Skip to main content

Questions tagged [wpa2]

Security protocol (IEEE 802.11i) developed by the Wi-Fi Alliance to protect wireless networks.

31 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
2 answers
2k views

How is TSC (TKIP sequence counter) calculated, in WPA?

I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images: ...
Teo's user avatar
  • 191
3 votes
0 answers
246 views

WPA2 MIC 128bits value VS HMAC SHA1 output 160bits

I understand that under WPA2, if the MIC value is equal to the HMAC SHA1 function, that means the password from dictionary attack works. However, after deriving the MIC value from Wireshark, which is ...
twistofytd's user avatar
2 votes
0 answers
225 views

802.11s with SAE vs WPA-RSN (802.11i) on a MESH network

I'm investigating a protection options for a mesh network (p2p). The amount of nodes is constantly changing and possibly owned by different entities. We are thinking between 802.11s with SAE (...
quinz's user avatar
  • 121
2 votes
2 answers
401 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
Elegancia's user avatar
  • 131
2 votes
0 answers
226 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
Konrad Gajewski's user avatar
2 votes
0 answers
390 views

Why WPA2 did not design a PTK based on asymmetric cryptography?

I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi. PMK is made with crypt_hash(SSID + PSK). OK, seems good. Then, the client and the Access Point (AP) make the famous 4 way ...
Sibwara's user avatar
  • 1,338
2 votes
0 answers
489 views

Securing wifi hotspots across multiple devices with multiple users

I have a situation where multiple devices will be installed in public places and different maintenance engineers, from potentially different companies, will need to login via their wifi hotspot to set ...
user1759872's user avatar
2 votes
0 answers
297 views

How router/access point generates Group Master Key (GMK)?

How router/access point generates Group Master Key (GMK)? Because GMK is the key that is created in the router and dies in the router, how does router derive it? In this paper is written that in ...
Bartosz Królak's user avatar
2 votes
0 answers
463 views

WPA2 EAP-TTLS with PAP: Does the authentication server know the password?

There's a wireless network that I sometimes need to connect to that uses WPA2 with EAP-TTLS and PAP as "inner" protocol. I've been sent a certificate file (presumably for the TTLS to work) and given ...
Daniel Jour's user avatar
2 votes
0 answers
264 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
user3801447's user avatar
1 vote
1 answer
27 views

In WPA handshake brute force attack, how can attacker find PMK if MIC is performed using only HALF of PTK?

Brute force attack against WPA is the most common attack against WPA/WPA2 networks. Attacker captures the 4-way handshake that allows the authentication key to be cracked offline. During the 4-way ...
allexj's user avatar
  • 65
1 vote
0 answers
48 views

Chop Chop attack decrypting ARP results in multicast traffic takeover only

I read about chop chop attack and how it is used to decrypt packets on a WPA TKIP network, by chopping off byte by byte and bruteforcing the byte to trigger MIC failure. In case of MIC failure, would ...
umarkaa's user avatar
  • 11
1 vote
0 answers
156 views

aireplay-ng --deauth never finds BSSID available

I've been trying to crack wifi wpa2 handshake using airodump-ng and aireplay-ng. I'm using alfa awus-036acs adapter. sudo airodump-ng wlan0 sudo airodump-ng --bssid MAC ADDR of AP --channel 1 -w ...
Michał Matusik's user avatar
1 vote
0 answers
73 views

Force A Reply WPA/WPA2

I am working on an open source project, and am currently stumped. Let’s say I have a client connect to a wireless WPA network I am not authenticated to the wireless network I just have a wireless card ...
sonicCrypt0r's user avatar
1 vote
0 answers
2k views

How does the WPA2 crack work with Hashcat 22000 format hash lines?

I'm trying to understand the format and functionality of WPA2 hash lines that start with WPA*02* used with -m 22000 on hashcat. The way I understand it, this format was created as an improvement and ...
ieatpizza's user avatar
  • 203
1 vote
0 answers
313 views

What is Received Sequence Counter(RSC) in WPA authentication

In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant. The only information I found about RSC is that it's ...
sroy's user avatar
  • 11
1 vote
0 answers
138 views

Is this the signature of a KRACK attack?

A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4. Is this the signature of a KRACK attack? And ...
Dev Kanchen's user avatar
1 vote
2 answers
295 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
Elegancia's user avatar
  • 131
1 vote
0 answers
167 views

Forward packages to Access Point in KRACK attack

I am investigating the KRACK attack based on the published paper and their youtube video. I largely understand the attacks proposed in the paper as they are except for the completion of the ...
Clanow's user avatar
  • 21
1 vote
0 answers
121 views

What happens when an attacker sends fake nonce in TKIP handshake?

The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
tpm900's user avatar
  • 171
1 vote
0 answers
184 views

How does deauth protection (IEEE_802.11w-2009) work?

I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
d33tah's user avatar
  • 6,564
1 vote
0 answers
924 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
Tenso's user avatar
  • 11
0 votes
0 answers
112 views

Wpa ptk and gtk in detail

I have been checking Pairwise and Group Transient keys in a network for security. I understand PTK is derived from = PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address ...
C.Unbay's user avatar
  • 207
0 votes
0 answers
152 views

How to secure old routers with WPA2 and with old firmware?

There are many old routers that support WPA2 that hadn't had a firmware update released since around 2010. Is it possible to secure their WPA2 implementation considering the more recent ...
sharp12345's user avatar
  • 2,059
0 votes
0 answers
400 views

How can I add some probable Keywords to hashcat, so I can Brute-Force attack a WPA2 Network faster

I´m trying to brute force attack a WPA2 Network with Hashcat and a wpa2.hccpax file, but when I do it says that it can take 45years to brute force it. So I had the idea that probably the network I´m ...
Super_X-dev's user avatar
0 votes
0 answers
480 views

How could a WPA2 WiFi with a 40+ character random password have been penetrated

I can confirm an intrusion from an unknown MAC address (identified as a Realtek device), getting a new, valid IP from the DHCP pool, and using the network for roughly 1 hour. The network is WPA2 - 1 ...
Dev Kanchen's user avatar
0 votes
0 answers
405 views

Why doesn't the fluxion attack steal credentials when authenticating to the network?

I ask this question because i am not happy with the answer here In a normal attack such as fluxion. You send DEAUTH packets to the victim wifi. Clone their access point and host an open wifi. Let the ...
yeah_well's user avatar
  • 3,794
0 votes
0 answers
1k views

MIC vs PTK, what's the difference?

What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK From my research, a PTK is the pairwise ...
Adam's user avatar
  • 1
0 votes
1 answer
2k views

Does WPA/WPA2 mixed mode have weak security even if I always connect using WPA2-AES?

My Wi-Fi access point is in "WPA/WPA2 mixed mode", which allows devices to connect to it using either WPA, WPA2-TKIP, or WPA2-AES. My Apple® smartphones and tablet computers are warning that ...
Flux's user avatar
  • 923
-1 votes
2 answers
1k views

How do I use driftnet without hacking?

I want to see which images are being sent through the air using my wifi and foreign wifi. How do I do that without cracking WPA(2) but just filtering out the unencrypted packages using windows or kali ...
Vitalis Hommel's user avatar
-1 votes
2 answers
6k views

How do I brute-force a WPA-2 wifi with Aircrack-ng in Kali Linux?

What I basically want to do is, perform a test on my Wi-Fi and brute force it instead of a dictionary attack. I googled, and all of them showed me examples of dictionary attack and no bruteforcing. ...
twodee's user avatar
  • 129