Questions tagged [wpa2-psk]

The tag has no usage guidance.

0
votes
0answers
51 views

MIC vs PTK, what's the difference?

What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK From my research, a PTK is the pairwise ...
4
votes
1answer
206 views

Why are WPA2 passwords longer than 16 bytes more secure than 16 byte passwords?

In this good Information Security StackExchange question, the answers reveal that a long WPA2-PSK password does not degrade performance of the network. The reasoning is that the password itself is ...
1
vote
1answer
104 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
10
votes
8answers
45k views

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine. ...
1
vote
1answer
59 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
7
votes
2answers
2k views

Extract WPA PSK from airodump-ng output file

How can I get the PSK hash in plain text from a airodumnp-ng .cap file ? Example : Hash : af8cfcf3c66d6e279d3fcb43e78569e872446e24f5f190350637fa174d9ece63 I understand aircrack-ng -J file....
2
votes
2answers
116 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
0
votes
1answer
116 views

How to protect your wifi traffic from sniffing if untrusted people know the password?

WPA2 PSK is used to encrypt packets to and from a router. All the members on the network have the wifi password, so theoritically if one of them is untrustable they could be able to capture and ...
2
votes
0answers
46 views

WPA3-Personal and traffic privacy

It is well known that (malicious) endpoints in a Wi-Fi network password-protected by WPA2-Personal can sniff all clear traffic to/from any other endpoint, if they can also capture the 4-way handshake ...
2
votes
1answer
2k views

Sniffing WPA2 PSK traffic with the key but without association

Assume a situation where a wireless access point is using WPA2-PSK, and it is configured to allow only a single client association at one time. Client A connects to the access point with PSK and ...
21
votes
2answers
54k views

What are the difference between WPA2-PSK and WPA2-EAP-PSK?

What are the differences between WPA2-PSK and WPA2 EAP-PSK? What are the pros and cons of using one configuration or the other?
2
votes
1answer
193 views

WPA PSK to WPA EAP PSK roaming

Would clients (iPhone, android, whatever) roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 ...
2
votes
2answers
1k views

WPA with PSK and with Radius Server

In case of WPA2 using the Radius server, every client gets its own username and password. But what is the case in the WPA2 using a PSK without the authenticating server. In this case also we have a 4 ...
1
vote
1answer
259 views

Role of derived keys in EAP-PSK in WPA-2

I'm currently trying to understand WPA-2 and I've discovered that it's built on the EAP-PSK protocol which sets up some keys derived from the SSID name and a password. I assume that the keys derived ...
1
vote
1answer
1k views

wpa2-psk aes hacking with android

I have a digisol HR3400 router, I want to prevent it from being hacked. Can I use wpa2-psk aes to prevent hacking by Android apps like andro dumper or wpa tester?
1
vote
2answers
847 views

Details of a good WPA2 pre-shared key (password)?

From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated: https://security.stackexchange.com/a/56646/37051 However, from other reading, ...
2
votes
1answer
834 views

Will WPA Enterprise give any advantage on home network with one user?

I understand some of the reasons why WPA Enterprise is more secure from this question: Why is WPA Enterprise more secure than WPA2? However, given a home network with only one single user where that ...
1
vote
1answer
465 views

Save decrypted pcap or decrypt on reading with rdpcap

I created a small program with runs command: tshark -i2 -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" Passphrase:SSID\"" -w test.pcapng This creates the file test.pcapng, but it ...
7
votes
1answer
23k views

Get WPA-Passphrase from HEX key and SSID?

Using this as an example for WPA key calculation (link): Network SSID: linksys54gh WPA passphrase: radiustest Hexadecimal key: 9e9988bde2cba74395c0289ffda07bc41ffa889a3309237a2240c934bcdc7ddb I ...
1
vote
2answers
644 views

KRACK Attack vs sniffing

Trying to learn.... The ultimate difference between the vulnerability outlined in the answer posted here and KRACK attack is that with KRACK attack, the attacker does not need the AP pass phrase?
4
votes
1answer
8k views

How exactly does WPA2-PSK work?

I'm trying to understand how PSK works. Here's what I think I know so far: PSK is just the password you enter to connect to the router in your home, the PSK is stored on the router. You combine the ...
6
votes
2answers
72 views

Why WPA2 Client Devices Respond to Any Deauths

A great number of attack methods for WPA2 involve getting a handshake capture. To capture one the fastest way involves sending deauthentication packets to the client forcing him to initiate the ...
6
votes
3answers
6k views

Can someone explain in simple steps how WPA2-Enterprise authentication and encryption happens?

When I try asking this question on other websites I get massive downvotes and am told "We're not doing your homework. Use google." Also I sometimes get banned. Anyways, I've searched tens of pages of ...
2
votes
2answers
111 views

Wireless network solution? WPA2/MAC Filtering problems

In short we have 7 Mobile Casio Scanners that seem to be incapable of holding their Wi-Fi passwords, they sometimes lose them for no apparent reason. We of course, cannot give out the wireless ...
6
votes
3answers
5k views

How do I bruteforce a WPA2 password given the following conditions?

I'm trying to brute-force my own WiFi, and from my own research, I know that all default passwords for this specific model of router I'm trying to hack follow the following rules: password length = 8 ...
1
vote
2answers
157 views

Is HTTP secure within a WPA2-PSK connection?

