Questions tagged [wpa2-psk]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
68 views

How is WPA-PSK authentication done?

When I try connecting to wireless networks (with no RADIUS server), I enter the password and it goes through an authentication process. After the station successfully connects to the access point, a 4-...
user avatar
0 votes
0 answers
83 views

Constructing PTK key from sniffed traffic and decrypting WPA2 network traffic using it

Suppose there is a WPA2/PSK access point (AP) and 2 clients are connected to it, say X and Y. So X and Y both know the password or PSK required for authentication. From here: In case of WPA2/PSK when ...
user avatar
0 votes
0 answers
15 views

Significant differences in hash cracking speeds? [duplicate]

I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
user avatar
0 votes
1 answer
244 views

Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?

All the references I have found https://en.wikipedia.org/wiki/IEEE_802.11i-2004 https://www.wifi-professionals.com/2019/01/4-way-handshake https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
user avatar
0 votes
1 answer
121 views

WPA/WPA2 networks without passwords [duplicate]

From my current understanding, WPA networks use a network's SSID and password to produce a PSK (pre-shared-key), which encrypts/decrypts communications between the router and the client before a new ...
user avatar
3 votes
1 answer
195 views

Why does a 20-character key make WPA Personal more secure?

Can someone tell me why a 20-character key makes WPA Personal more secure? That really confuses me.
user avatar
1 vote
1 answer
710 views

How is the MIC (message integrity code) generated in WPA2?

We know that in WPA2's four-way handshake, a MIC is generated in order verify the supplicant (client). But how it is generated? Is something hashed to get the MIC? The PTK (pairwise transient key) ...
user avatar
  • 13
0 votes
1 answer
255 views

Is there a point in randomizing my WPA2-Personal SSID (meaning, set a random string in place of the SSID)?

I was looking for ways to make Wi-Fi that uses WPA2-Personal/WPA-PSK secure, and I stumbled in this answer (the second one, from Terrence Koeman): WPA2-PSK (aka WPA2 Personal) basically does the same ...
user avatar
  • 15
4 votes
2 answers
3k views

Recommended length for WPA-2 password in 2020

I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
user avatar
0 votes
2 answers
152 views

Can a router be attacked without being associated to it's WiFi?

Can an old and upatched (assume a 15 y.o. TP-Link: so plenty of vulnerabilities) be breached given: no physical access WEP is disabled WPA is up but password is not crackable via aircrack-ng + ...
user avatar
  • 1,817
0 votes
2 answers
242 views

How Wifi prevent hacking in the same network?

We all know that the client device and WiFi AP will perform the 4 way handshake to generate the session key (PTK). Here is the recap of the 4 way handshake. 1.Client device<-----ANonce-----WiFi AP ...
user avatar
0 votes
1 answer
401 views

Using MAC Filtering in addition to WPA2 Encryption

I've been trying to find some answers regarding using MAC filtering on my router in addition to having WPA2 encryption but I couldn't find any clear ones. I understand that using MAC filtering solely ...
user avatar
1 vote
1 answer
237 views

With WiFi now having protected management frames, is it still worth attempting an evil twin attack?

I was trying to aireplay'ng my home WiFi but I understood that with the new generation of APs, there is a system of protected management frames. So I'm asking, is it still worth it to perform an evil ...
user avatar
  • 31
0 votes
0 answers
725 views

MIC vs PTK, what's the difference?

What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK From my research, a PTK is the pairwise ...
user avatar
  • 1
5 votes
1 answer
872 views

Why are WPA2 passwords longer than 16 bytes more secure than 16 byte passwords?

In this good Information Security StackExchange question, the answers reveal that a long WPA2-PSK password does not degrade performance of the network. The reasoning is that the password itself is ...
user avatar
1 vote
2 answers
229 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
user avatar
1 vote
1 answer
247 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
user avatar
  • 11
2 votes
2 answers
399 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
user avatar
2 votes
0 answers
129 views

WPA3-Personal and traffic privacy

It is well known that (malicious) endpoints in a Wi-Fi network password-protected by WPA2-Personal can sniff all clear traffic to/from any other endpoint, if they can also capture the 4-way handshake ...
user avatar
0 votes
1 answer
266 views

How to protect your wifi traffic from sniffing if untrusted people know the password?

