Hello guys, welcome to the first ever virtual DEF CON event.
This workshop, Introduction to Wi-Fi Security, is a part of Wireless Village, which is a part of DEF CON as you know.
So in this workshop, we are going to talk about the basics of Wi-Fi security.
We will talk about the schemes that Wi-Fi uses to keep your traffic, your identity secure while you are using the Wi-Fi.
And we will also look at the ways to attack those.
My name is Nishant and I will be conducting this workshop along with my colleague Jaswin.
We both work for Pentester Academy.
So before moving forward, a little bit background about us.
I work as R&D Manager at Pentester Academy.
We work on developing labs and training contents for our customers.
When we are not doing that, we train around the world in different venues.
We present our research.
Jaswin also works at Pentester Academy. He is a researcher there.
And apart from doing all the lab work and the routine work, he also helps me as a co-trainer in the trainings.
And he also publishes his research.
So here are some cool logos from some conferences that we have been to.
This is the pentesteracademy.com.
We have a lot of courses, on-demand video courses on here.
You can go and take a look.
Similarly, we have a browser-based lab which is completely in cloud.
We call it Attack Defense.
Everything in this lab can be used using your browser.
You don't need any VPN. You don't need any plugin.
We have customers from over 90 plus countries.
And now coming to the workshop outline.
So as discussed before, we will talk about the basics of Wi-Fi.
And then we will talk about sniffing and recon.
We'll talk about WEP, WPA2-PSK, and WPA2-Enterprise.
What they are, how the authentication works in them,
and how we can actually attack them.
So first of all, you know, when you read about Wi-Fi,
you will see that it is referred by the name or this number.
That's 802.11.
So 802 is the committee that deals with the network-related norms.
And .11 is assigned to Wi-Fi or wireless LAN.
So 802.11 is the standard.
And then there are multiple amendments to the standard to support newer things.
So for example, you have your 802.11 A, B, G, N.
Similarly, you have I, W, and there's a list.
There's a list of this.
So all of these are amendments to the main standard.
Wi-Fi Alliance is the organization that actually holds the right
for this specific logo.
The Wi-Fi trademarks actually belong to them.
So if you are a vendor and if you want to use this logo on your product,
you have to take approval from them.
So you submit your product to them and then they go through it.
They check if it complies with whatever standards they have.
And then you're allowed to use this logo.
So there are multiple amendments.
But we are only going to talk about those which deal with the transmission of Wi-Fi,
especially the bands and the bandwidth and all.
So in that, you have A, B, G, N, and AC, which is the latest one.
So 802.11 A, it uses OFDM.
So all of this, because it's a basic class, we don't have that amount of time.
But just to give you an overview, there's a reason why these slides are here,
so that you can go back later and, you know,
if you are interested in this specific part, you can dig deeper into it.
So 11A is the first one. It was the basic one.
It used to use 5 GHz.
And at that time, OFDM was the way to propagate the wave of the data in this case.
And then the 11B came.
It used to work on a different way of modulation.
And 2.4 GHz was used for it.
Then came G. In G, they increased the data carrying capacity.
After that came N.
N actually allowed you to use two or more channels together.
So it's, you know, so what the idea here is to increase the throughput.
So, you know, from A, B, G, N, what we are trying to do,
we are trying to transmit more data using Wi-Fi, right?
Because, you know, it's not like the older times now.
If you talk about 10, 15 years back, you didn't have that kind of requirements
as well as that kind of equipment at your home.
So, for example, you didn't have 4K TV, right?
But now when you have 4K TV, which connects to your Internet
and you want to stream a movie or something, you need higher bandwidth, right?
So that's where all of these standards actually came in.
So, you know, 11 AC is the latest one, which is, you know,
being adopted by the market for the past few years now.
So it can actually give you up to 1.3 Gbps of data transmission
using your home Wi-Fi.
And if you talk about enterprise Wi-Fi, then the limit will increase.
So these standards will make sure that, you know,
it can accommodate your needs with the time.
So this is the 2.4 GHz channel.
So Wi-Fi, if we talk about the main Wi-Fi, not the newer ones like 11 AD or something,
it operates on two main channels.
First one is the 2.4 GHz channel and the second one is the 5 GHz channel.
So this is the layout for the channels on 2.4 GHz.
So you can see that there are 14 channels and all of these cannot be used in all of geographies.
You know, there are regulations.
So according to them, you can use 14 channels in some of the geographies,
some of the nations, and then you can use 12 or 13 in others.
So you can refer to the regulatory information for this.
Now, what you can observe here is these bands are very narrow and they overlap.
And this causes a lot of problems because, you know, then you have interference
and you have a lot of, you know, Wi-Fi networks operating
and there are a lot of clients in the vicinity.
It is going to cause problems.
So that's where people then move to 5 GHz.
So 5 GHz is more spread out.
It has non-overlapping channels.
So you can transmit more.
So that was the idea behind it.
Now, coming back to the sniffing and the connection part.
Obviously, if you want to connect to a Wi-Fi, everyone is doing it now.
So, you know, it's the part of daily routine now.
