Questions tagged [wpa2]
Security protocol (IEEE 802.11i) developed by the Wi-Fi Alliance to protect wireless networks.
327
questions
2
votes
2
answers
339
views
WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?
We are using, as default, PEAP and MS-CHAPv2 as inner authentication.
I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
CommunityBot
- 1
0
votes
0
answers
29
views
Wpa ptk and gtk in detail
I have been checking Pairwise and Group Transient keys in a network for security. I understand
PTK is derived from = PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address
...
- 207
12
votes
2
answers
5k
views
Does WPA2 Enterprise mitigate evil twin attacks?
One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The ...
- 2,613
16
votes
2
answers
5k
views
How does WPA2-PSK prevent evil twin password phishing?
Let's say we have a WPA2-PSK secured AP and there are several clients like smartphones and notebooks that automatically connect to it.
Now if someone was to create another AP that looked completely ...
- 2,613
3
votes
1
answer
167
views
Is WPA2-Enterprise a more secure protocol designed to protect WiFi communication compared to WPA3-Personal?
Perhaps an unconventional comparison. If we ignore device compatibility for a moment and compare security features of WPA3(-three)-Personal with WPA2(-two)-Enterprise. Which is most secure and why is ...
- 6,661
0
votes
1
answer
42
views
What is a logical threshold in terms of users or devices to migrate from WPA personal to WPA enterprise?
I have a question in particular about WPA's Enterprise versus Personal without discussing the specifics of WPA2/WPA3.
I've encountered quite a few situations where the Personal version of WPA2/WPA3 ...
- 199k
1
vote
2
answers
264
views
Key reinstallation attack how does it work without a pre-shared key?
The author of the key reinstallation attack released scripts on Github to test AP and clients.
To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
CommunityBot
- 1
1
vote
1
answer
134
views
Using public WPA2 Enterprise credentials for public Wi-Fi
In South Korea, I've seen a couple of public Wi-Fi networks advertise a "secure" option. Stickers on public buses in Seoul and the captive portal login page for unencrypted Wi-Fi instruct ...
- 1,382
5
votes
2
answers
2k
views
How is TSC (TKIP sequence counter) calculated, in WPA?
I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images:
...
CommunityBot
- 1
0
votes
1
answer
98
views
Is it possible to fully protect a home Wi-Fi network from remote attacks?
I've read that some ways to secure a home Wi-Fi network include encrypting the network using WPA2 Personal, and changing the default administrative username, password, and network name. But I'm not ...
- 199k
2
votes
1
answer
2k
views
Speed up cracking a wpa2.hccapx file in hashcat
I'm trying to do a brute force with Hashcat on windows with a GPU cracking a wpa2.hccapx handshake. Based on my research I know the password is 10 characters, a mix of random lowercase + numbers only
...
CommunityBot
- 1
0
votes
0
answers
89
views
How to secure old routers with WPA2 and with old firmware?
There are many old routers that support WPA2 that hadn't had a firmware update released since around 2010. Is it possible to secure their WPA2 implementation considering the more recent ...
- 128k
0
votes
1
answer
703
views
Does WPA/WPA2 mixed mode have weak security even if I always connect using WPA2-AES?
My Wi-Fi access point is in "WPA/WPA2 mixed mode", which allows devices to connect to it using either WPA, WPA2-TKIP, or WPA2-AES. My Apple® smartphones and tablet computers are warning that ...
- 128k
0
votes
0
answers
16
views
Does the client know about the salt used for checking his password on a WPA2 wifi network? [duplicate]
I don't understand how the client is able to send his password secretly without knowing the salt.
- 101
11
votes
9
answers
94k
views
Wifi penetration testing: Why aireplay-ng de-authentication does not work?
I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine.
...
- 137
11
votes
5
answers
1k
views
My ISP shows my WiFi password on their public site in plain text. Should I be worried?
I recently noticed that when logged into my ISPs (Spectrum) public, external site that can be accessed outside my network, I can see my home network's WPA2 password in plain text.
This clearly means ...
- 1,382
4
votes
1
answer
884
views
Is brute force for SSH similar to cracking WPA2 handshake?
