Questions tagged [wpa2-psk]
The wpa2-psk tag has no usage guidance.
81
questions
2
votes
1
answer
165
views
Which attack is more dangerous: Evil Twin or ARP spoofing?
I'm learning about the Evil Twin and ARP Spoofing attacks performed by an attacker on the same WPA2-PSK protected wireless network and wanted to know which one would be more impactful since both of ...
- 23
0
votes
1
answer
309
views
How is WPA-PSK authentication done?
When I try connecting to wireless networks (with no RADIUS server), I enter the password and it goes through an authentication process. After the station successfully connects to the access point, a 4-...
0
votes
0
answers
16
views
Significant differences in hash cracking speeds? [duplicate]
I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
- 684
1
vote
1
answer
670
views
Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?
All the references I have found
https://en.wikipedia.org/wiki/IEEE_802.11i-2004
https://www.wifi-professionals.com/2019/01/4-way-handshake
https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
- 133
0
votes
1
answer
365
views
WPA/WPA2 networks without passwords [duplicate]
From my current understanding, WPA networks use a network's SSID and password to produce a PSK (pre-shared-key), which encrypts/decrypts communications between the router and the client before a new ...
- 3
3
votes
1
answer
286
views
Why does a 20-character key make WPA Personal more secure?
Can someone tell me why a 20-character key makes WPA Personal more secure? That really confuses me.
- 41
1
vote
1
answer
2k
views
How is the MIC (message integrity code) generated in WPA2?
We know that in WPA2's four-way handshake, a MIC is generated in order verify the supplicant (client). But how it is generated? Is something hashed to get the MIC? The PTK (pairwise transient key) ...
- 13
0
votes
1
answer
434
views
Is there a point in randomizing my WPA2-Personal SSID (meaning, set a random string in place of the SSID)?
I was looking for ways to make Wi-Fi that uses WPA2-Personal/WPA-PSK secure, and I stumbled in this answer (the second one, from Terrence Koeman):
WPA2-PSK (aka WPA2 Personal) basically does the same ...
- 5
4
votes
2
answers
8k
views
Recommended length for WPA-2 password in 2020
I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
0
votes
2
answers
176
views
Can a router be attacked without being associated to it's WiFi?
Can an old and upatched (assume a 15 y.o. TP-Link: so plenty of vulnerabilities) be breached given:
no physical access
WEP is disabled
WPA is up but password is not crackable via aircrack-ng + ...
- 1,917
0
votes
2
answers
348
views
How Wifi prevent hacking in the same network?
We all know that the client device and WiFi AP will perform the 4 way handshake to generate the session key (PTK). Here is the recap of the 4 way handshake.
1.Client device<-----ANonce-----WiFi AP
...
- 3
0
votes
1
answer
751
views
Using MAC Filtering in addition to WPA2 Encryption
I've been trying to find some answers regarding using MAC filtering on my router in addition to having WPA2 encryption but I couldn't find any clear ones. I understand that using MAC filtering solely ...
1
vote
1
answer
370
views
With WiFi now having protected management frames, is it still worth attempting an evil twin attack?
I was trying to aireplay'ng my home WiFi but I understood that with the new generation of APs, there is a system of protected management frames. So I'm asking, is it still worth it to perform an evil ...
- 29
0
votes
0
answers
1k
views
MIC vs PTK, what's the difference?
What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK
From my research, a PTK is the pairwise ...
- 1
5
votes
1
answer
1k
views
Why are WPA2 passwords longer than 16 bytes more secure than 16 byte passwords?
In this good Information Security StackExchange question, the answers reveal that a long WPA2-PSK password does not degrade performance of the network. The reasoning is that the password itself is ...
1
vote
2
answers
259
views
Key reinstallation attack how does it work without a pre-shared key?
The author of the key reinstallation attack released scripts on Github to test AP and clients.
To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
- 11
1
vote
1
answer
291
views
Where does last 4 bytes of hmac go in wpa2 mic?
The wpa2 mic is a 16 bytes array which is built by Hmac(sha1)
,But the Hmac(sha1) returns 20 bytes array.
So where does that 4 bytes go?
- 11
2
votes
2
answers
465
views
Can a rogue client bypass the Wi-Fi Access Point?
Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
2
votes
0
answers
192
views
WPA3-Personal and traffic privacy
It is well known that (malicious) endpoints in a Wi-Fi network password-protected by WPA2-Personal can sniff all clear traffic to/from any other endpoint, if they can also capture the 4-way handshake ...
0
votes
1
answer
350
views
How to protect your wifi traffic from sniffing if untrusted people know the password?
WPA2 PSK is used to encrypt packets to and from a router. All the members on the network have the wifi password, so theoritically if one of them is untrustable they could be able to capture and ...
- 1
1
vote
2
answers
5k
views
Details of a good WPA2 pre-shared key (password)?
From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated:
https://security.stackexchange.com/a/56646/37051
However, from other reading, ...
- 340
2
votes
1
answer
6k
views
Will WPA Enterprise give any advantage on home network with one user?
I understand some of the reasons why WPA Enterprise is more secure from this question: Why is WPA Enterprise more secure than WPA2?
However, given a home network with only one single user where that ...
- 340
1
vote
1
answer
2k
views
Save decrypted pcap or decrypt on reading with rdpcap
I created a small program with runs command:
tshark -i2 -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" Passphrase:SSID\"" -w test.pcapng
This creates the file test.pcapng, but it ...
6
votes
2
answers
133
views
Why WPA2 Client Devices Respond to Any Deauths
A great number of attack methods for WPA2 involve getting a handshake capture. To capture one the fastest way involves sending deauthentication packets to the client forcing him to initiate the ...
- 513
2
votes
2
answers
289
views
Wireless network solution? WPA2/MAC Filtering problems
In short we have 7 Mobile Casio Scanners that seem to be incapable of holding their Wi-Fi passwords, they sometimes lose them for no apparent reason.
We of course, cannot give out the wireless ...
- 21
1
vote
2
answers
649
views
Is HTTP secure within a WPA2-PSK connection?
I'm running a small, low power web server chip which creates a Wi-Fi access point using WPA2-PSK AES encryption. This chip is never connected to the public Internet or any other network. A client ...
- 13
0
votes
1
answer
295
views
Can KRACK be used to obtain wifi credentials that could be used to normally connect to an AP? [duplicate]
I have a pretty simple question about KRACK.
From what I have read it would be very common to be able to forge, decrypt, delay and block client packets as well as AP packets using KRACK.
Does this ...
- 1,009
-1
votes
1
answer
409
views
Handshake not capturing on wpa-psk/wpa 2 psk
I'm struggling to get a handshake from my router when using airodump.
airmon-ng
airmon-ng check kill
airodump-ng wlan0mon
airodump-ng -c (channel)--bssid(adress)-w (.cap file locand name) wlan0mon
...
1
vote
2
answers
786
views
KRACK Attack vs sniffing
Trying to learn....
The ultimate difference between the vulnerability outlined in the answer posted here and KRACK attack is that with KRACK attack, the attacker does not need the AP pass phrase?
- 441
1
vote
1
answer
2k
views
wpa2-psk aes hacking with android
I have a digisol HR3400 router, I want to prevent it from being hacked.
Can I use wpa2-psk aes to prevent hacking by Android apps like andro dumper or wpa tester?
- 13
7
votes
3
answers
15k
views
Can someone explain in simple steps how WPA2-Enterprise authentication and encryption happens?
When I try asking this question on other websites I get massive downvotes and am told "We're not doing your homework. Use google." Also I sometimes get banned.
Anyways, I've searched tens of pages of ...
- 145
1
vote
3
answers
897
views
Why can't Wifi be secured assymetrically? [closed]
Why couldn't we switch from AES to something asymmetric? Then a private key doesn't need to be shared with the client; rather just share a public key with them.
- 121
1
vote
1
answer
180
views
Is WPA-PSK of IEEE 802.11 insecure if PSK is exposed?
In WPA 4-Way Handshake, SNonce, ANonce, AP MAC addr and STA MAC addr are exposed to an eavesdropper Eve. But I think it is still safe unless PSK (password) is exposed to Eve.
If PSK is exposed, ...
- 141
3
votes
2
answers
3k
views
Is the Karma attack still relevant today?
I tried replicating the Karma attack and it does not work on my iphone5s and galaxy s6. Even when the phones send out directed probe requests and the Rouge AP responds with the appropriate probe ...
