I am pretty new to the domain of wireless security and am trying to understand the various techniques used for compromising wireless networks. There are a few things that I am not able to correlate and need help understanding them.
(I understand that WEP is no longer recommended but I am just trying to understand some underlying concepts here.)
- Why do I need to bother to BREAK the WEP or WPA keys (maybe using a tool like aircrack-ng)?
Can't I just de-authenticate a client (using aireplay-ng) and then present the client with a fake AP (impersonating a legitimate one) and then, when the client tries to reconnect to the AP, simply capture packets in monitor mode and sniff the key out from those?
In fact, is the fake AP even required here? I mean, even without hosting a fake AP, I could still sniff the PSK from a monitor mode capture (say using tools like Wireshark/Kismet/Cain etc.) - correct?
When we talk about PSK in case of WPA/WPA2, I understand that the PSK (the PMK and PTK finally) are used to encrypt all the data exchange. As per my understanding the PSK is not transmitted over the network by either the client or the AP during the connection/authentication process. It's just the initial nonce that is exchanged and thereafter it is the calculated PTK that is exchanged and it is the MIC that is used for verification. Is my understanding correct?
If my understanding of point 2 is correct, the 4-way handshake is not encrypted, correct? And this 4-way handshake can still be eavesdropped on (maybe through a monitor mode capture or using tools like Kismet/Wireshark/airodump-ng etc.) correct?
Please let me know if I am missing something and any pointers to references will also be helpful.