I heard recently that WPA2 passwords can be brute forced if somebody captures handshake (which is not very difficult). Can somebody tell if a similar method exists for cracking SSH traffic? I mean ...
- 66.5k
0
votes
1
answer
370
views
How is WPA-PSK authentication done?
When I try connecting to wireless networks (with no RADIUS server), I enter the password and it goes through an authentication process. After the station successfully connects to the access point, a 4-...
CommunityBot
- 1
0
votes
2
answers
332
views
My Linux Mint just accessed a wifi network WPA2 without knowing the password [closed]
I brought my personal notebook to work. Asked the IT technician to access the WiFi on it (it's a federal institution of health research, lots of biological risks involved). Then he noticed that the ...
- 128k
8
votes
1
answer
13k
views
Wireshark can't decrypt WPA2 LAN traffic
I want to decrypt my own network traffic.
I have Linux Mint on Samsung Laptop with a AR542x Wireless Network Adapter.
Open Wireshark, start capture in promiscuous mode & monitor mode and I ...
- 1
0
votes
1
answer
1k
views
Airodump-ng shows AP as OPN and WPA2 at the same time. What does it mean?
The result of airodump-ng lists some AP's as both OPN and WPA2. How does the authentication work in that case?
12:34:56:78:AB:CD, 2011-09-09 15:29:47, 2022-10-21 16:09:05, 1, WPA2 OPN, CCMP, MGT, -75,...
CommunityBot
- 1
7
votes
1
answer
2k
views
How to get hold of and use WPA session keys?
I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I ...
- 5,487
9
votes
1
answer
2k
views
Mitigating the new attack on WPA2 involving PMKID
A new attack was discovered which allows cracking a WPA2 passphrase without needing to capture the 4-way handshake. While this doesn't weaken the password itself, it does mean that an attacker can ...
- 66.5k
1
vote
0
answers
39
views
Force A Reply WPA/WPA2
I am working on an open source project, and am currently stumped.
Let’s say I have a client connect to a wireless WPA network I am not authenticated to the wireless network I just have a wireless card ...
- 12.7k
3
votes
1
answer
8k
views
How to use multiple charsets in hashcat
I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
- 1
1
vote
2
answers
257
views
WPA2 Security for Security System/IoT
How safe are WiFi modules/devices for use in security systems or even IoT?
How effective are dictionary and brute-force attacks in cracking WPA2? Online tutorials I've seen such as this claim to be ...
- 2,265
1
vote
1
answer
2k
views
WPA/PSK Dictionaries
I have been reading some articles on WPA/PSK encryption and one said that the hash is calculated like this:
Key = PBKDF2(passphrase, ssid, 4096, 256)
Where PBKDF2 is a standardized method to derive ...
- 495
0
votes
1
answer
2k
views
Can brute force or dictionary attacks be detected when using the WiFi protocol?
Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
- 2,265
26
votes
1
answer
8k
views
What is stronger - WPA2 Enterprise with 2048 bit key, or Personal with 63 character passphrase?
Which of the two following has a stronger cryptographic strength in withstanding brute-force attacks?
WPA/WPA2 Enterprise using 2048-bit RSA public-key
WPA/WPA2 Personal using 63-character ...
- 2,265
3
votes
2
answers
2k
views
EAPOL messages in different WPA handshakes
I have a pcap file with two captured packets only.
Time Protocol Info
0.000000 EAPOL Key (Message 3 of 4)
2934.200222 EAPOL Key (Message 2 of 4)
I already know, ...
- 128k
9
votes
2
answers
10k
views
Why does a deauth attack work on WPA2 despite encryption?
Given that WiFi packets should be encrypted if WPA2 is used, why is it that a deauth attack can be successful? Shouldn't the machine know that the message is illegitimate due to the fact that it would ...
- 12.7k
0
votes
1
answer
278
views
WPA2 Enterprise Authentication Certificate Security
While reading up about WPA2-Enterprise, it states that it is more preferred over WPA2-Personal as it allows authentication via digital certificates which prevents over-the-air attacks.
However, I am ...
