Wireless Pwnage Edition

What does this do and how does it work?

This setup makes use of Hostapd-WPE (Wireless Pwnage Edition) which is a modified version of the standard hostapd (Host Access Point Daemon) tool. It allows to set up a rogue access point which mimics legitimate Wi-Fi networks, tricking clients into connecting with it and allows to capture their authentication credentials which are sent within the clients connection attempt.

Modern wireless clients (laptops, smartphones, tablets) attempt to maintain seamless connectivity by continuously probing for known Wi-Fi networks in their saved list. When a device is not connected to Wi-Fi, it will periodically send probe requests asking if any of its previously connected networks are available. This behavior allows them to automatically connect when a familiar network is in range, without user intervention. In combination with a tool like Hostapd-WPE this allows to cause clients in range to connect and even when the authentication fails from the clients view, it still allows to monitor the attempted handshake and obtain the contained authentication credentials.

This works as hostapd-WPE can be configured to respond to all probe requests with an "available" response, effectively making the client think the requested SSID is in range.

Many clients, depending on their security settings, will automatically attempt to connect to the AP, believing it to be the legitimate network.

The captured authentication attempts can then be used for offline password cracking.

Note: This method only works on clients which use a lower version than WPA3 as encryption protocol, like WPA2 or WPA.

As prerequisite the host which is used to run the scripts needs two Wi-Fi network cards. One is used to run Hostapd-WPE and needs to support AP mode. The other is used to monitor the connection attempts and to record the authentication handshakes, requiring monitor mode. The supported modes for a Wi-Fi network card chipset can be checked with the command "iw list".

The script "wpe" launches Hostapd-WPE in karma mode, making use of the client behaviour explained above.

The script "mon" is used to launch the monitoring mode with one of the network cards, recording all captured connections in a pcap file which can then be used for extracting the credentials.

Usage

The script wpe is used to start the imitating AP on one interface. The interface needs to be set as option.

sudo ./wpe -i wlan0

The script mon can then be started simultaniously while the wpe script is still running. It captures connection attempts and writes them to a capture file. An interface needs to be given as option and it needs to be a different interface used for the wpe script.

sudo ./mon -i wlan1

Both scripts need the configuration file hostapd-wpe.conf either in the same directory or the default in /etc/hostapd-wpe/.

Processing a capture file

When monitoring Wi-Fi connections the resulting captured data is saved to a pcap file, numbered by the times the tool was run, so for the first run "wpa-01.cap".

Various tools can be used to process the captured data, optionally making use of various wordlists which, depending on the host system, available in the directory /usr/share/wordlists.

Examples:

aircrack-ng with a simple wordlist:

aircrack-ng -w /usr/share/wordlists/wifite.txt wpa-01.cap

Convert the capture for the use with the tool John the Ripper:

aircrack-ng wpa-01.cap -J wpa &&
hccap2john wpa.hccap > wpa.john &&
john -w=/usr/share/wordlists/john.lst -form=wpapsk wpa.john

Convert the capture for the use with the tool Hashcat:

sudo apt -y install hcxtools &&
hcxpcapngtool -o wpa.hccapx wpa-01.cap &&
hashcat -m 22000 -a 0 wpa.hccapx \
/usr/share/wordlists/rockyou.txt.gz