , which does cover other standards.

1

The passphrase is used for mutual authentication. That is, clients authenticates to AP and AP authenticates to client. Doing a MITM should be possible only when the attacker knows the password.

Moreover, there is no need for passwords being sent in plaintext. There are multiple protocols for authenticating by password without actual revealing it. I am not sure which one is used in WPA2.

  • I meant in my question, is wpa2-psk vulnerable to phishing attacks. so in my phished wifi will I be able to know the password if the client connected to me, with his wifi password? – RL.AdmiralX Jan 17 '15 at 3:03
  • If you mean a rogue AP that user automatically connects to, this is impossible, since the AP would have to authenticate to the user by knowledge of the password. There is, however, possible a different scenario, but it requires user interaction if the client WiFi is properly implemented. First, you make noise to hide the valid AP. Second, you create an open AP with the same name. Third, the user connects to the AP (by hand). Fourth, there is a captive portal that asks the user for the password. – v6ak Jan 17 '15 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.