So you have your access point in your home, at your office,
and then you have a Wi-Fi card which you have connected to your desktop externally
or, you know, you can have a laptop which automatically comes with it,
your phones, all of these have internal Wi-Fi cards.
So, you know, also they have antennas.
So using that, your device connects to the access point
and then you're able to exchange traffic with it, right?
So that's the basic thing about it.
Now, when in normal mode, these cards,
they don't actually look at the traffic of other cards.
So, you know, if you are sitting somewhere and there are multiple clients
and multiple routers or access points, as you like to call them,
if there are multiple of these pairs, they are transmitting data back and forth, right?
So, but the card that your machine is using in normal operation,
it will only consider or it will only show you the traffic that is, you know,
that is for your machine.
All the other, it, you know, it totally rejects that.
It totally ignores that.
So if you want to take a look at other people's traffic,
it can't be done in the normal mode.
So for that, you have something called as monitor mode.
If you guys have done a sniffing of other people's machine on LAN,
it's also known as promiscuous mode there.
So monitor mode allows you to look at the traffic in the vicinity.
You can do sniffing and then you can go for attacks and all of those things.
So first of the things that you need is a Wi-Fi card,
which allow you to sniff, which actually allow you to put it into monitor mode.
So here are some of the cards which actually allows monitor mode.
You can order one from Amazon or some other, you know, e-commerce market.
So this was the old way of doing it.
It was the conventional way of doing it.
Now, suppose you're dealing with something advanced, right?
You know, you're dealing with 11 AC points, which is transmitting data on a very high pace.
At that point, what you can do is you can go for an off-shelf access point.
You can write, you know, with your own firmware and then you can use it for sniffing.
The reason for doing that is for high performance access points.
Your cards will not be able to match the throughput or the capacity of those access points.
So if you have an access point, you have a better chance to not miss the traffic that is being transmitted
or received by that specific access point.
Now, you know, because firmware is not something that, you know, that is like Windows software.
It's not like you download it and you click run and it runs and installs.
It's not like that. And that's where a lot of people face problems.
So when you buy a router, you know, of the shelf routers from market
and you want to transform it into sniffer, you can use something like OpenWRT.
So OpenWRT is a Linux based project for these embedded devices,
which actually allow you to customize and, you know, customize your routers and access points.
You can use it in access point mode. You can make it something else.
You can make it a hacking gadget. So all of that, it actually allows you.
It has support for most of the hacking and recon tools, especially for Wi-Fi and all.
So you can use it if you want to go for the higher throughput ones.
So now let's talk about some basic terminology that will help us, you know,
in the workshop or the later parts of the workshop.
So first, station or STA in short is nothing but a wireless client.
It can be your mobile. It can be your laptop.
It can be a desktop, you know, with a Wi-Fi card on it.
Then comes BSS. BSS stands for Basic Service Set.
So BSS, when you will hear about it, it is to refer a set of access point and a client.
If you know they are operating in that or it can be ad hoc clients,
which, you know, do not need access point to connect.
ESS is a set which contains multiple BSS.
And similarly, then ESSID or SSID is the name which we use to identify that ESS.
So suppose you have a Wi-Fi network, you put some name on it, right?
Home Wi-Fi or something. So that is SSID, right?
It's important to remember. That's why, you know, I'm explaining it again.
SSID is the name of the Wi-Fi network that you are using.
And now ESSID refers to the MAC address of the access point that is giving you the Wi-Fi, right?
So ESSID will be the MAC address and you will be able to see it when you connect with that Wi-Fi.
Not in your Windows machine, you know, directly.
You have to do some dig through or you have to look at the packets to see it.
Then comes the distribution system.
So generally distribution system refers to the network which connects access point with the larger network.
So again, some examples of VSS.
You can see that in the first picture here, you have a VSSID.
You know, this AP, you have this access point.
And then there are two nodes which will be connected to this.
Similarly, in ad-hoc configuration, you can see that there is no access point.
But, you know, these machines are connecting with each other.
ESS is... it consists of DS, which is connecting to access points.
And then it consists of two VSS also.
Two or more actually. Two in this figure.
Now coming to WDS.
WDS is a wireless distribution system, right?
So suppose you want to deploy an access point in such a location where you don't have a wire, right?
You don't have an Ethernet connectivity there.
So what you can do is you can use an access point which has wired connectivity to extend the network.
And this bridge or this link between these two access points is known as WDS link.
And then you can cover more ground.
So it's also known as mesh networking in Wi-Fi, if you read about it.
So now there are three main type of packets in Wi-Fi.
First is the management packet.
Management packets are used to connect, to disconnect, or to manage the devices, if you want to say, on board.
Similarly, control packets are something which deal with the transmission control and other things.
But that is not something that we are going to look into a lot.
And the third one, data, as the name suggests, these are the packets which will actually carry the real data.
And then you have different subtypes in these.
You can read about these. This table is available on the Internet.
You can see that there are multiple management packets.
You have association request, association response.
And similarly, you have beacons and probes and whatnot.
So to summarize the Wi-Fi environment, you have an access point, which is currently operating a Wi-Fi network, which will be identified by its SSID.
That's the Wi-Fi network name.
