Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wpa2]

Security protocol (IEEE 802.11i) developed by the Wi-Fi Alliance to protect wireless networks.

0
votes
0answers
42 views

MIC vs PTK, what's the difference?

What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK From my research, a PTK is the pairwise ...
4
votes
1answer
188 views

Why are WPA2 passwords longer than 16 bytes more secure than 16 byte passwords?

In this good Information Security StackExchange question, the answers reveal that a long WPA2-PSK password does not degrade performance of the network. The reasoning is that the password itself is ...
0
votes
1answer
101 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
0
votes
1answer
95 views

Is it safe to login using HTTP on a WPA2 protected home network?

I have a small network infrastructure in my home on which I'm hosting some services such as a website, file server and such. Many of those services have an administration web interface which isn't ...
1
vote
1answer
99 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
1
vote
2answers
80 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
0
votes
1answer
75 views

is it possible to evil twin a WPA 2 Wifi using one of EAP methods?

the same as fluxion but without the captive portal just like this video Stealing 802.1x Credentials with Rogue AP & RADIUS server he was able to get the username and the password of an EAP wifi ...
2
votes
2answers
108 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
0
votes
1answer
112 views

How to protect your wifi traffic from sniffing if untrusted people know the password?

WPA2 PSK is used to encrypt packets to and from a router. All the members on the network have the wifi password, so theoritically if one of them is untrustable they could be able to capture and ...
0
votes
1answer
61 views

Securely connecting a wifi client to an AP using a generated password

I have two embedded systems, one acting as an AP with WPA2 and the other as a client. The idea is for a user to connect their client to the AP without any setup, so the authentication will all be ...
2
votes
1answer
119 views

What has to occur for a hacker to monitor traffic from my LAN?

I understand that if you change your network card from managed mode to monitor mode you will be able to monitor and sniff the traffic of your local network plus all the access points around you. My ...
1
vote
1answer
42 views

How WPA supplicant can determine whether switch supports authentication or not?

If a client(supplicant) configure to perform EAP-TLS authentication connects with a switch which doesn't requires authentication. How can supplicant determine that authentication is not required and ...
2
votes
1answer
119 views

Create Evil Twin with encryption and intercept input

I know how to create an Evil Twin of a WiFi network using Hostapd. However, I can only create an unencrypted network with eventually a fake login page. While this can be work with some kind of ...
2
votes
0answers
81 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
0
votes
1answer
220 views

Sniffing router's WiFi traffic

Let's say someone already has my key and is logged in my wifi network and also has access to my router. Catching the four-way handshake for the hacker is important to see my web traffic. If he wants ...
1
vote
2answers
768 views

Details of a good WPA2 pre-shared key (password)?

From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated: https://security.stackexchange.com/a/56646/37051 However, from other reading, ...
2
votes
1answer
705 views

Will WPA Enterprise give any advantage on home network with one user?

I understand some of the reasons why WPA Enterprise is more secure from this question: Why is WPA Enterprise more secure than WPA2? However, given a home network with only one single user where that ...
0
votes
1answer
172 views

Implementation of PMKID computing function

I am trying to implement a function, let's say in Python to compute Pairwise Master Key Identifier (PMKID) after reading the previously discovered bug in WPA2. Googling gave me this logical statement: ...
10
votes
1answer
1k views

Mitigating the new attack on WPA2 involving PMKID

A new attack was discovered which allows cracking a WPA2 passphrase without needing to capture the 4-way handshake. While this doesn't weaken the password itself, it does mean that an attacker can ...
4
votes
2answers
2k views

Why does a deauth attack work on WPA2 despite encryption?

Given that WiFi packets should be encrypted if WPA2 is used, why is it that a deauth attack can be successful? Shouldn't the machine know that the message is illegitimate due to the fact that it would ...
1
vote
1answer
380 views

EAPOL messages in different WPA handshakes

I have a pcap file with two captured packets only. Time Protocol Info 0.000000 EAPOL Key (Message 3 of 4) 2934.200222 EAPOL Key (Message 2 of 4) I already know, ...
1
vote
1answer
1k views

What is EAPOL payload in WPA2 Cracking?

I am currently working on a python script to crack WPA2. From this SO question: How exactly does 4-way handshake cracking work? I've all of the necessary fields as described, i.e. Addresses, NONCES,...
0
votes
1answer
482 views

Finding wpa2 key length

Is it possible to determine WPA key length through a successful handshake? Below is a screen capture showing the packet capture session of interest as displayed in Wireshark: My question came from ...
1
vote
0answers
27 views

Decrypting 802.11 packets captured through wireshark [duplicate]

I created my own network with security of WPA2-PSK, so I know the SSID, and password. I then connected 2 devices (A and B) to this network and started capturing B's traffic from A using wireshark in ...
-1
votes
1answer
709 views

Can brute force or dictionary attacks be detected when using the WiFi protocol?

Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
0
votes
1answer
700 views

Using airolib-ng with crunch and then using the file using aircrack-ng gives unexpected result

I'm using airlib-ng and crunch to generate password Database and use that Password Database in aircrack-ng to crack the Captured Handshake of a WPA2 Wireless Network. Here are my terminal Commands ...
3
votes
2answers
87 views

Am I supposed to find non-wifi devices in 802.11 frames of WPA2 encrypted wifi?

I recently tuned in on my access point to see what data is visible despite encryption. Am I supposed to find MAC addresses of my non-wifi clients in the 802.11 frames and is this part of the protocol ...
1
vote
0answers
135 views

Why WPA2 did not design a PTK based on asymmetric cryptography?

