Questions tagged [802.1x]

IEEE 802.1x is a standard for authentication of devices to a network, and is a part of the IEEE 802.1 group of networking protocols. Not to be confused with the wireless networking standard IEEE 802.11.

0
votes
0answers
25 views

PEAP MS-CHAPv2 brute force attack

I have a 802.1x switch and a client authenticated using PEAP-MS-CHAPv2. I sniffed the traffic using a HUB between the client and the switch. How can I use the captured informations to perform a brute-...
0
votes
0answers
20 views

802.1x :how to forge and inject EAP- Logoff frames?

I am testing the vulnerabilities of the 802.1x protocol, applied on wired network. Does anyone know how to forge EAP-Logoff frames and spam them to a particular host? thanks for the help
0
votes
1answer
211 views

How DHCP client can determine that 802.1x Port based authentication has been completed and its time to trigger DHCP discover

I have a Supplicant running on 1 Linux box attached with a Free radius server on other linux box with cisco catalyst switch (with 802.1x Port based access) in between. Now I have been able to ...
1
vote
1answer
43 views

How WPA supplicant can determine whether switch supports authentication or not?

If a client(supplicant) configure to perform EAP-TLS authentication connects with a switch which doesn't requires authentication. How can supplicant determine that authentication is not required and ...
0
votes
0answers
64 views

Capturing Dot11 (802.11) headers on Mac OSX

I'm trying to obtain remote signal strength indication (RSSI) from received packets by sniffing the ones having Dot11 headers. But I've heard somewhere that WLAN interface of Mac OSX (en1 interface as ...
1
vote
1answer
1k views

What is EAPOL payload in WPA2 Cracking?

I am currently working on a python script to crack WPA2. From this SO question: How exactly does 4-way handshake cracking work? I've all of the necessary fields as described, i.e. Addresses, NONCES,...
0
votes
1answer
225 views

Does getting a challenge and response with hostapd-wpe mean that credentials were sent?

I setup an access point to perform an "evil twin" attack on an existing WPA2 Enterprise network (I have permission to do this). I am using hostapd-wpe. Within a short period of enabling the access ...
2
votes
2answers
5k views

Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate?

Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate (CA, user, or otherwise)? If so, what are the security implications? The reason I ask is: I'm regularly connecting to a ...
1
vote
0answers
26 views

Attacking TKIP Group Shared traffic

I am aware of two attacks against TKIP/RC4 encrypted traffic: Beck-Tews attack Ohigashi-Morii attack If I have a network that uses TKIP for the Group Cipher, i.e. multicast and broadcast traffic, ...
3
votes
1answer
283 views

Is it dangerous to install my work's 802.1x certificate? [duplicate]

My employer, the University of Texas at Austin (UT), requires devices running some operating systems* to accept a certificate before they connect. Information about the certificate is available here: ...
0
votes
1answer
526 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
0
votes
0answers
724 views

4 way handshake: How to generate PMK?

I wonder how a utility like Wireshark produces the PTK for decrypting packets given the 4 EAPOl packets. The way I understand it is that the PTK is generated by concatenating the PMK, ANonce, SNonce, ...
0
votes
1answer
4k views

Certificate Based Authentication with AD and 802.1x or EAP-TLS

I like to think I have a better understanding of PKI then most people but this one issue has me scratching my head and I was hoping someone could cut to the core of it. In a system where you have ...
2
votes
2answers
2k views

Is is possible to decrypt 802.11 for WPA enterprise?

So it is fairly trivial to decrypt 802.11 for WPA-PSK as explained in this link https://wiki.wireshark.org/HowToDecrypt802.11. Is it then possible to decrypt the same way for WPA enterprise?(Assuming ...
5
votes
1answer
563 views

wireless security - Authentication and Association

I am trying to learn wireless security a bit more technically but resources out there on the net are so confusing. Here is my understanding. There are two types of Authentication: 1) Open System ...
0
votes
1answer
599 views

802.1x certificate authentication, private key?