And then the SSID will be there because the MAC address needs to be there on the access point.
And this SSID will then send the beacons out.
So beacons are the packets which your access point uses to advertise that, hey, I'm using or, you know, I'm providing you the specific Wi-Fi that you can use.
If a client has already connected to this Wi-Fi, instead of waiting for a beacon frame, it can also do probing.
So by probing, it sends a probe message looking for that specific network, which it already connected to once or multiple times in the past.
So once your client discovers the Wi-Fi network, then it goes ahead, it exchanges some packets with the access point, and then it connects with the access point.
And, you know, after that, you can transmit data, you can access Internet and other things.
So now, because, you know, it was not the wired thing, it's wireless, right?
Your packets are open, anyone with the monitor mode interfaces can capture it and then, you know, can look into what you are doing if it is not encrypted.
So that's the reason why we needed Wi-Fi encryption standards, so that we can protect our data from being sniffed by other people, right?
At your home, it might not matter. But, you know, especially if you are at a coffee shop, if you are at your office, if you're at an airport, all of this matters, right?
So here are some of the standards that we are going to talk about. We are going to talk about WEP. That was the oldest standard.
I hope that no one is using it now, but still, you know, you will find it somewhere in a CTF or in someone's home who is not very tech-savvy or, you know, old.
WPA, WPA2 are the ones that are currently used. These can be used in two different configurations. One is the PSK or pre-shared key.
It's also known as WPA or WPA2 personal, because it is meant to be personal use. And then there's enterprise one, which is meant for enterprise use.
WPA3 is the latest standard. It is something that you will see in mainstream, you know, within a year or maybe this year. In some places, you might have already been started seeing this.
So now to do the recon and the cracking for WEP and WPA, PSK, we are going to use Aircrack-NG suite of tools.
So it's a set of tools which allows you to do different things. So Aerodump-NG and Airmon-NG will allow you to capture the traffic, you know, to monitor the waves, to see the devices, access points that are in the vicinity.
Airbase-NG and Airreplay-NG allows you to create a honeypot to send deauthentication messages, to replay the messages.
And similarly, if you want to crack the key or the passphrase for WEP or WPA-PSK, you use Aircrack-NG.
So you can know more about these by searching about these on Google. This tool is used a lot. So you'll find multiple videos on it.
So now we'll talk about how to do basic recon with Airmon and Aerodump.
So now it's the demo time. And for that, we will shift to our demo setup.
So this is the portal that we are going to use to learn about these attacks. The URL is blurred. As of now, don't worry about it. We'll post the link to it in the YouTube description part.
So if you go down, you'll see that we have a course here which says Wi-Fi Basics Workshop.
You press start on it. It will show you four different scenarios. First is the Wi-Fi basics and then you have attacking WEP, you have attacking WPA2 Enterprise and PSK.
So we are going to start the Wi-Fi basics one.
So we chose this interface because, you know, as you can automatically see, you have commands on this side, you have lab on this side.
So it will help you to learn because, you know, you are the beginner people. So it really helps if you have guidelines ready.
Instead of searching on it on a blog and then coming back and then pasting and making mistakes and going back. Right. That actually wastes a lot of time.
So what we will do now, we will select a server from here. In your case, you might only see one option.
Solve this recapture. And then you start the lab.
It will take some time in starting the lab, so please be patient.
So the lab is ready now. What we have to do is on the left hand panel, we will read about the steps.
So first is check Wi-Fi interfaces present on this system.
And then to fire this, we will use this button.
Oh, please use Firefox for this exercise. It might feel it might face some issues on Chrome and others.
So if you click this, the command will execute and you will see that we have a WLAN0 interface, which is in managed mode.
So as we discussed before, managed mode is good for normal operation.
But if you want to do the recon and the sniffing and other things, this won't be enough.
So you have to put it in monitor mode. And that's what we are doing in step two.
So this is the command to put it in the monitor mode.
As you can observe, IWDEVWLAN0, the name of the interface, and then set monitor now.
So I'll press this. And it seems that the command has run.
Now, let's again run this command to see if it is in monitor mode.
Yes, it is. So we are ready now.
So now what we will do, we will run aerodump-ng on WLAN0.
And we will not define any other options for now.
We will let it jump on all the channels of 2.4 GHz and find what it can.
So press this. And as you can observe here, now it is looking for different ESSIDs or SSIDs.
You can also see the corresponding ESSIDs, corresponding channels.
And you can also see some of the stations, which means these are laptops or these can be phones.
In this case, this is emulated lab, so obviously these are none.
But in realistic scenario, you will see the phones, the laptops, other machines, sending probe requests, looking for the specific Wi-Fi.
Right. So this is how you can check which devices are in the vicinity.
So do a CTRL-C to stop it.
And then let's move to the next screen here.
Now suppose I am only interested in looking at traffic of channel 1.
So in that case, I can fire this command.
And here with argument-C, I have defined the channel number.
So what you will see here is this time this channel will not jump.
And you will only see the traffic which is coming on this specific channel. Right.
So this is how you use AeroDump to do basic recon.
And with this, our lab is done.
We will stop the lab after this.
And we will get back to the slides.
