Questions tagged [wpa2]
Security protocol (IEEE 802.11i) developed by the Wi-Fi Alliance to protect wireless networks.
28
questions with no upvoted or accepted answers
5
votes
2
answers
2k
views
How is TSC (TKIP sequence counter) calculated, in WPA?
I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images:
...
- 191
3
votes
0
answers
218
views
WPA2 MIC 128bits value VS HMAC SHA1 output 160bits
I understand that under WPA2, if the MIC value is equal to the HMAC SHA1 function, that means the password from dictionary attack works.
However, after deriving the MIC value from Wireshark, which is ...
- 31
2
votes
0
answers
170
views
802.11s with SAE vs WPA-RSN (802.11i) on a MESH network
I'm investigating a protection options for a mesh network (p2p). The amount of nodes is constantly changing and possibly owned by different entities.
We are thinking between 802.11s with SAE (...
- 121
2
votes
2
answers
339
views
WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?
We are using, as default, PEAP and MS-CHAPv2 as inner authentication.
I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
- 21
2
votes
0
answers
196
views
How can a 802.11 client verify the authenticity of an AP it is trying to connect to?
With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
- 583
2
votes
0
answers
353
views
Why WPA2 did not design a PTK based on asymmetric cryptography?
I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi.
PMK is made with crypt_hash(SSID + PSK). OK, seems good.
Then, the client and the Access Point (AP) make the famous 4 way ...
- 1,328
2
votes
0
answers
467
views
Securing wifi hotspots across multiple devices with multiple users
I have a situation where multiple devices will be installed in public places and different maintenance engineers, from potentially different companies, will need to login via their wifi hotspot to set ...
- 21
2
votes
0
answers
275
views
How router/access point generates Group Master Key (GMK)?
How router/access point generates Group Master Key (GMK)? Because GMK is the key that is created in the router and dies in the router, how does router derive it? In this paper is written that in ...
- 125
2
votes
0
answers
438
views
WPA2 EAP-TTLS with PAP: Does the authentication server know the password?
There's a wireless network that I sometimes need to connect to that uses WPA2 with EAP-TTLS and PAP as "inner" protocol.
I've been sent a certificate file (presumably for the TTLS to work) and given ...
- 196
2
votes
0
answers
246
views
WPA2-Enterprise - unable to find a way around Lanner Electronics
I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
- 31
1
vote
0
answers
39
views
Force A Reply WPA/WPA2
I am working on an open source project, and am currently stumped.
Let’s say I have a client connect to a wireless WPA network I am not authenticated to the wireless network I just have a wireless card ...
- 11
1
vote
0
answers
2k
views
How does the WPA2 crack work with Hashcat 22000 format hash lines?
I'm trying to understand the format and functionality of WPA2 hash lines that start with WPA*02* used with -m 22000 on hashcat.
The way I understand it, this format was created as an improvement and ...
- 203
1
vote
0
answers
244
views
What is Received Sequence Counter(RSC) in WPA authentication
In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant.
The only information I found about RSC is that it's ...
- 11
1
vote
0
answers
114
views
Is this the signature of a KRACK attack?
A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4.
Is this the signature of a KRACK attack? And ...
- 121
1
vote
2
answers
264
views
Key reinstallation attack how does it work without a pre-shared key?
The author of the key reinstallation attack released scripts on Github to test AP and clients.
To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
- 11
1
vote
0
answers
146
views
Forward packages to Access Point in KRACK attack
I am investigating the KRACK attack based on the published paper and their youtube video.
I largely understand the attacks proposed in the paper as they are except for the completion of the ...
- 21
1
vote
0
answers
96
views
What happens when an attacker sends fake nonce in TKIP handshake?
The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
- 171
1
vote
0
answers
165
views
How does deauth protection (IEEE_802.11w-2009) work?
I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
- 6,534
1
vote
0
answers
811
views
Difference between WPA, WPA2 and mixed mode on packets level
What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples?
Above question ...
- 11
0
votes
0
answers
29
views
Wpa ptk and gtk in detail
I have been checking Pairwise and Group Transient keys in a network for security. I understand
PTK is derived from = PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address
...
- 207
0
votes
0
answers
89
views
How to secure old routers with WPA2 and with old firmware?
There are many old routers that support WPA2 that hadn't had a firmware update released since around 2010. Is it possible to secure their WPA2 implementation considering the more recent ...
- 2,039
0
votes
0
answers
316
views
How can I add some probable Keywords to hashcat, so I can Brute-Force attack a WPA2 Network faster
I´m trying to brute force attack a WPA2 Network with Hashcat and a wpa2.hccpax file, but when I do it says that it can take 45years to brute force it. So I had the idea that probably the network I´m ...
0
votes
0
answers
412
views
How could a WPA2 WiFi with a 40+ character random password have been penetrated
I can confirm an intrusion from an unknown MAC address (identified as a Realtek device), getting a new, valid IP from the DHCP pool, and using the network for roughly 1 hour.
The network is WPA2 - 1 ...
- 121
0
votes
0
answers
358
views
Why doesn't the fluxion attack steal credentials when authenticating to the network?
I ask this question because i am not happy with the answer here
In a normal attack such as fluxion.
You send DEAUTH packets to the victim wifi.
Clone their access point and host an open wifi.
Let the ...
- 3,794
0
votes
0
answers
1k
views
MIC vs PTK, what's the difference?
What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK
From my research, a PTK is the pairwise ...
- 1
0
votes
1
answer
701
views
Does WPA/WPA2 mixed mode have weak security even if I always connect using WPA2-AES?
My Wi-Fi access point is in "WPA/WPA2 mixed mode", which allows devices to connect to it using either WPA, WPA2-TKIP, or WPA2-AES. My Apple® smartphones and tablet computers are warning that ...
- 793
-1
votes
2
answers
1k
views
How do I use driftnet without hacking?
I want to see which images are being sent through the air using my wifi and foreign wifi. How do I do that without cracking WPA(2) but just filtering out the unencrypted packages using windows or kali ...
- 171
-1
votes
2
answers
5k
views
How do I brute-force a WPA-2 wifi with Aircrack-ng in Kali Linux?
What I basically want to do is, perform a test on my Wi-Fi and brute force it instead of a dictionary attack. I googled, and all of them showed me examples of dictionary attack and no bruteforcing.
...
- 129