Collaborate Disseminate
I want to decrypt my own network traffic.
I have Linux Mint on Samsung Laptop with a AR542x Wireless Network Adapter.
Open Wireshark, start capture in promiscuous mode & monitor mode and I receive all the packages around me.
The… Continue reading Wireshark can’t decrypt WPA2 LAN traffic
So basically I am having a hard time trying to figure out why I can’t use cowpatty and genpmk to crack a wpa2 on a test router that I have. Initially I was having a problem getting it to work with genpmk. Then to figure out i… Continue reading Having problems cracking WPA2 using Cowpatty and Cowpatty+genpmk
I’ve seen that hostapd-wpe supports the following EAP types for impersonation:
1. EAP-FAST/MSCHAPv2 (Phase 0)
2. PEAP/MSCHAPv2
3. EAP-TTLS/MSCHAPv2
4. EAP-TTLS/MSCHAP
5. EAP-TTLS/CHAP
6. EAP-TTLS/PAP
I think that is usin… Continue reading How to change EAP configuration in hostapd-wpe
I’ve seen that hostapd-wpe supports the following EAP types for impersonation:
1. EAP-FAST/MSCHAPv2 (Phase 0)
2. PEAP/MSCHAPv2
3. EAP-TTLS/MSCHAPv2
4. EAP-TTLS/MSCHAP
5. EAP-TTLS/CHAP
6. EAP-TTLS/PAP
I think that is usin… Continue reading How to change EAP configuration in hostapd-wpe
I want to replace my current WPA2/PSK Setup with WPA2+802.1x with RADIUS authentication. There are various algorithms which can be used for that which can be roughly divided in two groups:
a) the user uses a certificate to a… Continue reading WPA2 with 802.1x – how is the server certificate validated?
A very similar question was asked here but it didn’t get any reply, so I’m going to ask a new question with some more insights.
The problem of the most common Evil Twin Attack is that the fake AP is unsecured and I’ve notice… Continue reading Evil Twin Access Point Secured-Unsecured
Can anyone tell me how ARP Poisoning exactly works?
Because I was sure that worked as I stated here.
But I’ve been told that is not how ARP poisoning works. That the path I’ve mentioned in the link is wrong, because the correct one would be:
target(C)–> router(A)—>attacker(B) –>router(A)–> internet.
And I’ve been told that due to the path mentioned above, I wouldn’t need the PTK to decrypt the traffic because the router would decrypt the traffic for me.
So, which one is correct?
Can anyone tell me how ARP Poisoning exactly works?
Because I was sure that worked as I stated here.
But I’ve been told that is not how ARP poisoning works. That the path I’ve mentioned in the link is wrong, because the correct one would be:
target(C)–> router(A)—>attacker(B) –>router(A)–> internet.
And I’ve been told that due to the path mentioned above, I wouldn’t need the PTK to decrypt the traffic because the router would decrypt the traffic for me.
So, which one is correct?
As mentioned in the title, I’ve questions regarding an ARP Poisoning on a WPA Personal and WPA Enterprise.
I’m gonna do an example (please let me know if I’m wrong):
I need to send the ARP reply to the Victim (C), updating the record of the gateway (A) with the MAC of my machine (B).
Then I need to send the ARP reply to the Router (host A), updating the record of the victim (C) with the MAC of my machine (B).
After that I would simply allow ip forwarding on machine.
So, we should have:
C->B->A
A->B->C
Because, if that is correct, I believe that in WPA Personal, in order to the decrypt the traffic that you have received from the client (victim) you would need to generate the PTK used by the victim (which in this case I believe is possible, because you could generate the PMK having the PSK. Then sniff ANonce, SNonce, AP_MAC, CLIENT_MAC and generate the PTK).
Again, if what I’ve said is correct, how would be possible to decrypt the traffic of the WPA Enterprise that has multiple passwords, making therefore not possible to generate the PMK?
As mentioned in the title, I’ve questions regarding an ARP Poisoning on a WPA Personal and WPA Enterprise.
I’m gonna do an example (please let me know if I’m wrong):
I need to send the ARP reply to the Victim (C), updating the record of the gateway (A) with the MAC of my machine (B).
Then I need to send the ARP reply to the Router (host A), updating the record of the victim (C) with the MAC of my machine (B).
After that I would simply allow ip forwarding on machine.
So, we should have:
C->B->A
A->B->C
Because, if that is correct, I believe that in WPA Personal, in order to the decrypt the traffic that you have received from the client (victim) you would need to generate the PTK used by the victim (which in this case I believe is possible, because you could generate the PMK having the PSK. Then sniff ANonce, SNonce, AP_MAC, CLIENT_MAC and generate the PTK).
Again, if what I’ve said is correct, how would be possible to decrypt the traffic of the WPA Enterprise that has multiple passwords, making therefore not possible to generate the PMK?