Hot answers tagged

28 votes
Accepted

How to force clients to connect to WiFi automatically?

You can't simply Force a client, but to trick him! As long as the device's WiFi is running, it keeps sending probe requests, searching for your previous connected networks. Using some software like ...
Eibo's user avatar
  • 2,495
9 votes
Accepted

Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate?

Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate (CA, user, or otherwise)? PEAP/MSCHAPv2 doesn't typically use client certificates, nor does it directly use any CA ...
YLearn's user avatar
  • 4,007
8 votes

How to force clients to connect to WiFi automatically?

There are a few methods that could have been used: Devices of all sorts that use WiFi connection usually have a setting that lets the device connect automatically when the same SSID is out there. ...
Bubble Hacker's user avatar
3 votes
Accepted

Is is possible to decrypt 802.11 for WPA enterprise?

The methodology I've always seen for this involves using Hostapd in a man in the middle style attack. Essentially setting up an Evil Twin style attack on the enterprise network, failing but still ...
Ori's user avatar
  • 2,757
3 votes

Evil Twin Access Point Secured-Unsecured

I've already answered on how to clone AP (merge with the original on a wireless network list) in here I think. If you're evil twin is an Open Network (waiting for the user to mistakenly selecting it ...
Azteca's user avatar
  • 1,106
3 votes

Wireless network risks?

This kind of depends on how strong you want your network security policy to be. Lets point out the main good and bad things about a WiFi network: Good: Convenient for the office workers to work ...
Bubble Hacker's user avatar
2 votes

Iterate through and decode Dot11Elt layers -- Scapy

Given the info in https://stackoverflow.com/a/29989032, you need to iterate over them like this: dot11elt = packet.getlayer(Dot11Elt) while dot11elt: print dot11elt.ID, dot11elt.info ...
solsTiCe's user avatar
  • 231
2 votes
Accepted

The benifits of Full NAC solution VS simple radius server

Any added value for the NAC solution in this case? Part of the answer to that depends on why you are implementing dot1x. One parallel I find useful is Trusted Network Connect, which the Strongswan ...
iwaseatenbyagrue's user avatar
2 votes

The benifits of Full NAC solution VS simple radius server

The solution of NAC basic use two features. Posture and Profilling. In the case of not using Host Checker(Agent) you are "losing" posture features - check patchs, av, registry and otheres stuff. ...
PedroMC's user avatar
  • 21
2 votes

Sending Probe Request Frames | Receving Probe Response -- Scapy

That's because you didn't include the "Dot11Elt" layer, try this: RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11Elt(ID="SSID", ...
MistSpark's user avatar
2 votes

How secure is LAN wireless 802.11 if password is used with access point?

"How Secure?" is a difficult question to answer. It depends on your particular circumstance and risk tolerance. If you are using WPA2 for encryption with a complex key, than I think it's reasonable ...
Ron Trunk's user avatar
  • 627
2 votes
Accepted

Is it dangerous to install my work's 802.1x certificate?

This is definitely not a Root CA since the website specifically says : Verify that the certificate is for dot1x.utexas.edu and lists GeoTrust CA as the issuer. The certificate purpose is to be ...
M'vy's user avatar
  • 13k
2 votes

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

It is possible, and you cannot prevent it. Most devices will allow administrators to backup or extract certificates, including the private key. Your perception of security is not in line with the ...
DoubleD's user avatar
  • 3,942
2 votes
Accepted

Certificate Based Authentication with AD and 802.1x or EAP-TLS

Maybe some of following statement are not accurate, but in overall, it works very similarly. It really depends on implementation. But the idea is the private key never leaves the device it is using ...
Fis's user avatar
  • 1,230
2 votes

What is the best way to authenticate active directory users who want to connect to Ubiquiti or Meraki's WiFi hotspots?

802.1X authentication has three parties: a supplicant, an authenticator, and an authentication server. The RADIUS (or its proposed successor Diameter) is used for the communication between an ...
Esa Jokinen's user avatar
  • 18.9k
1 vote
Accepted

EAP-TLS for securing internal local WLAN?

