Skip to main content

Questions tagged [wireless]

Wireless security topics including 802.11, Bluetooth, and others.

Filter by
Sorted by
Tagged with
1 vote
2 answers
2k views

Is there any way to send malicious keystrokes to wireless keyboard USB dongle?

I have read many blogs on how to intercept wireless keyboard keystrokes. Similarly is there any way where we can send keystrokes to any keyboards USB receiver module? can we kick out the existing ...
knobiDev's user avatar
  • 113
11 votes
2 answers
1k views

How does MDK3 carry out deauth attacks?

With aireplay, you have to specify both the AP and client to send deauth frames to, but MDK3 doesn't require an AP mac address. Does it just scan the desired channel for beacons until it finds an AP ...
Bobbybobbobbo's user avatar
0 votes
2 answers
150 views

When I receive data in this scenario, how many times is it encrypted?

Right now I'm using a Web browser under the following circumstances: I am making this post over HTTPS I am connected to a password-protected Wi-Fi network with WPA/WPA2, EAP-PEAP, and MSCHAPV2 ...
JesseTG's user avatar
  • 523
2 votes
1 answer
4k views

What does SSI signal does mean in captured packets in wireshark?

In the packet captured below, captured by wireshark does the SSI Signal in dBm represents the power at which the sniffing network adapter (say USB network adapter wlan1 on Raspberry Pi3) received ...
haccks's user avatar
  • 145
2 votes
1 answer
3k views

MDNS activity-- is this a network risk/vuln?

I am connected to a wireless network that is huge (think large organization). After opening up Wireshark and capturing pcap for about 15 minutes I am seeing lots of MDNS Standard Query traffic with ...
userJoe's user avatar
  • 93
6 votes
3 answers
4k views

How to setup a Virtual Wireless Router?

I need to teach some students about cracking WEP and WPA passwords, as I don't have a real wireless router to use, is there any VM that I could use to simulate a wireless network? Like a Virtual ...
Ricardo Reimao's user avatar
2 votes
1 answer
356 views

Deauth as a protection

In the case that there is an ongoing attack in my network, where the attacker is using WLAN to access my network and I recognize it, would it be possible to send a broadcast deauth in my network to ...
hoppla1232's user avatar
3 votes
2 answers
8k views

Security of Bluetooth tethering vs. Wi-Fi hotspot

I'm using my cellphone to connect my laptop to the web. I think connecting my cellphone to my laptop with a USB cable would be the safest connection but if I go wireless, is it safer to connect to my ...
frenchie's user avatar
  • 1,091
3 votes
1 answer
6k views

How to prevent WiFi jammer attack? [duplicate]

How can I prevent a WiFi jammer attack on my wireless network? For example if I send a deauth (deauthentication) packet with aircrack-ng on Kali Linux for a specific client, he/she can't use WiFi. ...
unbl0ck3r's user avatar
  • 169
6 votes
2 answers
6k views

How to connect HackRF to Wireshark?

How to capture ZigBee waves using HackRF and how to analyze it through Wireshark?
SJK's user avatar
  • 61
3 votes
1 answer
1k views

Why do public wifi networks often have a click screen to join? [closed]

At many if not most coffeeshops and other public Wi-Fi locations, even though Wi-Fi is free and not password protected, there are click screens with "join" buttons that need to be tapped to access the ...
TheEnvironmentalist's user avatar
2 votes
1 answer
5k views

Security of Wi-Fi vs Bluetooth

I am preparing a project for a client. It is a wireless device to be used inside a factory so the workers can interact with the factory without having to go to a terminal. In order to connect the ...
Daniferrito's user avatar
0 votes
1 answer
3k views

WPS Why Can't Pin be Bruteforced Offline

I don't totally understand how the WPS protocol works but why cannot a user get the hash of the WPS pin from the router and crack it in the same way a WPA2 handshake is cracked? (Not pixiewps but ...
NULL's user avatar
  • 503
1 vote
2 answers
3k views

Stations not deauthenticating when using Aircrack-ng

I am attempting to conduct a deauthentication attack on a stand alone AP using Aircrack-ng. Im using an ASUS 802.11ac router and using aireplay-ng to send the deauthentication packets. But when ...
dan_ponting's user avatar
0 votes
1 answer
251 views

In Real-Time, where do we deploy Extensible Authentication Protocol(EAP) in Wireless Networks?