So now I will pass it over to my colleague Jaswin who will go through the WEP part.
And then I will meet you guys again when we will discuss WPA2-PSK and WPA2-Enterprise.
Hello everyone. Next we will take a look at WEP, Wired Equivalent Privacy.
When it comes to wired network, the physical proximity itself acts as a security mechanism.
That is, we need to get into the building physically, find a port, plug in our device and sniff the traffic or perform an attack.
Whereas in case of wireless networks, we have radio waves which are not bound by walls.
Therefore, it is very easy to intercept the traffic.
WEP was the original IEEE standard to add security to wireless network.
It provided security equivalent to that of wired network and hence the name.
WEP used RC4 stream cipher for generating the key stream.
It supported 40-bit shared key which is equivalent to 5 ASCII characters or 10 hexadecimal characters.
And a 104-bit shared key which is equivalent to 13 ASCII characters or 26 hex characters.
Now, if the same key is used to encrypt multiple plain text messages, what the attacker can do is analyze the ciphertext to generate the pattern and the attacker can ultimately find the key.
To prevent this, an initialization vector is added to the key.
In case of WEP, the initialization vector had length of 24 bits.
Therefore, the encryption key had the length of 64-bit or 0.28-bit.
WEP used CRC32 for generating the integrative check value.
Now, let's take a look at the encryption process.
So, here we have the initialization vector, key and the message.
The initialization vector and key is passed to the key scheduling algorithm and the pseudo random number generator.
It generates the key stream which will be used to encrypt the data.
For the second part, we have the message.
The integrity check value is generated of the message and is concatenated with the message and then it is encrypted.
The integrity check value is generated so that after decryption, we can verify that the message has not been tampered with.
So, finally, the message and the ICD is XORed with the key stream to generate the ciphertext.
In the end, the packet has initialization vector, 2-bit key ID, ciphertext and ICD.
Now, let's take a look at the decryption process.
In the decryption process, we have initialization vector, 2-bit key ID, ciphertext and ICD.
We'll get the key from the key ID and we'll feed it to the key scheduling algorithm along with the initialization vector.
This is further passed to the pseudo random number generator and the key stream is generated which will be used to decrypt the ciphertext.
The ciphertext is XORed with the key stream to generate the message and the ICD.
Now, the ICDs are compared and if both of them match, the packet is considered. Otherwise, it is discarded.
Now, the next question arises, what was the weakness of WEP?
The major weakness in WEP was the length of the initialization vector. 24-bit was not enough.
And as a result, when we have large number of packets, the ID will get repeated.
And once the attacker has all of these ciphertexts with repeated IDs, the attacker can easily find out the shared key.
Now, the attacker has two options. One is to wait and sniff all the traffic till we get enough number of IDs.
Or the attacker can inject a packet to force the access point to send more packets and therefore the attacker will get more number of IDs.
And this way, the second option fastened the process and made it possible to crack any WEP key.
Now, to crack a 64-bit WEP key, usually 250,000 IDs are required. And to crack a 128-bit WEP key, 1.5 million IDs are required.
But with the technique such as PDW, it is possible to crack WEP keys with a very less number of IDs.
So, to crack WEP keys, there are many methods. Few of the methods are break authentication, capillarity attack, chop-chop attack, fragmentation attack, and PDW attack.
Now, in order to crack the WEP key, we will start by sniffing the traffic, identifying the SSID, VSSID, and the channel number.
Now, in order to send packets to the access point, the MAC address of the attacker has to be authenticated with the access point.
Otherwise, any packet we send will get blocked and will get a deauthentication.
Now, in order to authenticate the MAC address, fake authentication can be used.
So, what happens in fake authentication is, we tell the access point that we can prove that we have the shared key, but we will not send the shared key yet.
This way, the access point will add the MAC address of the attacker to the list of clients who can send packets to the access point.
Now, since we have not sent the shared key to the access point, we cannot transmit data.
However, we can capture the data from the legitimate client connected to the network and then replay those packets.
Now, this is exactly what we are going to do.
First, we will capture the op request sent by the already connected client and then we will replay it to the access point.
So, when the access point gets the op request, it will rebroadcast the op request with a new initialization value.
This way, we can continuously send op requests to the access point to get more and more op requests with new initialization vectors.
Once we have enough number of initialization vectors, we can use aircrack-ng to crack the web key.
So, now let's take a look at a demo.
So, we will quickly select the server and install the capture.
Then we will start the lab. It should take a couple of seconds for the lab to come up.
The lab is now ready. Let's increase the size of the pond.
We will start testing the interfaces on the machine.
So, we have two interfaces. One is wlan1 and another is wlan2.
Both are in managed mode. So, we will set wlan0 into monitor mode.
And we will check the list of interfaces again.
So, now we can see wlan0 is in monitor mode.
Now, let's check the networks which are present in the vicinity.
We can do this with the help of aircrack-ng command.
So, now as you can see, we have epic-media-proc, which is using VIP on channel 6.
So, next, what we will do is we will start a capture in channel 6 and write these packets into capture file.
Now, if we just keep sniffing, it could take a lot of time to get enough number of packets.