0
votes
0
answers
316
views
How can I add some probable Keywords to hashcat, so I can Brute-Force attack a WPA2 Network faster
I´m trying to brute force attack a WPA2 Network with Hashcat and a wpa2.hccpax file, but when I do it says that it can take 45years to brute force it. So I had the idea that probably the network I´m ...
CommunityBot
- 1
1
vote
1
answer
2k
views
How does the EAP-TLS handshake work, exactly?
I'm trying to understand EAP-TLS authentication, but I'm struggling to understand a few bits:
Before the supplicant sends any certificates to the server, it usually verifies the server's identity.
...
CommunityBot
- 1
3
votes
1
answer
323
views
Why does a 20-character key make WPA Personal more secure?
Can someone tell me why a 20-character key makes WPA Personal more secure? That really confuses me.
CommunityBot
- 1
4
votes
1
answer
4k
views
WiFi Direct/WPS key question
So far, I haven't seen any PoC or real-world attacks against WiFi Direct, but I see the potential because it relies on WiFi Protected Setup (WPS) for establishing the connection.
Tools like Reaver ...
- 103
1
vote
0
answers
2k
views
How does the WPA2 crack work with Hashcat 22000 format hash lines?
I'm trying to understand the format and functionality of WPA2 hash lines that start with WPA*02* used with -m 22000 on hashcat.
The way I understand it, this format was created as an improvement and ...
- 203
3
votes
3
answers
32k
views
How to setup GPU for Cracking WPA/WPA2?
I have a Dell N5110 15R Laptop that I'm planning to use for GPU based cracking of WPA/WPA2 passwords. The thing is, I'm not a really big fan of password dictionaries and rainbow tables, I'd rather ...
1
vote
1
answer
158
views
Under what circumstances can WPA be cracked?
can someone please tell me under what circumstances can WPA be cracked? i'll appreciate it.
- 655
1
vote
1
answer
3k
views
How is the MIC (message integrity code) generated in WPA2?
We know that in WPA2's four-way handshake, a MIC is generated in order verify the supplicant (client). But how it is generated? Is something hashed to get the MIC? The PTK (pairwise transient key) ...
- 46.4k
1
vote
0
answers
244
views
What is Received Sequence Counter(RSC) in WPA authentication
In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant.
The only information I found about RSC is that it's ...
- 11
8
votes
3
answers
8k
views
Extract WPA PSK from airodump-ng output file
How can I get the PSK hash in plain text from a airodumnp-ng .cap file ?
Example :
Hash :
af8cfcf3c66d6e279d3fcb43e78569e872446e24f5f190350637fa174d9ece63
I understand aircrack-ng -J file....
1
vote
2
answers
502
views
Hacking WPA/WPA2 passwords
Is there another method apart from using a wordlist to crack WPA/WPA2 passwords? because it's not going to work for all cases. Even using the biggest wordlist ever, there are cases where there won't ...
- 129
8
votes
1
answer
36k
views
Rainbow tables/hash tables versus WPA/WPA2
In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks?
Is there an advantage of one over the other?
...
- 103
0
votes
2
answers
5k
views
Why do WEP, WPA, WPA2 need TKIP, AES, CCMP?
Okay so im looking into understanding more about Wireless security. One thing i have not be able to understand is what does WEP, WPA and WPA2 do without the help of TKIP, CCMP, and AES, and what do ...
- 9,294
2
votes
0
answers
170
views
802.11s with SAE vs WPA-RSN (802.11i) on a MESH network
I'm investigating a protection options for a mesh network (p2p). The amount of nodes is constantly changing and possibly owned by different entities.
We are thinking between 802.11s with SAE (...
- 61.5k
4
votes
2
answers
9k
views
Recommended length for WPA-2 password in 2020
I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
- 61.5k
2
votes
1
answer
14k
views
How to brute-force WPA-2 password of specific set of characters using oclHashcat?
I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}.
To do this I have already captured the handshake in a .cap file and converted it ...
CommunityBot
- 1
1
vote
3
answers
447
views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
- 1,144
3
votes
2
answers
3k
views
WPA password cracking setup
let's say i am trying to crack a WPA password and i need to create a virtual machine setup for it. What would the setup be if i limit myself with a specific number of hours ( let's say 24 hours and ...
- 9,443