I have heard that the EAP protocol has authentication capabilities for wireless networks too. But I am not able to get how it is deployed in real time as I know that whenever I need to connect to my ...
Skynet's user avatar
  • 588
2 votes
0 answers
347 views

Getting the current time from wifi networks without connecting [closed]

In a microcontroller powered by a solar cell we need to have the current time. When the sun decrease the micro-controller switch off and all the volatile data vanish. When the sun increase the micro-...
Michael Courcy's user avatar
2 votes
1 answer
1k views

Few questions about group keys family in WPA/WPA2

In my previous question I learnt something about Group Temporal Key (GTK), but after searching the internet I have another questions: 1. How is Group Master Key (GMK) derived? What is GMK derived ...
Bartosz Królak's user avatar
0 votes
1 answer
1k views

Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks?

I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode). It is my understanding that 802.11 networks using WEP encryption ...
david's user avatar
  • 3
1 vote
1 answer
84 views

Does it affect the probability of successful trasmission if a jammer hops channels?

Suppose an attacker tries to jam a wireless communication. There are 10 channels available and the legitimate sender chooses one of them of transmission randomly every 1s. If it transmits data for 5s ...
Nikolaos Kakouros's user avatar
3 votes
2 answers
2k views

Windows 10 Wi-Fi vs Airplane Mode Security

Does Windows 10 Airplane Mode provide the same level of security/protection as turning off Wi-Fi? I know that turning on Airplane Mode disables Bluetooth; however, as far as connecting to the ...
Anton Rasmussen's user avatar
1 vote
1 answer
158 views

Wireless Adapter + Arduino 'Bug'

First, I am new to ethical hacking. And also I just realized that I need a wireless adapter for wireless attacks. I'm currently mastering Python, and some basic knowledge in Bash and Arduino. What I ...
Wowotek's user avatar
  • 13
29 votes
1 answer
77k views

EAP-TLS vs EAP-TTLS vs EAP-PEAP

I'm having troubles understanding the differences between the 3. As far as I understand, with EAP-TLS, the client (peer) and the server (authenticator) both need a certificate. The authentication is ...
netik's user avatar
  • 447
1 vote
1 answer
3k views

WPS. Output messaging translation to "human readable"

I'm trying to test the wifi security of my router at home. It has WPS activated. I know WPS should deactivated, I'm only testing... Reaver is "spitting" a lot of messages, the question is: What is ...
Siracuso's user avatar
1 vote
1 answer
4k views

Are iPhones immune to deauth attacks?

I was today rumbling a bit with wireless security, and more specific in creating Fake Access-Points to make Wi-Fi users enter their password on a phishing-page (by using the Fluxion tool). One of the ...
O'Niel's user avatar
  • 2,916
3 votes
1 answer
223 views

Are there any signs for an end-user of cellular calls being routed through a Stingray device?

The Stingray is a small device that mimics cellular towers. From the user's endpoint side, is there any way to detect you are being routed through a rogue cellular tower?
Kamic's user avatar
  • 693
0 votes
1 answer
368 views

How can someone determine where a wireless router/SSID originated? [duplicate]

Someone hacked my wifi. I beefed up security. They now have renamed their SSID with a derogatory SSID including my apartment number. I want to find where they are so I can confront them. Is that ...
user3063346's user avatar
0 votes
1 answer
200 views

Security better between WPA/WPA2 and AP Login Webpage

I silly wonder if we can stand outside and sniff password login webpage in protocol HTTPS or not? And attacker can brute force the WPA or WPA2 but if they change AP:set non-password and redirect ...
Rei's user avatar
  • 34
0 votes
1 answer
158 views

Wireless Access Point CONF? Edit [duplicate]

Is it possible that for instance I have one access point that it requires a password for authorization to access to modem and internet. I want to edit this step like a user when he/she click to the ...
Fi.'s user avatar
  • 1
3 votes
1 answer
866 views

What information can WiFi devices leak without actually connecting?

Mr Paranoid walks from one secure location to another. Mid-journey, he panicks -- his wireless device (laptop, iPad, or other common consumer electronics) is turned on! If it sent any information to ...
spraff's user avatar
  • 315
1 vote
1 answer
536 views

Prevention against De-Auth Attack for Handshake Capturing [duplicate]

As far as I know about De-authentication attack, the attacker sends de-auth packets to both router and the victim asking the victim to disconnect and reconnect. But I wonder what would happen if I ...
7_R3X's user avatar
  • 656
0 votes
2 answers
552 views

Does MAC filtering in WLAN protect against MAC spoofing?

An organization has a Wireless router with MAC filtering enabled allowing only certain users to connect. If an attacker knows the password and SSID of the WLAN, and he manages to spoof one of the user'...
RaJ's user avatar
  • 525
3 votes
1 answer
9k views

Enterprise Wireless 5Ghz deauth

I am running blackbox pentests on an enterprise wireless setup. My area of attack consists of multiple APs that have a 2.4 GHz interface and also a 5GHz one. I have successfully deauthenticated users ...
Sabin Nicula's user avatar
2 votes
1 answer
3k views

WPS PBC Security

On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame. There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any ...
BgrWorker's user avatar
  • 1,929
1 vote
0 answers
121 views

What happens when an attacker sends fake nonce in TKIP handshake?