So, what we are going to do is, we will start a pre-play attack in order to generate more number of packets.
So, we will start our pre-play attack.
And now we need around 10,000 data packets.
Currently, we can see we have 83,132 and the number increased.
So, now we have 10,000 data packets. We will stop the capture.
And we will also stop attacking the access point.
Now, we will use aircrack-ng command to crack the IP.
We will have to mention which network we want to target.
In this case, we have epic-media-proc, which is having the index of 4.
So, we will enter 4 now.
And then, we will start cracking.
So, we were able to find the key.
The key was 14332.
So, guys, welcome back. I hope you enjoyed the WEP session.
So, now we will talk about WPA2-PSK.
This is the scheme that is widely used. You will find this at your home.
And even in the smaller coffee shops or the restaurants or even the small offices.
So, WPA2 came after WPA.
WPA was a transitional scheme to move from WEP to WPA2.
So, WPA2 uses dynamic keys unlike WEP.
It uses AES encryption standard with CCMP mode in the CCMP mode.
And the protocol is still secure.
It is prone to passphrase brute forcing or the dictionary attacks if your password is not strong.
But apart from that, the scheme is still secure.
There were crack attacks that were discovered last year, which was for this specific scheme.
But again, it is very important to understand that the problem was not in the scheme itself.
It was in the implementation.
So, the scheme, theoretically, if you choose a good strong password, it is good to go.
But WPA2 also had its own shortcomings.
It doesn't have forward secrecy, which means if I'm capturing all of your traffic today and if you're using WPA2-PSK,
even if I don't have the password today, if I somehow manage to get the password two months after or two years after,
I can still go back and decrypt all of your traffic.
So, that is not good from security point of view.
Similarly, there is no management frame protection.
So, your receiver, when he receives a management frame, he doesn't have any way to tell that if it is coming from a real source
or it is something which is sent by a hacker or a malicious user.
And that's the reason why the deauthentication attacks, which are used widely for Wi-Fi DOS, the denial of service, work.
So, you can read about deauthentication attacks.
It's very common now.
It's been used for quite some years now.
And also, WPA2-PSK or personal is supposed to be personal.
It is supposed to be used in a personal network.
So, if you use it in a work environment or some place which you don't count as a personal space, it is also prone to insiders.
So, if you have a malicious insider, he can actually see the traffic of all the people on that specific Wi-Fi.
So, as we mentioned before, there are no static keys like WEP.
So, idea is you generate a dynamic key.
You use that to decrypt the traffic or encrypt the traffic.
And then, you know, next time when you do this, you again generate the keys again.
In saying it's very easy, but you need some way in which both the parties can have the keys.
And then they can use them to encrypt and decrypt stuff.
And obviously, this key needs to be the same, right?
Because we are going to use the symmetric encryption.
We have a lot of data.
So, what we do in this case is we use something called PSK.
That's where the PSK terms come.
It's pre-shared key.
So, you have a passphrase, which is, you know, between 8 to 63 letters long or characters long.
And you use it.
You feed it to pbkdf2.
pbkdf2 is a function.
It stands for password-based key derivation function.
And it will actually give you a pre-shared key of 256 bit.
The reason of doing this is passphrases are easier for human beings.
Just like you have IP to domain mappings.
Similarly, you can use passphrase to generate the pre-shared key.
It's easier to remember something meaningful than, you know, than a chunk of random hex characters.
So, when your access point is configured, it already knows the passphrase.
When you connect to that network, you also know the passphrase.
And that's how it works.
So, both the parties, they can calculate the same PSK and then they can use it for connection.
But again, as you can observe, PSK is not transient or not temporary in nature, right?
It's not directly generated.
You are converting it from the passphrase to the PSK, but that's not dynamic nature, right?
It will remain same till the time you will not change the password, right?
So, that's where we have to generate something else, which we refer to PTK from this.
So, PMK is derived using this specific function here.
You use PBKDF.
You pass it the secret passphrase.
You pass it the SSID name.
And then the SSID name length.
And then these numbers are there, which is 4096.
It's the number of iteration that will happen.
And then 256 is the intended key length for the PMK key that we are going to get.
So, you can read more about PBKDF and all of this in RFC 2898.
So, what will happen in WPA2 or even in WPA, we have this handshake.
We call it four-way handshake.
And this handshake is used to generate this specific temporary key that you use to pass the traffic on securely, obviously.
So, when you have a client, it wants to connect to the access point.
First of all, it will locate the access point.
It will locate the Wi-Fi network.
And after that, there are authentication and association messages, which are part of Wi-Fi protocol.
But here, please don't confuse authentication with the thing that we are going to do now.
So, it's more of a compatibility kind of thing rather than security.
So, first four steps are pretty much the same.
Your client, it will ask the AP that, hey, I want to connect.
And your AP will say, okay, go ahead.
So, this much is done.
After this, both of them have pre-shared key.
Why? Because both of them had passphrases.
And when you have passphrases, you can derive PSK of 256-bit format.
We just saw it in the previous slides.
Now, your access point will send message 1.
It's the first message.
There are four messages.
That's why it is four-way handshake.
