Linked Questions

4 votes
3 answers
1k views

How will popular WiFi clients react to an evil twin

If I create an evil twin hotspot next to a legitimate AP and simply clone the SSID, I know that my WiFi client will see these as 2 different APs and both will show up in a list of available networks (...
Sander Smith's user avatar
24 votes
1 answer
75k views

How exactly does 4-way handshake cracking work?

From my understanding this is how WPA2 works for home networks: PSK (Pre-Shared Key) is used to generate PMK (Pairwise Master Key), which is used together with ANonce (AP Nonce) to create PTK (...
user3362334's user avatar
5 votes
1 answer
15k views

Which part of the eapol packets contain WPA password Hash?

I have captured wifi traffic from a WPA network using Wireshark. I filtered the results for "eapol" packets and noted in the info column there are message type 3 and type 1. I believe this is two ...
user2729246's user avatar
2 votes
1 answer
672 views

Create Evil Twin with encryption and intercept input

I know how to create an Evil Twin of a WiFi network using Hostapd. However, I can only create an unencrypted network with eventually a fake login page. While this can be work with some kind of ...
Andrean's user avatar
  • 123
1 vote
1 answer
690 views

Accessing WPA/WPA2 password from native auth form on a rogue router

I'm trying to wrap my head around the WPA/WPA2 4-way handshake in an attempt to determine if it is possible for a rogue wireless access point to retrieve a plaintext (or hashed) version of a router's ...
Brannon's user avatar
  • 135
1 vote
1 answer
698 views

Role of derived keys in EAP-PSK in WPA-2

I'm currently trying to understand WPA-2 and I've discovered that it's built on the EAP-PSK protocol which sets up some keys derived from the SSID name and a password. I assume that the keys derived ...
Dragos's user avatar
  • 113
1 vote
1 answer
180 views

Are there any pen testing tools/methods for wpa2 networks that don't require using an adapter that supports monitor mode? [closed]

I really enjoy reading and researching about networking and pentesting. Recently I heard from a friend that there are ways that can be used to get into wireless networks without needing an adapter ...
mbz's user avatar
  • 11
0 votes
1 answer
2k views

Can brute force or dictionary attacks be detected when using the WiFi protocol?

Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
genral Hummel's user avatar
0 votes
1 answer
604 views

How do Access Points manage attempted Passwords? [duplicate]

How do Access Points check whether the provided password (given by the device wishing to authenticate) is actually the correct password of the Access Point? If a user attempts to join a secured ...
Coto's user avatar
  • 3
0 votes
1 answer
391 views

Can a third party passively read transmissions if WEP / WPA / WPA2 key is known?

If I connect to a WiFi network sporting either WEP, WPA or WPA2 encryption, can someone other decipher my communication he passively received if he knows the network's passphrase?
dronus's user avatar
  • 141
0 votes
0 answers
1k views

MIC vs PTK, what's the difference?

What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK From my research, a PTK is the pairwise ...
Adam's user avatar
  • 1