Questions tagged [wpa2]
Security protocol (IEEE 802.11i) developed by the Wi-Fi Alliance to protect wireless networks.
327
questions
0
votes
1
answer
1k
views
How to Generate Custom Dictionary For this Password Structure [closed]
I am trying to carry out a dictionary attack for a password that is of this structure:
15 characters
Lowercase letters and 0-9
First a five letter word then 4 numbers, then 6 letter word
Examples of ...
- 513
0
votes
1
answer
901
views
Possibility Of Cracking WPA Password with Additional Information
If one knows that a certain WPA2 CCMP encrypted network uses a password that is 16 characters and only numbers and uppercase letters (ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890) and has a handshake from ...
- 513
2
votes
0
answers
274
views
How router/access point generates Group Master Key (GMK)?
How router/access point generates Group Master Key (GMK)? Because GMK is the key that is created in the router and dies in the router, how does router derive it? In this paper is written that in ...
- 125
2
votes
1
answer
1k
views
Few questions about group keys family in WPA/WPA2
In my previous question I learnt something about Group Temporal Key (GTK), but after searching the internet I have another questions:
1. How is Group Master Key (GMK) derived? What is GMK derived ...
- 125
4
votes
1
answer
7k
views
Few questions about Group Temporal Key (GTK) in WPA/WPA2
I have a few question about group key in WPA family:
1. How many bits GTK have? How much characters this key have?
2. From which characters GTK can be generated? From 0-9, a-z etc.?
3. Is GTK the ...
- 125
1
vote
0
answers
59
views
Is it possible to crack WPA2 faster than brute-force? If yes, how? [duplicate]
Does WPA2 have any weaknesses, flaws or gaps that would make a hack faster than brute-force possible?
Maybe I can hijack authorized user's session or trick AP itp.
- 125
6
votes
1
answer
3k
views
What is the most used WiFi encryption? [WEP/WPA/WPA2] [closed]
I am doing some research on WiFi for my school and one question I want to answer is what encryption is the most used. One day it was of course WEP and now it is WPA2 I assume, but it would be great if ...
- 63
2
votes
2
answers
465
views
Can a hotspot in Ubuntu validate wrong passwords also?
I want to host a hotspot in Ubuntu. The hotspot should authenticate every client, whether he enters right password or wrong password. Actually, I want to validate four way handshake even if the ...
- 21
2
votes
0
answers
438
views
WPA2 EAP-TTLS with PAP: Does the authentication server know the password?
There's a wireless network that I sometimes need to connect to that uses WPA2 with EAP-TTLS and PAP as "inner" protocol.
I've been sent a certificate file (presumably for the TTLS to work) and given ...
- 196
0
votes
1
answer
259
views
Where can the Group Transient Key be found by a client after the WPA2 4-Way Handshake?
I am undertaking a project that looks into the ‘Hole 196’ exploit found in WPA2. I am attempting to uncover the current Group Transient Key that my AP is using in an attempt to use it myself to ...
- 133
33
votes
3
answers
16k
views
How safe are Wi-Fi Hotspots? Because WPA 2 is compromised, is there any other security protocol for Wi-Fi?
WPA 2 can be cracked using Aircrack-ng in Kali Linux. Is there any other security protocol for Wi-Fi which is not compromised?
- 525
1
vote
0
answers
96
views
What happens when an attacker sends fake nonce in TKIP handshake?
The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a ...
- 171
1
vote
0
answers
181
views
How many packets required to deauth WPA? [duplicate]
When using aircrak-ng to attack WPA; Why do I need to send many de-authenticate packets to force the host to deauthenticate? Why is one packet not enough to cause deauthentication?
- 1,566
0
votes
1
answer
704
views
Attacking WPA/WPA2 ; Clarification on deauthentication packets
In the attack on WPA/WPA2, one way to force a handshake is by sending deauth packets to force the client to deauntheticate. During reauthentication attempts, the handshake can the be captured. Here is ...
- 1,566
8
votes
3
answers
8k
views
Extract WPA PSK from airodump-ng output file
How can I get the PSK hash in plain text from a airodumnp-ng .cap file ?
Example :
Hash :
af8cfcf3c66d6e279d3fcb43e78569e872446e24f5f190350637fa174d9ece63
I understand aircrack-ng -J file....
- 105
6
votes
1
answer
3k
views
Evil twin access point with WPA/WPA2
When I created an evil twin AP with an SSID of someone else's Wi-Fi network e.g. MyWifiNet, I could see two APs on my phone/laptop with the SSID MyWiFiNet, however the legitimate one was secured with ...
- 71
-1
votes
2
answers
5k
views
How do I brute-force a WPA-2 wifi with Aircrack-ng in Kali Linux?
What I basically want to do is, perform a test on my Wi-Fi and brute force it instead of a dictionary attack. I googled, and all of them showed me examples of dictionary attack and no bruteforcing.
...
- 129
1
vote
1
answer
6k
views
How does the HMACSHA1 algorithm really work?
I am preparing for a presentation and I need to understand how HMACSHA1 works. I understand what a salt is and I understand that it does a number of cycles but how does it really work?
When is the ...
- 105
5
votes
1
answer
2k
views
Unable to obtain TCP/HTTP traffic from WPA2 packets even with full handshake and decryption
The Problem
On my WPA2 network, I have been successfully able to get intercept a full four-message EAPOL handshake from a particular computer on my network. It is my understanding that with this ...
- 235
2
votes
1
answer
3k
views
Evil AP with known WPA2 password
So I have been playing around with the aircrack-ng suite and beef a mitmf.
Until now I have been able to host an Evil Twin with DHCP server and providing internet access to connected clients while ...
- 143
2
votes
1
answer
2k
views
Packet Injection during attacks on WPA/WPA2/WEP -- How it works
Most Wi-Fi attacks rely on some kind of packet injection. This could be in the form of injecting deauth packets, arp packets, etc.
I have a question about these fake packets -- Are they constructed ...
- 1,566
2
votes
1
answer
4k
views
WPA/WPA2 Handshake -- A question on the computation of the MIC
During the WPA/WPA2 4-way handshake, the first two steps are as follows. (1) The AP sends an ANonce to the client, (2) The client computes its own Nonce (SNonce), computes the Preshared Transient Key (...
- 1,566
0
votes
1
answer
985
views
Attacking WEP -- Question on Packet Injection
When attacking WEP, one must use a wireless card which supports packet injection. I have two questions about this.
(1) As long as we have a busy network, why would we need packet injection? I thought ...
- 1,566
23
votes
2
answers
5k
views
How is attacking WPA different from attacking WPA2?
What’s the difference between the process of attacking WPA and the process of attacking WPA2?
I know that WPA2 is much more secure than WPA. However, it seems the case that both of them are attacked ...
- 1,566
2
votes
3
answers
1k
views
Why don't we need a WPA handshake on a ARP spoofing MiTM attack?
On wireless network running under WPA2 protocol, the communication between a client and the AP is encrypted using a session key (calling it that way, but if there's a more exact term I'd be glad to ...
- 91
3
votes
2
answers
529
views
Attacking WEP/WPA/WPA2
When attacking WEP/WPA/WPA2, I see people buy a wireless network adapter (e.g. Alfa). Why can't an inbuilt adapter in a laptop work? Or in other words, is there a quick way for me to check if the ...
- 1,566
2
votes
1
answer
645
views
Can someone find wpa2 key through ethernet?
When you connect to a ap using ethernet it requires no authentication but the traffic must be encrypted with a handshake shouldn't it?
So wouldn't an attacker be able to write a script when he plugs ...
- 21
8
votes
1
answer
422
views
How to provide user friendly WiFi access to gym members with WPA2 Enterprise?
Background
A friend of mine is the owner of a medium sized gym. He wants to provide WiFi to his customers and asked me to come up with a concept and eventually also deploy it. As a computer scientist ...
0
votes
1
answer
352
views
Can a third party passively read transmissions if WEP / WPA / WPA2 key is known?
If I connect to a WiFi network sporting either WEP, WPA or WPA2 encryption, can someone other decipher my communication he passively received if he knows the network's passphrase?
- 141
3
votes
3
answers
2k
views
Authentication in WPA from a user's perspective
I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is :
How is the authentication used in WPA different from that used ...
- 131
2
votes
2
answers
2k
views
Ethical Hacking: Cracking my personal wireless network
I am teaching myself ethical hacking.
Now, I am attempting to crack the password of my Verizon FIOS Router at home. Using Kali Linux 2 based on this website.
Steps So Far
On Kali Linux typed airmon-...
- 143
1
vote
0
answers
165
views
How does deauth protection (IEEE_802.11w-2009) work?
I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
- 6,534
4
votes
1
answer
1k
views
How are WPA2 passwords encoded?