So, in first message, it will generate a random number or a random string.
It will call it anons.
And it will send it in a packet in plain text to the supplicant.
Supplicant here is the client.
Your mobile, laptop, you know, whatever it is.
Now, what your client will do, it will take these anons,
and it will also generate a random number or random string called snons.
So, A here denotes to the authenticator or the access point.
S here denotes the supplicant or this station.
So, when you have snons and anons, which are randomly generated,
you can use this specific function here to generate the PTK.
PTK is the Pairwise Transient Key.
And as you can observe here, we passed PMK to it.
PMK is nothing but a key that we derived using the passphrase and SSID and SSID name length.
And then you have anons and snons.
These are randomly generated by access point and the client.
And then you have access point MAC and the client MAC.
So, this is the information which is now used to generate a temporary key.
This is temporary because anons and snons are randomly generated.
So, now this happens.
So, this guy can generate a PTK.
Now, what it will do, it will send snons plus MIC.
MIC or Michael is used to verify the integrity of a message.
And it is signed by a key.
So, in this case, the key that we have used, that we have generated, is used to sign this message.
And again, anons and snons are in plain text.
So, it will be sent to the access point.
Now, access point has all the information.
So, it will also generate PTK.
So, what it will do, it will generate its PTK.
It will check this MIC.
And then it will generate MIC for this specific packet and match the MIC to MIC.
Now, if this MIC matches, it means the PTK is same with the both parties.
In that case, access point will go ahead, install the key for use.
And it will also send a message to the client that, you know, this key is good.
Please go ahead with it.
And then client will also say, okay, I have installed the key and now we can use this key for encrypting the traffic.
And then the encryption starts.
Now, if suppose the access point, if it does not have the same PMK, you know, the passphrase is different for access point and the client, then the PTK will be different.
Because, you know, it depends on PMK, right?
Then the MIC check will fail.
And in that case, access point will reject it and it will not connect.
So this is how the authentication works in WPA four-way handshake.
So again, to reiterate, you have the PF passphrase.
You use PBKDF.
You put it, you gave it SSID name, length, and you generated a pre-shared key.
That is 256 bit in length.
And then from four-way handshake, you get all of this information.
You get S-nones, A-nones, because again, these are transmitted in plain text.
There is no encryption.
And then APMAC and ClientMAC is something that you can easily see.
And from there, you will generate the PTK.
You will use the PTK to encrypt the traffic.
So now, from an attacker's angle, if you want to perform an attack, a dictionary attack to guess the PTK, how you will do it?
You will take a dictionary.
You will take one passphrase from dictionary at one time.
And you will generate the PTK, because obviously, you also need to have this information, which will come from four-way handshake.
Once you have this, you can generate the PTK.
You have a packet from the real access point on client, which has MIC.
You will generate the MAC.
You will generate the MIC.
And then you will compare the MIC.
If MIC is correct, then you have done it.
You have got the right passphrase for it.
So this is how the dictionary attack will work.
Now, look at the information what we need, right?
So all packets will have AP and ClientMAC, because, you know, one is sender, one is a receiver.
A-nonce is going in packet one and packet three.
And S-nonce is going in packet two.
So now, what you can do here is, you can either take all four packets, or you can either take packet one or two.
And you will have all the information that you need to crack WPA2-PSK.
And again, deauthentication, we already talked about it.
It's a packet that you send, you know, you spoof it.
You send it to client from posing as, you know, access point.
If you are sending it to access point, you will pose as, you know, one of the clients.
And then you will tell the other party that, you know, I don't want to be connected to you anymore.
So in that case, the other party will think that this message is being sent by the real party and, you know, it will disconnect.
So this comes handy when you have access point connected with a client and you want this to move so that you can capture the four-way handshake.
Because remember, four-way handshake will only take place when you are connecting to the device first time.
When you are connecting to the access point, only then your client will do the four-way handshake.
If it's already connected, there is no need to do the four-way handshake.
So if we want to capture four-way handshake for our device, which is already connected, we have to do a deauthentication.
So now it's the demo time. We will do this using the same lab.
The principles are very simple. WPA-PSK is using a weak passphrase, which is present in our dictionary.
We will capture the four-way handshake and then we will attack it.
So let's move to the lab.
So let's go to attacking WPA-2-PSK.
Again, you have to select a zone from here.
Prove to this guy that you are not a robot, you are a human.
And then start the lab and wait.
And the lab is ready. We'll follow the same drill.
First, let's check the Wi-Fi interface.
There is a Wi-Fi interface in managed mode and its name is WLAN0.
We'll put it in monitor mode.
Let's check if it is there.
Yes, it is in monitor mode.
Now let's run AeroDump on WLAN0.
And here we can observe that this is the SSID protected network, which is using WPA-2-PSK.
So let's press CTRL-C and move to the next step.
SSID protected network is the one that we want to do the attack on.
So for that, what we want to do is we need to capture the four-way handshake, right?
So it is running on channel 4.
So what we will do, we will run AeroDump packet capture on channel 4 using this command.
And as you can observe, it is now doing that.
If you wait for some time, it will also find the client that is attached to this specific machine.