In 802.1x does the client authenticate with the certificate containing the privat e key e.g. is the private key stored on the device that is wishing to access a given resource network ?
2
votes
1answer
1k views

Access-Challenge EAP Request

From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP). The Access-Challenge packet ...
1
vote
0answers
82 views

Manipulate EAP negotiation

The EAP method to use is suggested from the client to the server during the EAP negotiation. I'm trying to make the EAP negotiation ends on one specific EAP method (inner authentication included) of ...
1
vote
0answers
114 views

Force/Suggest the client to use one specific EAP method

I would like to suggest to the client which one EAP method and inner authentication to use. I'm using hostapd to create the AP. I've tried by removing some methods in the hostapd.eap_user but I ...
2
votes
0answers
408 views

Change default EAP type in hostapd [closed]

I'm trying to change the default EAP type in hostapd but I am not able to understand how to do that. Here's what I've found reading the hostapd.conf file: > # NAI Realm information > # One or ...
0
votes
2answers
703 views

The benifits of Full NAC solution VS simple radius server

In case we want to enable dot1x authentication on the wired network without using host checker,do we still need NAC solution or just simple AAA server to authenticate the host and dynamic VLAN ...
5
votes
2answers
697 views

Evil Twin Access Point Secured-Unsecured

A very similar question was asked here but it didn't get any reply, so I'm going to ask a new question with some more insights. The problem of the most common Evil Twin Attack is that the fake AP is ...
3
votes
2answers
842 views

ARP Poisoning: exactly how it works

Can anyone tell me how ARP Poisoning exactly works? Because I was sure that worked as I stated here. But I've been told that is not how ARP poisoning works. That the path I've mentioned in the link ...
5
votes
2answers
576 views

ARP Poisoning: WPA Personal and Enterprise

As mentioned in the title, I've questions regarding an ARP Poisoning on a WPA Personal and WPA Enterprise. I'm gonna do an example (please let me know if I'm wrong): I need to send the ARP reply to ...
1
vote
2answers
719 views

PMK is what prevent to generate the PTK and decrypt the traffic?

I'm trying to establish a connection to an encrypted SSID, using scapy. My intent was basically to sniff the frames of the handshake from the victim, acting as a proxy (MITM), and redirect the frames ...
3
votes
1answer
437 views

What information can WiFi devices leak without actually connecting?

Mr Paranoid walks from one secure location to another. Mid-journey, he panicks -- his wireless device (laptop, iPad, or other common consumer electronics) is turned on! If it sent any information to ...
0
votes
2answers
2k views

Iterate through and decode Dot11Elt layers — Scapy

OBJECTIVE I want to iterate through the Dot11Elt layers of a beacon frame that I captured with Scapy. I also want to decode the .info of each ID layer. def packet_handler(packet) : if packet....
0
votes
2answers
365 views

Does wireless card need to be on same channel as AP to sniff beacon frames?

OBJECTIVE Essentially, my goal is to emulate something like airodump-ng wlan0 Here is a link just in case ... airodump-ng Collects raw 802.11 frames Displays nearby access points and data GAMEPLAN ...
3
votes
2answers
2k views

How to sniff 802.11 packets without going into monitor mode?

Is it possible to sniff or capture 802.11 packets which sends my computer to the router (AP). I know that I can't sniff packets which have a other destination MAC address without going into monitor ...
4
votes
1answer
3k views

Sending Probe Request Frames | Receving Probe Response — Scapy

OBJECTIVE Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames ) The object ...
17
votes
2answers
11k views

How to force clients to connect to WiFi automatically?

I have watched a hak5 YouTube that they did make people connect to their wifipineapple (a WiFi Honey pot) , and they stored the Wi-Fi hotspots, those the phone used to connect to. The historical ...
0
votes
2answers
103 views

How secure is LAN wireless 802.11 if password is used with access point?

I've read a book on computer networks, and among other subjects the author touched WiFi security. It was said that WiFi has some serious security flaws and that there is even free publicly available ...
1
vote
0answers
75 views

How does deauth protection (IEEE_802.11w-2009) work?

I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
2
votes
3answers
407 views

Wireless network risks? [closed]

What are the security risks associated with installing a Wi-Fi (802.11) network in-comparison to a wired network for internet connection?
1
vote
0answers
799 views

How to get 802.1X credentials with hostapd-wpe?

I've been using hostapd-wpe to create fake access points and trick clients into connecting to them. This plan always worked very well for "normal" WPA2-Enterprise networks, as I've always been able to ...
2
votes
2answers
183 views

What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?

If you authenticated with your eduroam credentials at a participating institution, your home institution is the one doing the authentication of the credentials, and the host institution is only ...