Security
  • IT Security Knowledge Base
  • Blue team
    • Linux System Hardening
    • Phishing Analysis
    • Snort
    • Yara
  • Capture the Flag
    • OverTheWire
      • Bandit
        • Bandit Level 0
        • Bandit Level 0 → Level 1
        • Bandit Level 1 → Level 2
        • Bandit Level 2 → Level 3
        • Bandit Level 3 → Level 4
        • Bandit Level 4 → Level 5
        • Bandit Level 5 → Level 6
        • Bandit Level 6 → Level 7
        • Bandit Level 7 → Level 8
        • Bandit Level 8 → Level 9
        • Bandit Level 9 → Level 10
        • Bandit Level 10 → Level 11
        • Bandit Level 11 → Level 12
        • Bandit Level 12 → Level 13
        • Bandit Level 13 → Level 14
        • Bandit Level 14 → Level 15
        • Bandit Level 15 → Level 16
        • Bandit Level 16 → Level 17
        • Bandit Level 17 → Level 18
        • Bandit Level 18 → Level 19
        • Bandit Level 19 → Level 20
        • Bandit Level 20→ Level 21
        • Bandit Level 21→ Level 22
        • Bandit Level 22 → Level 23
        • Bandit Level 23 → Level 24
        • Bandit Level 24 → Level 25
        • Bandit Level 25 → Level 26
        • Bandit Level 26 → Level 27
        • Bandit Level 27 → Level 28
        • Bandit Level 28 → Level 29
        • Bandit Level 29 → Level 30
        • Bandit Level 30 → Level 31
        • Bandit Level 31 → Level 32
        • Bandit Level 32 → Level 33
    • OWASP Juice Shop
      • Installation
      • Level 1 - Challenges
      • Level 2 - Challenges
    • TryHackMe Rooms
      • Anthem
      • Capture!
      • Corridor
      • Gotta Catch'em All!
      • Mustacchio
      • Neighbour
      • Opacity
      • Source
    • CEH v12 practical resources
  • Cryptology
    • CryptoHack
      • Course: Introduction to CryptoHack
        • Introduction - Challenges
        • General - Encoding
        • General - XOR
      • Course: Modular Arithmetic
        • General - Mathematics
        • Mathematics - Modular Math
        • Mathematics - Brainteasers Part 1
      • Course: Symmetric Cryptography
        • How AES Works
        • Symmetric Starter
        • Block Ciphers
        • Stream Ciphers
  • Red Team
    • Reconnaissance
      • Foot-printing
      • Scanning (Nmap)
      • Enumeration
    • Vulnerability Analysis
    • Initial Access
      • Obtaining credentials
      • Vulnerability Exploitation
        • Buffer Overflow
        • Metasploit and Armitage
        • Ninja Jonin
    • Active Directory
      • Connect to AD
      • AD Explore
      • CMD and PowerShell enumeration
      • Certificates in AD
      • LDAP Pass-back Attacks
      • Cracking NetNTLM Challenge with Responder
      • Exploring Configuration Files for AD Credentials
      • Pass the hash with evil WinRM
      • Understanding Runas
    • Malware
    • Sniffing
      • Intercept HTTP traffic - Hetty
      • Intercept HTTP traffic - Bettercap
      • Wireshark
    • Social Engineering
    • Denial of Service
    • Web Hacking
      • Burp Suite
      • OWASP ZAP
      • Web servers
      • Web Server Footprinting
      • Directory Enumeration
      • Session Hijacking
      • Web Shells
      • Web vulnerability scanners
      • SQL Injection
    • Cloud
    • Wireless Networks
      • Attacking WEP
      • Attacking WPA/WPA2
    • Mobile Devices
    • Network Security Evasion
    • Privileges Escalation
    • Maintain Access and Hide Malicious Activity
      • Backdooring
    • Cover your Tracks
  • Internet of Things
    • IoT in general
    • Common IoT Protocols
      • CoAP
      • MQTT
      • ZIGBEE
      • Bluetooth
    • Scapy
      • Sniffing and spoofing
      • ARP cache Poisoning
  • Projects
    • Cybersecurity Roadshow
Powered by GitBook
On this page
  • How it works
  • WPA
  • WPA2
  • Cracking WPA/WPA2 keys
  1. Red Team
  2. Wireless Networks

Attacking WPA/WPA2

How it works

WPA

WPA employs the following process:

  1. Generation of Keystream:

    • A Transmit Key (TK), Transmit Address, and TKIP Sequence Counter (TSC) serve as input to the RC4 algorithm, resulting in the generation of a keystream.

    • The Initialization Vector (IV) or TK Sequence, Transmit Address (MAC destination address), and TK are combined using a hash or mixing function, producing a 128-bit and 104-bit key.

    • This key is combined with RC4 to create a keystream of the same length as the original message.

  2. MIC Calculation:

    • The MAC Service Data Unit (MSDU) and the Message Integrity Check (MIC) are combined using the Michael algorithm.

  3. Fragmentation:

    • The combination of MSDU and MIC is fragmented to generate the MAC Protocol Data Unit (MPDU).

  4. ICV Calculation:

    • A 32-bit Integrity Check Value (ICV) is calculated for the MPDU.

  5. Encryption:

    • The combination of MPDU and ICV is subjected to a bitwise XOR operation with the keystream, resulting in the generation of the encrypted data.

  6. MAC Frame:

    • The IV is added to the encrypted data to create the final MAC frame.

WPA2

WPA2, in its CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) implementation, generates additional authentication data (AAD). This data is created using a MAC header and is incorporated into the encryption process, which utilizes both AES (Advanced Encryption Standard) and CCMP encryption techniques. This integration ensures the protection of the non-encrypted portion of the data frame from any tampering or distortion.

To facilitate this encryption, the protocol employs a sequenced packet number (PN) and a segment of the MAC header to generate a Nonce, a random number used in the encryption process. The protocol takes plaintext data, temporal keys, AAD, and the Nonce as input for data encryption, utilizing both AES and CCMP algorithms. The inclusion of a PN in the CCMP header safeguards against replay attacks.

The AES and CCMP algorithms work together to produce encrypted text and an encrypted MIC (Message Integrity Code) value. These elements, along with the assembled MAC header, CCMP header, encrypted data, and encrypted MIC, come together to form the complete WPA2 MAC frame.

Cracking WPA/WPA2 keys

Just remember that a NIC supporting monitor mode is needed.

PreviousAttacking WEPNextMobile Devices

Last updated 1 year ago

has a nice guide for this .

Aircrack-ng
here