Wifiphisher: Fast automated phishing attacks against WPA networks
1–10 of 58 posts
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#2I wondered why the deauth in step 1 works, it sure looks like that's one of the shortcomings in WPA and there is just no workaround - except going with WPA2.
http://security.stackexchange.com/questions/20219/preventing...
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#3I don't see how this tests the security of a setup if it is relying on a user submitting the password themselves. There is no way to protect against your own or the stupidity of others.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#4I don't see how this tests the security of a setup if it is relying on a user submitting the password themselves. There is no way to protect against your own or the stupidity of others.
Where does it say that this is testing the security of a setup?
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#5I don't see how this tests the security of a setup if it is relying on a user submitting the password themselves. There is no way to protect against your own or the stupidity of others.
A reasonable use case would be demonstrating the weakness of a naive setup to a business that wanted to charge for access.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#6My network connection security setting is 'WPA & WPA2 Personal'. This works on WPA but apparently not on WPA2. Will this attack work on my wifi?
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#7This looks really cool. However, when I first read the words "social engineering", I expected it to create another access point encrypted the same way, and get the code direct from the victim. This way seems less fool-proof.
Is my suggestion at all possible, or is the code transmitted while connecting useless unless you already have it? (Well it's not useless, as it can be brute-forced by aircrack-ng locally. I'm wondering if what's transmitted is like a hash of the passphrase, which isn't useful, or encrypted with a one time key sent by the access point, in which case my idea is much better.)
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#8My network connection security setting is 'WPA & WPA2 Personal'. This works on WPA but apparently not on WPA2. Will this attack work on my wifi?
[deleted]
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#9This looks really cool. However, when I first read the words "social engineering", I expected it to create another access point encrypted the same way , and get the code direct from the victim. This way seems less fool-proof. Is my suggestion at all possible, or is the code transmitted while connecting useless unless you already have it? (Well it's not useless , as it can be brute-forced by aircrack-ng locally. I'm w…
The key (nor a hash of the key) is sent over the air. It's a challenge. Since both sides should know the key they can challenge each other by saying things like "encrypt the word 'horse' using our secret key" ... then they can compare the result.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#10This looks really cool. However, when I first read the words "social engineering", I expected it to create another access point encrypted the same way , and get the code direct from the victim. This way seems less fool-proof. Is my suggestion at all possible, or is the code transmitted while connecting useless unless you already have it? (Well it's not useless , as it can be brute-forced by aircrack-ng locally. I'm w…
The code is never trasnmitted. The data is encrypted with the code and only the code on the other side can be used to decrypt it.
Most brute-force systems work by capturing packets to hard drive and then attempting to decrypt them offline. Or you can upload your captures to the cloud: https://www.cloudcracker.com/