WPA2 PSK is used to encrypt packets to and from a router. All the members on the network have the wifi password, so theoritically if one of them is untrustable they could be able to capture and ...
user avatar
  • 1
1 vote
2 answers
4k views

Details of a good WPA2 pre-shared key (password)?

From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated: https://security.stackexchange.com/a/56646/37051 However, from other reading, ...
user avatar
  • 320
2 votes
1 answer
5k views

Will WPA Enterprise give any advantage on home network with one user?

I understand some of the reasons why WPA Enterprise is more secure from this question: Why is WPA Enterprise more secure than WPA2? However, given a home network with only one single user where that ...
user avatar
  • 320
1 vote
1 answer
1k views

Save decrypted pcap or decrypt on reading with rdpcap

I created a small program with runs command: tshark -i2 -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" Passphrase:SSID\"" -w test.pcapng This creates the file test.pcapng, but it ...
user avatar
6 votes
2 answers
119 views

Why WPA2 Client Devices Respond to Any Deauths

A great number of attack methods for WPA2 involve getting a handshake capture. To capture one the fastest way involves sending deauthentication packets to the client forcing him to initiate the ...
user avatar
  • 503
2 votes
2 answers
259 views

Wireless network solution? WPA2/MAC Filtering problems

In short we have 7 Mobile Casio Scanners that seem to be incapable of holding their Wi-Fi passwords, they sometimes lose them for no apparent reason. We of course, cannot give out the wireless ...
user avatar
1 vote
2 answers
522 views

Is HTTP secure within a WPA2-PSK connection?

I'm running a small, low power web server chip which creates a Wi-Fi access point using WPA2-PSK AES encryption. This chip is never connected to the public Internet or any other network. A client ...
user avatar
0 votes
1 answer
283 views

Can KRACK be used to obtain wifi credentials that could be used to normally connect to an AP? [duplicate]

I have a pretty simple question about KRACK. From what I have read it would be very common to be able to forge, decrypt, delay and block client packets as well as AP packets using KRACK. Does this ...
user avatar
  • 959
-1 votes
1 answer
306 views

Handshake not capturing on wpa-psk/wpa 2 psk

I'm struggling to get a handshake from my router when using airodump. airmon-ng airmon-ng check kill airodump-ng wlan0mon airodump-ng -c (channel)--bssid(adress)-w (.cap file locand name) wlan0mon ...
user avatar
1 vote
2 answers
756 views

KRACK Attack vs sniffing

Trying to learn.... The ultimate difference between the vulnerability outlined in the answer posted here and KRACK attack is that with KRACK attack, the attacker does not need the AP pass phrase?
user avatar
  • 441
1 vote
1 answer
2k views

wpa2-psk aes hacking with android

I have a digisol HR3400 router, I want to prevent it from being hacked. Can I use wpa2-psk aes to prevent hacking by Android apps like andro dumper or wpa tester?
user avatar
  • 13
7 votes
3 answers
12k views

Can someone explain in simple steps how WPA2-Enterprise authentication and encryption happens?

When I try asking this question on other websites I get massive downvotes and am told "We're not doing your homework. Use google." Also I sometimes get banned. Anyways, I've searched tens of pages of ...
user avatar
1 vote
3 answers
764 views

Why can't Wifi be secured assymetrically? [closed]

Why couldn't we switch from AES to something asymmetric? Then a private key doesn't need to be shared with the client; rather just share a public key with them.
user avatar
  • 121
1 vote
1 answer
158 views

Is WPA-PSK of IEEE 802.11 insecure if PSK is exposed?

In WPA 4-Way Handshake, SNonce, ANonce, AP MAC addr and STA MAC addr are exposed to an eavesdropper Eve. But I think it is still safe unless PSK (password) is exposed to Eve. If PSK is exposed, ...
user avatar
  • 141
3 votes
2 answers
3k views

Is the Karma attack still relevant today?

I tried replicating the Karma attack and it does not work on my iphone5s and galaxy s6. Even when the phones send out directed probe requests and the Rouge AP responds with the appropriate probe ...
user avatar
0 votes
1 answer
373 views

Which key is actually used for encrypting data traffic in WPA after the 4WHS?

Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true? From what I understand, this can have very ...
user avatar
0 votes
1 answer
1k views

What are the roles of PSK and GTK in a WPA setting?

I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
user avatar
6 votes
3 answers
16k views

How do I bruteforce a WPA2 password given the following conditions?

I'm trying to brute-force my own WiFi, and from my own research, I know that all default passwords for this specific model of router I'm trying to hack follow the following rules: password length = 8 ...
user avatar
  • 89
7 votes
1 answer
5k views

Attack WPA password with hashcat - Settings and resources for "german" passwords?

I'd like to prove to a friend of mine that his wifi is insecure and learn something about password cracking on the way. The guy I am talking about does not believe in strong passwords but in SSID ...
user avatar
  • 173
2 votes
1 answer
371 views

WPA PSK to WPA EAP PSK roaming

Would clients (iPhone, android, whatever) roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 ...
user avatar
1 vote
1 answer
133 views

See communication in WiFi with known password

I know the password to a certain router which uses WPA2-PSK-CCMP + WPS + ESS, is it possible to watch the communication between devices and the router unencrypted assuming I know the password to the ...
user avatar
  • 131
33 votes
3 answers
16k views

How safe are Wi-Fi Hotspots? Because WPA 2 is compromised, is there any other security protocol for Wi-Fi?

WPA 2 can be cracked using Aircrack-ng in Kali Linux. Is there any other security protocol for Wi-Fi which is not compromised?
user avatar
  • 525
0 votes
2 answers
547 views

What is the chance that my WiFi passphrase has the same WPA2 hash as a PW present in an adversary's char. based brute force password search space?

What is the chance that my WiFi passphrase has the same WPA2 hash as a password present in an adversary's character based brute force password search space, after a 30% is searched. WiFi PSK WPA2 ...
user avatar
  • 525
2 votes
1 answer
332 views

Why does john force MinLen to 8 for wpapsk?

I'm trying to use john to test wpa security. I want it to generate 10-character passwords, so I've added this to john.conf: [Incremental:Test] File = $JOHN/alnum.chr MinLen = 10 MaxLen = 10 CharCount ...
user avatar
3 votes
1 answer
1k views

Aircrack-ng: Why deauth works

When using aircrack to attack WPA, deauth packets are used to force a host to deauthenticate. But the machine sending these deauth packets is not even connected to the network. How possible is it that ...
user avatar
  • 1,526
42 votes
7 answers
15k views

Why is HTTP data sent in clear text over password-protected Wifi?

In my home I have a router protected with WPA2-PSK (WPA2 Personal), using the passphrase. When I try to log in to a page over the Internet (this page does not use HTTPS to log me in), all my data is ...
user avatar
  • 407
8 votes
3 answers
6k views

Extract WPA PSK from airodump-ng output file

How can I get the PSK hash in plain text from a airodumnp-ng .cap file ? Example : Hash : af8cfcf3c66d6e279d3fcb43e78569e872446e24f5f190350637fa174d9ece63 I understand aircrack-ng -J file....
user avatar
  • 105
6 votes
1 answer
2k views

Evil twin access point with WPA/WPA2

When I created an evil twin AP with an SSID of someone else's Wi-Fi network e.g. MyWifiNet, I could see two APs on my phone/laptop with the SSID MyWiFiNet, however the legitimate one was secured with ...
user avatar
3 votes
2 answers
484 views

Attacking WEP/WPA/WPA2

When attacking WEP/WPA/WPA2, I see people buy a wireless network adapter (e.g. Alfa). Why can't an inbuilt adapter in a laptop work? Or in other words, is there a quick way for me to check if the ...
user avatar
  • 1,526
4 votes
1 answer
1k views

How are WPA2 passwords encoded?

I'm trying to figure out a good John The Ripper rule for WPA2 that won't waste time testing impossible passwords. Thus the question - are there any limits on what's allowed in a WPA2 password? Can it ...
user avatar
  • 6,504
1 vote
2 answers
3k views

Is WPA-PSK AES safer than WPA-PSK TKIP-AES?

On this forum thread I see (translated): On Telecom Router we have those wifi encryption modes Disabled-OpenNet - WEP (128 bit) -> WEP (unsafe breakable in some minutes) - WPA-PSK TKIP 256 bit -...
user avatar
  • 113