WPA2-Enterprise with EAP-TLS authentication to a RADIUS server seems more suitable at first glance (per-connection encryption PMK, no pre-shared key, mutual authentication with different secrets on ...
ysdx's user avatar
  • 1,499
1 vote
Accepted

How do I determine whether a person use a (public) WiFi access point using WiFi sniffing?

Some tools can already do this, notably airodump-ng, which will show a list of clients and the network they are currently associated with. The tool can filter by open networks. QoS data is typically ...
multithr3at3d's user avatar
1 vote
Accepted

How WPA supplicant can determine whether switch supports authentication or not?

This can be done in two ways, based on whether machine IP is statically configured or dynamically configured. If machine is configured for DHCP than a client can initiate the DHCP DISCOVER and wait ...
proudengineer's user avatar
1 vote

Does getting a challenge and response with hostapd-wpe mean that credentials were sent?

It seems the answer is yes getting a challenge response indicates the password was sent. My mistake was in cracking the password. To successfully crack the password I created a new wordlist.txt with ...
Shane Burke's user avatar
1 vote

wireless security - Authentication and Association

WPA and WEP have little in common security wise. WPA does not allow Open System Authentication nor Shared Key Access. You cannot be authenticated and not connected to an access point. You associate, ...
Pedro's user avatar
  • 3,931
1 vote

802.1x certificate authentication, private key?

is the private key stored on the device that is wishing to access a given resource network ... For authentication using public-key cryptography as done in 802.1x or in TLS certificates the ...
Steffen Ullrich's user avatar
1 vote

ARP Poisoning: exactly how it works

From a brief look - both descriptions are essentially correct as 802.11 is talking via the router (think of it as a switch in this context) to reach your box. From a higher layer perspective (the ...
user2867314's user avatar
1 vote

ARP Poisoning: WPA Personal and Enterprise

Because, if that is correct, I believe that in WPA Personal, in order to the decrypt the traffic that you have received from the client (victim) you would need to generate the PTK used by the victim ...
YLearn's user avatar
  • 4,007
1 vote
Accepted

PMK is what prevent to generate the PTK and decrypt the traffic?

To decipher the traffic of your victim, PMK is what prevents you to figure out the PTK of that client. To generate PTK 5 things are required: PMK AP MAC Address Client's MAC Address ANonce SNonce ...
defalt's user avatar
  • 6,841
1 vote

What information can WiFi devices leak without actually connecting?

Mr. Paranoid's device will do two things to scan for networks: passively listen for beacon frames and send probe requests to a null BSSID. The second technique is active and therefore detectable. ...
Reid Rankin's user avatar
  • 1,092
1 vote

Iterate through and decode Dot11Elt layers -- Scapy

Here you go buddy. you can have whatever you want from netaddr.core import NotRegisteredError from netaddr import * from scapy.all import * import logging import logging.handlers ...
Rahul rajput's user avatar
1 vote

Does wireless card need to be on same channel as AP to sniff beacon frames?

What really happens is that to modulate and demodulate the signal your WIFI card antenna needs to operate on a frequency called central-frequency, which belongs to a certain channel which is being ...
Arjun sharma's user avatar
1 vote

Does wireless card need to be on same channel as AP to sniff beacon frames?

You can only listen to signals on the correct frequency band (channel). This is why tools that attempt to give a full listing will necessarily browse through all the channels.
Julie Pelletier's user avatar
1 vote

How to sniff 802.11 packets without going into monitor mode?

No. You absolutely can see frames you generate or are destined for your radio without monitor mode. With the exception of the initial 802.1x handshake, unfortunately. You will need something like ...
Ori's user avatar
  • 2,757
1 vote

How secure is LAN wireless 802.11 if password is used with access point?

Nothing can be 100% secure these days. There was a case back in 2011 where a WiFi neighbor Barry Ardolf, 46, repeatedly hacked into his next-door neighbors’ Wi-Fi network to frame them for child ...
BitsInForce's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible