Questions tagged [802.1x]
IEEE 802.1x is a standard for authentication of devices to a network, and is a part of the IEEE 802.1 group of networking protocols. Not to be confused with the wireless networking standard IEEE 802.11.
46
questions
0
votes
0
answers
32
views
bind a certificate to a specific IP address with 802.1x or any other "secure" protocol
Let's say that you have a network composed of 802.1x clients (with user-password auth and dynamic IP addresses) and servers (with MAC-based auth and static IP addresses).
I would like to know if you ...
- 101
0
votes
1
answer
637
views
How to create PKCS12 container with no password
I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the ...
- 176
0
votes
1
answer
164
views
EAP-TLS for securing internal local WLAN?
I'm looking at securing a wi-fi network used in an industrial context.
I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). ...
- 103
1
vote
1
answer
147
views
How does the supplicant connect to the auth server in EAP TTLS?
I understand that a tls has to be established between the supplicant (end user device) and the auth server but a few things are unclear :
How does the supplicant know the ip adress of the auth server ...
- 29
1
vote
0
answers
189
views
What is Received Sequence Counter(RSC) in WPA authentication
In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant.
The only information I found about RSC is that it's ...
- 11
0
votes
1
answer
134
views
How do I determine whether a person use a (public) WiFi access point using WiFi sniffing?
I would like to distinguish the behavior of users to use a (public) Wi-Fi access point. It would be possible to access the log files of the access point, but I don't have the authority to.
...
- 103
0
votes
1
answer
273
views
How are keys negotiated in wpa-eap?
Question about PEAP-MSCHAPV2 on RADIUS.
After MSCHAPV2 success keys are extracted from TLS context. Then it sent to AP.
Client failed to connect WiFi (or eapol, etc) with my handmade RADIUS Access-...
- 111
0
votes
1
answer
422
views
Monitor mode not sniffing from other devices on the same network
i'm currently running a 802.11n adapter in monitor mode on a kali linux PC. Monitor mode was enabled using airmon-ng. On the same network as the kali linux PC are 2 raspberry pi devices.
Pinging from ...
1
vote
0
answers
126
views
Packets shown are mostly 802.11 despite open network
I'm currently trying to see if it's possible to sniff MQTT packets between two raspberry pi's from a wireless adapter in monitor mode attached to my PC.
I ran the following command on my PC (Kali ...
- 11
1
vote
1
answer
382
views
What is the best way to authenticate active directory users who want to connect to Ubiquiti or Meraki's WiFi hotspots?
I know .1x is the protocol that actually does the job, does RADIUS have to be involved in this process, .1x only works with RADIUS (AKA NPS on server-side Windows)?
- 11
1
vote
0
answers
147
views
PEAP MS-CHAPv2 brute force attack
I have a 802.1x switch and a client authenticated using PEAP-MS-CHAPv2.
I sniffed the traffic using a HUB between the client and the switch.
How can I use the captured informations to perform a brute-...
- 11
0
votes
0
answers
105
views
802.1x :how to forge and inject EAP- Logoff frames?
I am testing the vulnerabilities of the 802.1x protocol, applied on wired network.
Does anyone know how to forge EAP-Logoff frames and spam them to a particular host?
thanks for the help
- 23
0
votes
1
answer
1k
views
How DHCP client can determine that 802.1x Port based authentication has been completed and its time to trigger DHCP discover
I have a Supplicant running on 1 Linux box attached with a Free radius server on other linux box with cisco catalyst switch (with 802.1x Port based access) in between. Now I have been able to ...
1
vote
1
answer
102
views
How WPA supplicant can determine whether switch supports authentication or not?
If a client(supplicant) configure to perform EAP-TLS authentication connects with a switch which doesn't requires authentication.
How can supplicant determine that authentication is not required and ...
0
votes
0
answers
225
views
Capturing Dot11 (802.11) headers on Mac OSX
I'm trying to obtain remote signal strength indication (RSSI) from received packets by sniffing the ones having Dot11 headers. But I've heard somewhere that WLAN interface of Mac OSX (en1 interface as ...
- 161
1
vote
1
answer
12k
views
What is EAPOL payload in WPA2 Cracking?
I am currently working on a python script to crack WPA2. From this SO question:
How exactly does 4-way handshake cracking work?
I've all of the necessary fields as described, i.e. Addresses, NONCES,...
- 137
0
votes
1
answer
804
views
Does getting a challenge and response with hostapd-wpe mean that credentials were sent?
I setup an access point to perform an "evil twin" attack on an existing WPA2 Enterprise network (I have permission to do this).
I am using hostapd-wpe. Within a short period of enabling the access ...
- 11
6
votes
2
answers
17k
views
Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate?
Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate (CA, user, or otherwise)?
If so, what are the security implications?
The reason I ask is: I'm regularly connecting to a ...
- 1,739
1
vote
0
answers
85
views
Attacking TKIP Group Shared traffic
I am aware of two attacks against TKIP/RC4 encrypted traffic:
Beck-Tews attack
Ohigashi-Morii attack
If I have a network that uses TKIP for the Group Cipher, i.e. multicast and broadcast traffic, ...
- 4,068
3
votes
1
answer
459
views
Is it dangerous to install my work's 802.1x certificate? [duplicate]
My employer, the University of Texas at Austin (UT), requires devices running some operating systems* to accept a certificate before they connect. Information about the certificate is available here:
...
- 905
0
votes
1
answer
1k
views
Break into WPA2-Enterprise RADIUS wifi network by stealing credentials
I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network.
Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
0
votes
0
answers
1k
views
4 way handshake: How to generate PMK?
I wonder how a utility like Wireshark produces the PTK for decrypting packets given the 4 EAPOl packets. The way I understand it is that the PTK is generated by concatenating the PMK, ANonce, SNonce, ...
- 321
0
votes
1
answer
7k
views
Certificate Based Authentication with AD and 802.1x or EAP-TLS
I like to think I have a better understanding of PKI then most people but this one issue has me scratching my head and I was hoping someone could cut to the core of it.
In a system where you have ...
- 355
2
votes
2
answers
4k
views
Is is possible to decrypt 802.11 for WPA enterprise?
So it is fairly trivial to decrypt 802.11 for WPA-PSK as explained in this link https://wiki.wireshark.org/HowToDecrypt802.11. Is it then possible to decrypt the same way for WPA enterprise?(Assuming ...
- 429
9
votes
2
answers
894
views
wireless security - Authentication and Association
I am trying to learn wireless security a bit more technically but resources out there on the net are so confusing. Here is my understanding.
There are two types of Authentication:
1) Open System ...
- 213
0
votes
1
answer
1k
views
802.1x certificate authentication, private key?
In 802.1x does the client authenticate with the certificate containing the privat e key e.g. is the private key stored on the device that is wishing to access a given resource network ?
- 1,558
2
votes
1
answer
2k
views
Access-Challenge EAP Request
From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP).
The Access-Challenge packet ...
- 177
1
vote
0
answers
153
views
Manipulate EAP negotiation
The EAP method to use is suggested from the client to the server during the EAP negotiation.
I'm trying to make the EAP negotiation ends on one specific EAP method (inner authentication included) of ...
- 41
1
vote
0
answers
159
views
Force/Suggest the client to use one specific EAP method
I would like to suggest to the client which one EAP method and inner authentication to use.
I'm using hostapd to create the AP.
I've tried by removing some methods in the hostapd.eap_user but I ...
- 41
2
votes
0
answers
540
views
Change default EAP type in hostapd [closed]
I'm trying to change the default EAP type in hostapd but I am not able to understand how to do that.
Here's what I've found reading the hostapd.conf file:
> # NAI Realm information
> # One or ...
