Wi-Fi Basic Wireless Pentest Checklist

Authentication methods

• Open
  • Opportunistic Wireless Encryption (OWE)
  • Uses DH key exchange, unique session keys, encrypts the network without needing a password
• Personal
  • Simultaneous Authentication of Equals (SAE)
    • Dynamically generated session-specific encryption keys
    • Prevents passwords from being derived from captured data
  • Transition mode
    • Allows PSK devices to connect
      • Backwards compatible with WPA-2 personal
• Enterprise
  • Extension of WPA2-Enterprise
  • Transition mode - Allows WPA2-Enterprise clients to connect
  • 192-bit security mode
    • Recommended for government/highly sensitive networks

Deauthetication attacks

• WPA3 uses management frame protection to prevent deauthentication

OWE

• Both the AP and Client generate DH key pairs.
• These are used to derive a shared secret
• The shared secret is used to generate a pairwise master key (PMK) which is used for session encryption.
• Does not perform identity validation

OWE reconnaissance

• In airodump the ENC will be WPA3 and the Auth will be OWE
• Wireshark filter for the pcaps:

(wlan.fc.type == 0) && (wlan.fc.type_subtype == 0x08)

• Within the RSN Capabilities the Auth Key Management will say OWE
• And management frame protection required will be true.
• For transition made, there will be a tag saying "Vendor Specific: Wi-Fi Alliance: OWE Transition Mode"

SAE

• Replaces the PSK method used by WPA2

• Uses a password-authenticated key exchange (PAKE)

• The client and the AP prove they know the password without transmitting it.

• So no offline brute-force of handshakes

• Each password brute-force takes 1 live authentication attempt which slows down a brute force.

• Two modes

  • WPA3-SAE - Solo mode, only WPA3 capable clients can connect.
  • WPA2/WPA3 transition mode - Allows WPA2-PSK and WPA3-SAE clients to connect

SAE reconnaissance

• In airodump the ENC will be WPA3 and the Auth will be SAE
• Wireshark filters for the pcap:

(wlan.fc.type == 0) && (wlan.fc.type_subtype == 0x08)

• Within a beacon frame the RSN information will show:
  • Auth Key Management - SAE
• If PSK and SAE are listed in Auth Key Management then the AP is using WPA3 transition mode.
  • You won't be able to tell from airodump alone that transition mode is in use. You have to look at the beacon frames.
• Management frame protection might not be enforced on transition mode. This will also be within the RSN information
  • Management Frame Protection Required: False

WPA3 attack vectors

• Downgrade attack if the target AP:
  • Supports both PSK and SAE listed in the AKM
  • Wi-Fi 6 support
  • Management frame protection supported
• Online brute-force or evil twin if the target AP
  • Supports only SAE
  • Has Wi-Fi 6 support
  • Management frame protection is required