The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
tpm900's user avatar
  • 171
6 votes
4 answers
2k views

Caught Deauth attempt on wireless network last night. Suggestions on what to do from this point?

Last night around 3-4 am I had noticed my network acting funky.. I flipped my wireless card into monitor mode and boom there was a rogue AP. I then acknowledged that I had seen them and mimic'd the ...
JohnnyMnemonic's user avatar
1 vote
0 answers
314 views

mdk3 beacon pwning not detected by other devices

I'm new to wireless security. I'm trying to pwn beacon frames to announce a new access point using mdk3. However, when I run the command I get the following result where the MAC address is not ...
Peter Gerges's user avatar
2 votes
1 answer
736 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
nduru's user avatar
  • 21
1 vote
1 answer
1k views

What information does a wireless access point have about connected devices?

Which information about a connected device leaks to the access point it is connected to? What's the minimum amount of information that must be supplied to successfully connect, apart from the password?...
Jibran.'s user avatar
  • 13
6 votes
1 answer
2k views

How Hole 196 actually works ? What WPA parameters does it exploit?

While dealing with wireless set I came across the term Hole 196. Got to know that preventions too. But can it still bypass Client isolation and standard preventive approach if packets are crafted at ...
Arjun sharma's user avatar
0 votes
2 answers
445 views

Wireless EAP-TLS implementing on Medical Wireless Device

I am new to PKI, digital certificates etc and will be the first time to connect a medical wireless device to a wireless network using EAP-TLS. I am connecting a medical wireless device to our customer'...
OLI11E's user avatar
  • 3
6 votes
2 answers
2k views

What are weak IVs? Can we somehow stop or slow down WEP cracking by avoiding usage of them?

Most of us dealing with wireless security must have cracked a WEP key, and while doing that must have come across texts like this: weak IVs, reveal more information about the secret part of the WEP ...
Arjun sharma's user avatar
0 votes
1 answer
110 views

Wireless devices with default configurations

I have the idea of deploying a product using a Raspberry Pi alike (CHIP) however I am concerned of the security issues getting a wireless device into people's homes The device will be: Using all the ...
LuisF's user avatar
  • 185
1 vote
2 answers
1k views

scans for WIFI access points

PCI DSS requirement 11.1: "Implement processes to test for the presence of wireless access points (802.11), and detect and identify all authorized and unauthorized wireless access points on a ...
BokerTov's user avatar
  • 539
2 votes
2 answers
2k views

Change device MAC address to router's MAC address

This is in respect to bypassing Captive Portals. I haven't tried it yet on a captive portal yet. But I was wondering, what will happen if : I connect to a wireless network Get the router's MAC ...
Sanidhay's user avatar
  • 191
3 votes
1 answer
782 views

Why are wireless adapters needed for wireless attacks?

I got into penetration testing a couple of weeks ago and just started learning more about wireless attacks and how they are done, and they mention a lot the need of wireless adapters. Would I still ...
Ace's user avatar
  • 43
4 votes
3 answers
2k views

Are Apple Magic Keyboards Secure Against Man-in-the-Middle Attacks?

Is Apple magic keyboard secure against man-in-the-middle attacks when it pairs to mac automatically? Recently I heard lots of wireless keyboards are vulnerable to eavesdropping. I don’t want my key ...
user124001's user avatar
1 vote
1 answer
1k views

Capture Handshake with WPS disabled

I just got into exploring network cracking. Honestly, just to learn how the process works. I am not curious about cracking the handshake as much as capturing it. It seems when I set up a test ...
Ryan J Danneskjöld's user avatar
7 votes
1 answer
3k views

List wireless stations around me

I'm looking to find a specific wireless user around me, I have his MAC address, I even have the channel he is on. I've tried iwlist peers, to no avail, as well as airodump. I have seen his mac pop up ...
unknown6708's user avatar
4 votes
1 answer
1k views

Arp replay for cracking WEP key IN Aircrack-ng

I'm pretty new to all of this so it might be a little stupid question... but why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP ...
Rexi's user avatar
  • 43
2 votes
1 answer
1k views

Strange behavior when injection wifi packets with aireplay-ng [closed]

When I'm testing packet injection with aireplay-ng I can witness a strange behaviour on my Lenovo T510i. Several blogs report my wireless device to be capable of packet injection. But then look at ...
kaidentity's user avatar
  • 2,654

1 2 3
4
5
10