I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi. PMK is made with crypt_hash(SSID + PSK). OK, seems good. Then, the client and the Access Point (AP) make the famous 4 way ...
0
votes
1answer
222 views

Does getting a challenge and response with hostapd-wpe mean that credentials were sent?

I setup an access point to perform an "evil twin" attack on an existing WPA2 Enterprise network (I have permission to do this). I am using hostapd-wpe. Within a short period of enabling the access ...
3
votes
2answers
2k views

WPA password cracking setup

let's say i am trying to crack a WPA password and i need to create a virtual machine setup for it. What would the setup be if i limit myself with a specific number of hours ( let's say 24 hours and ...
3
votes
1answer
348 views

What are the factors making a WPA2 handshake suitable for cracking?

Days ago I was dumping handshakes of my APs using airodump-ng. I would later use aircrack-ng to crack them using wordlists which would purposely contain the passphrases. However, I noticed that some ...
6
votes
2answers
10k views

How long would it take to brute force an 11 character single-case alphanumeric password?

My previous home wifi router's WPA2 password was permanently fixed to FZ4HBCKHGC8. How long would it take to crack via brute force? Or more pragmatically: How long would it take to exhaust all ...
26
votes
1answer
6k views

What is stronger - WPA2 Enterprise with 2048 bit key, or Personal with 63 character passphrase?

Which of the two following has a stronger cryptographic strength in withstanding brute-force attacks? WPA/WPA2 Enterprise using 2048-bit RSA public-key WPA/WPA2 Personal using 63-character ...
2
votes
0answers
89 views

WPA2 MIC 128bits value VS HMAC SHA1 output 160bits

I understand that under WPA2, if the MIC value is equal to the HMAC SHA1 function, that means the password from dictionary attack works. However, after deriving the MIC value from Wireshark, which is ...
3
votes
2answers
385 views

WiFi security in 2018

On my wireless network I have implemented WPA2 protocol with AES encryption. Last year there was several warnings that WPA2 is broken, hacked. Now there are announcements that WPA3 is comming in 2018. ...
2
votes
1answer
2k views

Command Syntax for KRACK pentesting [duplicate]

I have been trying to pen test my router with a variety of ways, long story short, it locks out indefinitely with pixie wps until I go to the router admin page and click unlock. I tried DDOS with MDK, ...
0
votes
1answer
210 views

Can KRACK be used to obtain wifi credentials that could be used to normally connect to an AP? [duplicate]

I have a pretty simple question about KRACK. From what I have read it would be very common to be able to forge, decrypt, delay and block client packets as well as AP packets using KRACK. Does this ...
9
votes
2answers
1k views

WPA3 announced. Really needed?

It seems Wi-Fi Alliance announced WPA3 for the end of 2018. Anybody knows exactly what is new? features, security improvements, etc... Is it because of Krack attack? I thought patching WPA2 is enough....
4
votes
1answer
101 views

Is Apple compromising network security with its default settings, which allow users to provide network credentials to other users with one tap?

This article summarizes the functionality that has been recently added to Apple devices. My colleagues have expressed concerns about this feature eroding network security at the office. My ...
10
votes
2answers
1k views

Krack attack(er) sees which traffic?

I am trying understand one thing about the KRACK attack. I see explanations like this everywhere: The hacker interferes with the initial handshake between your device and the WiFi router in ...
9
votes
4answers
856 views

My ISP shows my WiFi password on their public site in plain text. Should I be worried?

I recently noticed that when logged into my ISPs (Spectrum) public, external site that can be accessed outside my network, I can see my home network's WPA2 password in plain text. This clearly means ...
3
votes
1answer
1k views

How does a device send the Wi-Fi password to the router? [duplicate]

When I connect to a Wi-Fi network I know the password of, how does the device send the password? Specifically, what prevents the network next door from catching that message and thereby learning the ...
4
votes
3answers
431 views

Risk of eavesdropping when using private and encrypted WiFi network but no TLS

Of course, normally I would use HTTPS, but that's not an option in a potential scenario I don't want to get into... This question is similar to Is it possible to secure a web app without HTTPS?, ...
6
votes
1answer
302 views

Hashing password longer than 14 characters in wpa_supplicant.conf

My college has a WPA2 Enterprise network, which I can connect to on my Pi after configuring the network in wpa_supplicant.conf. I don't want my Wi-Fi password stored in plain text, so I use echo -n $...
0
votes
1answer
514 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
1
vote
0answers
98 views

Forward packages to Access Point in KRACK attack

I am investigating the KRACK attack based on the published paper and their youtube video. I largely understand the attacks proposed in the paper as they are except for the completion of the ...
1
vote
1answer
743 views

How do I check if my router is patched against the KRACK exploit?

Numerous Google searches found little useful information. The most comprehensive list is at http://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4 and most ...
2
votes
2answers
211 views

Is WiFi confidentiality provided by public hotspot gateways same or worse than WPA2?

As I understand how most WiFi hotspots work, they require the user to authenticate on a Web page that is served by a proxy on the WiFi default gateway. After whatever authentication process (if any) ...
0
votes
2answers
650 views

How to detect KRACK attack?

I want to create a honeypot that will detect KRACK attacks. Is there any way to detect that kind of attack, are there any traces, any information that is stored in log files (syslog for example) that ...
1
vote
1answer
429 views

are older wpa_supplicant versions vulnerable to KRACK?

Are wpa_supplicant versions prior to 2.x (e.g. 0.2.x, 0.4.x, 0.6.x, 0.7.3, etc.) also vulnerable to any of the KRACK CVEs? I've looked at the source code but it's different enough from the 2.x ...