I'm running a small, low power web server chip which creates a Wi-Fi access point using WPA2-PSK AES encryption. This chip is never connected to the public Internet or any other network. A client ...
2
votes
1answer
6k views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
0
votes
1answer
215 views

Can KRACK be used to obtain wifi credentials that could be used to normally connect to an AP? [duplicate]

I have a pretty simple question about KRACK. From what I have read it would be very common to be able to forge, decrypt, delay and block client packets as well as AP packets using KRACK. Does this ...
-1
votes
1answer
199 views

Handshake not capturing on wpa-psk/wpa 2 psk

I'm struggling to get a handshake from my router when using airodump. airmon-ng airmon-ng check kill airodump-ng wlan0mon airodump-ng -c (channel)--bssid(adress)-w (.cap file locand name) wlan0mon ...
6
votes
1answer
2k views

Evil twin access point with WPA/WPA2

When I created an evil twin AP with an SSID of someone else's Wi-Fi network e.g. MyWifiNet, I could see two APs on my phone/laptop with the SSID MyWiFiNet, however the legitimate one was secured with ...
5
votes
1answer
3k views

Why crack WEP or WPA/WPA2 PSK when it can be sniffed through monitor mode capture?

I am pretty new to the domain of wireless security and am trying to understand the various techniques used for compromising wireless networks. There are a few things that I am not able to correlate ...
33
votes
3answers
16k views

How safe are Wi-Fi Hotspots? Because WPA 2 is compromised, is there any other security protocol for Wi-Fi?

WPA 2 can be cracked using Aircrack-ng in Kali Linux. Is there any other security protocol for Wi-Fi which is not compromised?
8
votes
2answers
5k views

If WPA2-PSK is insecure, what other options do home users have?

from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
5
votes
1answer
3k views

Attack WPA password with hashcat - Settings and resources for “german” passwords?

I'd like to prove to a friend of mine that his wifi is insecure and learn something about password cracking on the way. The guy I am talking about does not believe in strong passwords but in SSID ...
3
votes
1answer
301 views

Customize John The Ripper BF technique

Is it possible for me to customize the way John the Ripper brute forces a .cap file? I, knowing my WiFi password, want to crack it fast as possible (no hit with word list). Can I customize John to ...
3
votes
2answers
2k views

Is the Karma attack still relevant today?

I tried replicating the Karma attack and it does not work on my iphone5s and galaxy s6. Even when the phones send out directed probe requests and the Rouge AP responds with the appropriate probe ...
1
vote
3answers
232 views

Why can't Wifi be secured assymetrically? [closed]

Why couldn't we switch from AES to something asymmetric? Then a private key doesn't need to be shared with the client; rather just share a public key with them.
1
vote
1answer
79 views

Is WPA-PSK of IEEE 802.11 insecure if PSK is exposed?

In WPA 4-Way Handshake, SNonce, ANonce, AP MAC addr and STA MAC addr are exposed to an eavesdropper Eve. But I think it is still safe unless PSK (password) is exposed to Eve. If PSK is exposed, ...
1
vote
3answers
2k views

airodump-ng never see WPA handshake

I am testing cracking my personal WPA2-PSK password following these directions. I completed step 4. However, I do not see "WPA handshake" as seen in step 5. All I see is "fixed channel mon0: -1" ...
0
votes
1answer
133 views

Which key is actually used for encrypting data traffic in WPA after the 4WHS?

Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true? From what I understand, this can have very ...
0
votes
1answer
958 views

What are the roles of PSK and GTK in a WPA setting?

I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
48
votes
2answers
2k views

WPA2 ephemeral key derivation

I'm trying to learn how ephemeral keys in WPA2 4-way handshake are derived. Starting from 4 EAPOL packets sniffing, I successfully derived PMK and PTK reading ANonce, SNonce, and knowing ASCII-PSK ...
2
votes
2answers
840 views

Enabled WPS methods

I would like to know if there are tools available to identify what WPS method is actually enabled on an AP? I would like to know also if there is a way by looking at packets to know which WPS method ...
1
vote
1answer
78 views

See communication in WiFi with known password

I know the password to a certain router which uses WPA2-PSK-CCMP + WPS + ESS, is it possible to watch the communication between devices and the router unencrypted assuming I know the password to the ...
0
votes
2answers
342 views

What is the chance that my WiFi passphrase has the same WPA2 hash as a PW present in an adversary's char. based brute force password search space?

What is the chance that my WiFi passphrase has the same WPA2 hash as a password present in an adversary's character based brute force password search space, after a 30% is searched. WiFi PSK WPA2 ...
2
votes
1answer
183 views

Why does john force MinLen to 8 for wpapsk?

I'm trying to use john to test wpa security. I want it to generate 10-character passwords, so I've added this to john.conf: [Incremental:Test] File = $JOHN/alnum.chr MinLen = 10 MaxLen = 10 CharCount ...
3
votes
1answer
567 views

Aircrack-ng: Why deauth works

When using aircrack to attack WPA, deauth packets are used to force a host to deauthenticate. But the machine sending these deauth packets is not even connected to the network. How possible is it that ...
40
votes
7answers
13k views

Why is HTTP data sent in clear text over password-protected Wifi?

In my home I have a router protected with WPA2-PSK (WPA2 Personal), using the passphrase. When I try to log in to a page over the Internet (this page does not use HTTPS to log me in), all my data is ...
3
votes
2answers
367 views

Attacking WEP/WPA/WPA2

When attacking WEP/WPA/WPA2, I see people buy a wireless network adapter (e.g. Alfa). Why can't an inbuilt adapter in a laptop work? Or in other words, is there a quick way for me to check if the ...
3
votes
1answer
538 views

How are WPA2 passwords encoded?

I'm trying to figure out a good John The Ripper rule for WPA2 that won't waste time testing impossible passwords. Thus the question - are there any limits on what's allowed in a WPA2 password? Can it ...