I'm trying to figure out a good John The Ripper rule for WPA2 that won't waste time testing impossible passwords. Thus the question - are there any limits on what's allowed in a WPA2 password? Can it ...
- 6,534
2
votes
1
answer
1k
views
What is the difference between capture traffic from inside and outside of my network?
I'm thinking to use Wireshark tool to packet capture in my Wireless network.
I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "...
- 313
2
votes
2
answers
4k
views
Is WPA-PSK AES safer than WPA-PSK TKIP-AES?
On this forum thread I see (translated):
On Telecom Router we have those wifi encryption modes
Disabled-OpenNet
- WEP (128 bit) -> WEP (unsafe breakable in some minutes)
- WPA-PSK TKIP 256 bit -...
- 155
3
votes
1
answer
2k
views
missing ESSID from aircrack-ng
I'm using Mac OS X and I was able to sniff packet from my homeNetwork (in order to learn more about how things goes on).
I'm sending a deauth command to all my devices to disconnect them and then ...
- 211
1
vote
3
answers
5k
views
aircrack-ng fed with crunch taking ages
I'm trying aircrack-ng attack like below:
crunch 1 2 -f /usr/local/Cellar/crunch/3.6/share/charset.lst mixalpha-numeric|aircrack-ng -b 90:F6:52:80:B9:E2 -w - ~/DumpLog*
⋮
Crunch will now generate the ...
- 111
2
votes
1
answer
692
views
Details of WPA2
Finding explanations about the various aspects of WPA2 suffers from inconsistent terminology and a general lack of clarity on what purpose some protocol/standard serves and how it relates to others.
...
- 247
2
votes
2
answers
516
views
Does DirectAccess protect non corporate traffic on public wifi?
If I were connected to DirectAccess over public wifi, does this provide any measure of security for non-corporate resources, such as online banking?
Would I be better served by going through ...
- 21
0
votes
1
answer
1k
views
MITM attack on WPA-PSK using fake AP: Can the password be intercepted from normal Windows AP-logon mechanism?
I have already tested how to do a MITM attack, using a fake AP to intercept the WPA-PSK, by presenting the user to a vendor (e.g. Linksys) logon page, before routing network traffic through eth0.
...
- 1,207
3
votes
3
answers
309
views
Risks of giving a hacker my WPA key for my router?
What are the risks when someone (maybe a hacker), that through Social Engineering gets the WPA or WEP key of my router and (obviously) can navigate through internet.
At this point, what can this ...
- 559
0
votes
1
answer
522
views
Plaintext DNS traffic in a WPA2 session?
The question I have is, in WPA2 session between the AP and client are DNS requests sent plain text?
Trying to wrap my head around the latest glibc exploit.
Thank you
Ted
- 1
2
votes
1
answer
2k
views
How to optimize cracking speed with Reaver
When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of ...
- 141
2
votes
1
answer
413
views
Is a "standalone WPS server" possible?
Wi-Fi Protected Setup (WPS) is
a network security standard to create a secure wireless home network.
It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a button, ....
- 9,028
1
vote
0
answers
807
views
Difference between WPA, WPA2 and mixed mode on packets level
What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples?
Above question ...
- 11
4
votes
1
answer
1k
views
Evil Twin attack: How to make client send WPA2-PSK password when asked for AP-password? [closed]
How can an Evil Twin attack be set up, so that the client will be prompted for a password and send it in plain text?
Is the above even possible? I have already set up the fake AP, but it must be ...
- 1,207
1
vote
1
answer
753
views
How can systems recognize different wifi AP with the same SSID and MAC address
I'm testing, for studying purpose, an evil twin attack. In my scenario I have both the rogue AP made by my laptop and the real AP with the same SSID and MAC address, but with different security ...
- 11
2
votes
1
answer
14k
views
How to brute-force WPA-2 password of specific set of characters using oclHashcat?
I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}.
To do this I have already captured the handshake in a .cap file and converted it ...
- 1,207
0
votes
1
answer
185
views
Why isn't WPA2 more secure?
Follow-up from this question. I just learned that all one needs to decrypt WPA2 traffic is the network key. So for example if I go to a coffee shop and they have the key on the wall I can listen to ...
16
votes
2
answers
5k
views
How does WPA2-PSK prevent evil twin password phishing?
Let's say we have a WPA2-PSK secured AP and there are several clients like smartphones and notebooks that automatically connect to it.
Now if someone was to create another AP that looked completely ...
- 1,019