- 41
0
votes
2
answers
2k
views
The benifits of Full NAC solution VS simple radius server
In case we want to enable dot1x authentication on the wired network without using host checker,do we still need NAC solution or just simple AAA server to authenticate the host and dynamic VLAN ...
- 355
5
votes
2
answers
1k
views
Evil Twin Access Point Secured-Unsecured
A very similar question was asked here but it didn't get any reply, so I'm going to ask a new question with some more insights.
The problem of the most common Evil Twin Attack is that the fake AP is ...
- 177
3
votes
2
answers
1k
views
ARP Poisoning: exactly how it works
Can anyone tell me how ARP Poisoning exactly works?
Because I was sure that worked as I stated here.
But I've been told that is not how ARP poisoning works. That the path I've mentioned in the link ...
- 177
5
votes
2
answers
1k
views
ARP Poisoning: WPA Personal and Enterprise
As mentioned in the title, I've questions regarding an ARP Poisoning on a WPA Personal and WPA Enterprise.
I'm gonna do an example (please let me know if I'm wrong):
I need to send the ARP reply to ...
- 177
1
vote
2
answers
1k
views
PMK is what prevent to generate the PTK and decrypt the traffic?
I'm trying to establish a connection to an encrypted SSID, using scapy.
My intent was basically to sniff the frames of the handshake from the victim, acting as a proxy (MITM), and redirect the frames ...
- 177
3
votes
1
answer
807
views
What information can WiFi devices leak without actually connecting?
Mr Paranoid walks from one secure location to another. Mid-journey, he panicks -- his wireless device (laptop, iPad, or other common consumer electronics) is turned on! If it sent any information to ...
- 315
2
votes
2
answers
4k
views
Iterate through and decode Dot11Elt layers -- Scapy
OBJECTIVE
I want to iterate through the Dot11Elt layers of a beacon frame that I captured with Scapy. I also want to decode the .info of each ID layer.
def packet_handler(packet) :
if packet....
- 345
0
votes
2
answers
637
views
Does wireless card need to be on same channel as AP to sniff beacon frames?
OBJECTIVE
Essentially, my goal is to emulate something like airodump-ng wlan0
Here is a link just in case ... airodump-ng
Collects raw 802.11 frames
Displays nearby access points and data
GAMEPLAN ...
- 345
3
votes
3
answers
4k
views
How to sniff 802.11 packets without going into monitor mode?
Is it possible to sniff or capture 802.11 packets which sends my computer to the router (AP). I know that I can't sniff packets which have a other destination MAC address without going into monitor ...
- 159
5
votes
1
answer
5k
views
Sending Probe Request Frames | Receving Probe Response -- Scapy
OBJECTIVE
Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy
Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames )
The object ...
- 345
17
votes
2
answers
13k
views
How to force clients to connect to WiFi automatically?
I have watched a hak5 YouTube that they did make people connect to their wifipineapple (a WiFi Honey pot) , and they stored the Wi-Fi hotspots, those the phone used to connect to.
The historical ...
- 387
0
votes
2
answers
147
views
How secure is LAN wireless 802.11 if password is used with access point?
I've read a book on computer networks, and among other subjects the author touched WiFi security. It was said that WiFi has some serious security flaws and that there is even free publicly available ...
- 101
1
vote
0
answers
155
views
How does deauth protection (IEEE_802.11w-2009) work?
I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
- 6,514
2
votes
3
answers
468
views
Wireless network risks? [closed]
What are the security risks associated with installing a Wi-Fi (802.11) network in-comparison to a wired network for internet connection?
- 141
1
vote
0
answers
1k
views
How to get 802.1X credentials with hostapd-wpe?
I've been using hostapd-wpe to create fake access points and trick clients into connecting to them. This plan always worked very well for "normal" WPA2-Enterprise networks, as I've always been able to ...
- 1,107
2
votes
2
answers
256
views
What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?
If you authenticated with your eduroam credentials at a participating institution, your home institution is the one doing the authentication of the credentials, and the host institution is only ...
- 1,894