If you are not able to see it, don't worry.
We will do a broadcast deauthentication on this VSSID and then also it will work.
But, you know, as you can observe here, AeroDump has found one client that is this client connected to this VSSID.
Now, if you remember to capture the four-way handshake, we need to disconnect it, right?
And for that, we are going to use deauthentication packet.
And so we can launch it from the next tab, open a new tab.
You can use the same WLAN0 interface to do this because, you know, you have set WLAN0 on channel 4 and you want to send this packet on channel 4 as well.
So click on this.
And you will see that AeroPlayNG is sending deauthentication packets, 100 packets, to this specific VSSID.
Let's do control-C because I think these are enough.
And let's go back here.
And now what happened when we did this is this guy here, it was disconnected.
And then it reconnected once we stopped the deauthentication attack.
And when it did that, we captured handshake for it.
So now we have handshake.
You can also, you know, run commands on it if you like to.
So you can observe that we have the file, the capture file here.
We also have this specific dictionary here, which we will use to crack it.
So now we can go ahead and try to crack it.
We'll use AeroPlayNG with this dictionary and test-01.cap is the capture file.
So run it. Attack is running.
And we have found the right key.
So the right passphrase is Raspberry.
So with that, this demo is done.
This is how easy it is to attack it if you are using a weak passphrase.
So after WPA2-PSK, now we will talk about WPA2-Enterprise.
We already learned about the shortcomings of WPA2-Personal.
These are not really shortcomings, but it was designed in such a way.
It was designed for personal spaces.
So it was assumed that whoever is using the network, you don't need to hide your information from them.
So that's the reason why same password was there and all the other people on the network had the capability to decrypt your traffic.
But if you want to use this for your enterprise or for your company, this is going to be a problem, right?
Because first thing is this insider threat.
And the second thing is it is difficult to maintain the credentials because everyone is using the same passphrase.
Now, suppose if this passphrase gets leaked, you have to change it.
You have to inform everybody and you have to keep doing this again and again, right?
So for that, these people came up with WPA2-Enterprise.
So in WPA2-Enterprise, instead of using a passphrase, a RADIUS server is used for authentication.
So this RADIUS server will maintain the credential list for all the authorized users.
And then users can use their username, passwords to authenticate with the Wi-Fi.
So it looks like this.
So you have your Wi-Fi client, that is, you know, a laptop or a PC.
And then you have the access point which is connected to the RADIUS server.
So this RADIUS server is the authentication backend here.
And then this is the handshake flow.
So four-way handshake will be there because, again, it's WPA.
But in this case, because there is no passphrase, EAP will be used.
EAP is Extended Authentication Protocol.
So EAP will be used to do authentication with the authentication server, that is, the RADIUS server in the backend.
So your client, after doing the connection ritual, it will send a EAP poll start, which is the first packet.
And then access point will ask it for its identity.
So, you know, if you're using credentials, the username will be the identity.
And this username will be then forwarded to the authentication server.
So after this, the access point, you know, will be in the path, but it's not really doing anything.
Your client and the authentication server will exchange some packets.
And once it is proved to the authentication server that this guy or this client is the real client, it will generate a PMK.
It's randomly generated, and then it will send this PMK to the access point and to the client.
So you can observe the difference from the PSK here.
It is not being generated from the passphrase that was known to both parties.
And after, you know, you have PMK on both the parties, you will do the same four-way handshake and then, you know, data transfer will continue.
Now, the scheme that we are going to talk about in this demo is a PEEP-MSCHAP-V2.
So PEEP stands for Protected Extensible Authentication Protocol.
It is known as protected or it is being referred as protected because all the EAP packets that will be exchanged between your client and your authentication server will go through a TLS tunnel.
So even access point cannot look into it, right, what it is sending.
And then MSCHAP, MS obviously stands for Microsoft, and then CHAP is Challenge Handshake Authentication Protocol.
So it's a challenge response authentication protocol where one party will send a challenge and then the other party will send response and then, you know, they'll verify each other.
So it's like that.
So the user account credentials, the password and the username will be used.
A TLS certificate will be used to create the tunnel and to make sure that the client is connecting to the correct authentication server.
So this is how it looks.
So till here, you can see that the request identity is asked by the RADIUS server or the access point, and then the username is provided.
After that, it requests for the PEEP. RADIUS server is initiating PEEP.
And then a TLS tunnel will be set up.
So this certificate will be sent by the authentication server to the client.
And the client, if it accepts it, after that, it will do the MSCHAP challenge.
So the challenge will be sent by the RADIUS server.
Your client is supposed to provide a response and send it to the RADIUS server.
The RADIUS server will check it. If it is good, then EAP success will be conveyed and the PMK will be shared with the station.
And on the same time, it will also share the PMK with the access point because PTK is the key that will be generated by the station and the access point.
So RADIUS has nothing to do there.
So now if you want to attack it, what are the ways?
So what you can do is, instead of making the client connect to the real access point, you can create your own honeypot or fake access point or evil twin.
And when the client will connect to it, obviously, because you don't have access to the real RADIUS server.
Because if you had that, you could have taken credentials from there, right? You don't have that.