- 439
0
votes
1
answer
490
views
Which key is actually used for encrypting data traffic in WPA after the 4WHS?
Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true?
From what I understand, this can have very ...
- 439
0
votes
1
answer
2k
views
What are the roles of PSK and GTK in a WPA setting?
I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
- 439
6
votes
3
answers
20k
views
How do I bruteforce a WPA2 password given the following conditions?
I'm trying to brute-force my own WiFi, and from my own research, I know that all default passwords for this specific model of router I'm trying to hack follow the following rules:
password length = 8
...
- 89
7
votes
1
answer
6k
views
Attack WPA password with hashcat - Settings and resources for "german" passwords?
I'd like to prove to a friend of mine that his wifi is insecure and learn something about password cracking on the way. The guy I am talking about does not believe in strong passwords but in SSID ...
- 173
2
votes
1
answer
532
views
WPA PSK to WPA EAP PSK roaming
Would clients (iPhone, android, whatever) roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 ...
- 21
1
vote
1
answer
141
views
See communication in WiFi with known password
I know the password to a certain router which uses WPA2-PSK-CCMP + WPS + ESS, is it possible to watch the communication between devices and the router unencrypted assuming I know the password to the ...
- 131
33
votes
3
answers
16k
views
How safe are Wi-Fi Hotspots? Because WPA 2 is compromised, is there any other security protocol for Wi-Fi?
WPA 2 can be cracked using Aircrack-ng in Kali Linux. Is there any other security protocol for Wi-Fi which is not compromised?
- 525
0
votes
2
answers
590
views
What is the chance that my WiFi passphrase has the same WPA2 hash as a PW present in an adversary's char. based brute force password search space?
What is the chance that my WiFi passphrase has the same WPA2 hash as a password present in an adversary's character based brute force password search space, after a 30% is searched.
WiFi PSK WPA2 ...
- 525
2
votes
1
answer
365
views
Why does john force MinLen to 8 for wpapsk?
I'm trying to use john to test wpa security. I want it to generate 10-character passwords, so I've added this to john.conf:
[Incremental:Test]
File = $JOHN/alnum.chr
MinLen = 10
MaxLen = 10
CharCount ...
- 121
3
votes
1
answer
1k
views
Aircrack-ng: Why deauth works
When using aircrack to attack WPA, deauth packets are used to force a host to deauthenticate. But the machine sending these deauth packets is not even connected to the network. How possible is it that ...
- 1,556
42
votes
7
answers
16k
views
Why is HTTP data sent in clear text over password-protected Wifi?
In my home I have a router protected with WPA2-PSK (WPA2 Personal), using the passphrase.
When I try to log in to a page over the Internet (this page does not use HTTPS to log me in), all my data is ...
- 407
8
votes
3
answers
8k
views
Extract WPA PSK from airodump-ng output file
How can I get the PSK hash in plain text from a airodumnp-ng .cap file ?
Example :
Hash :
af8cfcf3c66d6e279d3fcb43e78569e872446e24f5f190350637fa174d9ece63
I understand aircrack-ng -J file....
- 105
6
votes
1
answer
3k
views
Evil twin access point with WPA/WPA2
When I created an evil twin AP with an SSID of someone else's Wi-Fi network e.g. MyWifiNet, I could see two APs on my phone/laptop with the SSID MyWiFiNet, however the legitimate one was secured with ...
- 71
3
votes
2
answers
523
views
Attacking WEP/WPA/WPA2
When attacking WEP/WPA/WPA2, I see people buy a wireless network adapter (e.g. Alfa). Why can't an inbuilt adapter in a laptop work? Or in other words, is there a quick way for me to check if the ...
- 1,556
4
votes
1
answer
1k
views
How are WPA2 passwords encoded?
I'm trying to figure out a good John The Ripper rule for WPA2 that won't waste time testing impossible passwords. Thus the question - are there any limits on what's allowed in a WPA2 password? Can it ...
- 6,534
2
votes
2
answers
3k
views
Is WPA-PSK AES safer than WPA-PSK TKIP-AES?
On this forum thread I see (translated):
On Telecom Router we have those wifi encryption modes
Disabled-OpenNet
- WEP (128 bit) -> WEP (unsafe breakable in some minutes)
- WPA-PSK TKIP 256 bit -...
- 145