So what you will do, you will emulate a fake RADIUS server.
Which will say yes to all the credentials, right? And then here you are relying on the client that it will provide the real credentials.
But before that, there is a problem with EAP, right? Because there is a TLS tunnel.
And because the certificate that your fake access point or fake RADIUS will send, it will not match the real certificate.
So your client will actually get a warning that this certificate doesn't match or we don't know this certificate.
So at that point, if your client or if your user, he accepts this fake certificate, a non-real certificate, then you are in a problem.
If you don't do this, then you are again safe.
So you can say that this attack is a combination of technical as well as social engineering angles, right?
So we are going to do this attack, but to keep it simple, what we will do instead of creating an evil twin, we will create a honeypot.
So you don't have to do the deauth and all those things.
So for that, we are going to use Hosteo PD Mana Toolkit.
So it's a tool which can be used to create the rogue access point.
It is generally used mainly for the enterprise networks because, you know, it will keep the hassle of creating a RADIUS and all, you know, away from you.
You can directly go, you can fire three or four commands and, you know, you are good to go. You are good to do attack.
So let's go for the demo now.
So here, go for the attacking WPA2 enterprise.
Same drill. You have to select the server. You have to prove that you are a human.
And you might have to solve this, a recapture.
So now the lab is ready.
So let's see what interfaces are there on the lab.
So here we can observe that there are two interfaces, WLAN0 and WLAN1.
Let's put WLAN0 into monitor mode.
And let's run aerodump on it.
So what we can observe here is there is a client which is looking for AMAZE underscore LLC.
So if we go to next step, we will see that the challenge is regarding this only.
A client is probing for AMAZE underscore LLC.
We have to create a honeypot and then we have to steal the credential for it.
And this guy is using peepmschapv2.
So let's do a control C here.
We will also need the fake certificates as we talked about before.
And there you go. We have provided you all the things that you need for this.
If you scroll down.
You will also see the configuration for the hosted PD mana.
So what you have to do here is.
First, you have to create this file.
So I'm using VIM.
VIM is mostly available in most environments, so you can use that.
And let's copy this.
And paste it here.
And you have to format it.
You have to make sure that everything is in separate lines.
Let me do that.
So now I have done the formatting for this file.
Let's go over the configuration file.
So first is the interface.
We are using WLAN1.
SSID is mentioned.
We want to host a honeypot with AMAZE underscore LLC.
And you can choose channel as per your liking.
I have chosen 6 here.
Hardware mode is G, which indicates the 11G.
And then WPA3 means WPA2.
And here we are using management TKE.
Here you can put CCMP.
You can put something else.
So yeah, there's a mistake.
When you put TKCCMP, which means you support both WPA and WPA2-PSK.
And then, you know, for 1X, 1X is the EAP.
And you're also hosting a fake backend server.
And for that, we'll provide a special configuration in this file, which can be then used by our hosted PD Mana.
And here you can observe the certificate, the key.
All of that is provided so that when the tunnel forms, you know, the setup can get the information and then show us what it is.
Mana EAP success actually signifies that doesn't matter what kind of credentials the user provides, we will always tell him that these are the correct ones.
So this file is done.
Let's create the second file.
Let's move a little low and copy it from here.
Paste it.
So to know more details about these configurations, I'll suggest you visit hosted PD Mana's GitHub page.
The link to the documentation is also given here.
So check that out.
You will be able to understand these better.
So this configuration will make sure that doesn't matter what kind of scheme or what kind of method your EAP is using.
It will support it, even if it is a PEEP or a TTLS or TLS, or even if it is using MSCHAP or GTC or something inside.
So all of that will be supported.
So it's a catch all kind of thing.
So once it is done, we can move forward and we can launch this to start our honeypot.
So what we can observe here is on interface WLAN1, we have created a maze underscore LLC SSID.
Here, what we are observing is a client which was roaming has tried to connect to this, you know, access point.
And in that process, we are able to see the information that it was passing.
So if you remember, we talked about CHAP, right?
The challenge response.
So here, hosted PD Mana is actually giving us the challenge, the response so that we can crack it.
And the username here is Sean.
So this is the command that we need to use with asleep to crack it.
So if we move down, we have actually written this command for you.
Let's clear the screen a little bit.
And let's run this command.
So what we did here is because we had the challenge and the response captured, we used a dictionary file that is given here.
And from that, we recovered the password for it.
The password is chocolate in this case.
So this is how using a honeypot, you can attack enterprise networks, the WPA2 enterprise in this case, which was using a PMS CHAP version 2.
The attack will work similarly for the other schemes as well.
So with this, we are going to conclude this workshop.
I hope you learned about the basics of Wi-Fi and schemes and how to attack them.
And if you face these in real world or in a CTF somewhere, you will be able to solve it.
So with that, thanks again for attending our workshop in Wireless Village.
We also thanks Wireless Village and the DEF CON team to make all of this possible in this tough time.
It doesn't matter how bad it is.
The learning should continue.
And with that, I'll say thanks.
If you have any follow up questions, any comments, any feedbacks, here's my email ID.
You can drop me a mail and I'll try to help you out.
Thank you.