The reason I don't think this would work is because no one knows their wifi password.
I think "Phase 3" is indeed too much. I would think this tool would be more useful for "simple" MITM than for PSK phishing.
Wifiphisher: Fast automated phishing attacks against WPA networks
41–50 of 58 posts
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#42This looks really cool. However, when I first read the words "social engineering", I expected it to create another access point encrypted the same way , and get the code direct from the victim. This way seems less fool-proof. Is my suggestion at all possible, or is the code transmitted while connecting useless unless you already have it? (Well it's not useless , as it can be brute-forced by aircrack-ng locally. I'm w…
The code is never trasnmitted. The data is encrypted with the code and only the code on the other side can be used to decrypt it. Most brute-force systems work by capturing packets to hard drive and then attempting to decrypt them offline. Or you can upload your captures to the cloud: https://www.cloudcracker.com/
What about setting up a WEP access point to impersonate the WPA one, then getting the password from that? Still seems more likely to work than what it's doing now.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#43https://xkcd.com/416/ looks better, anyway :)
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#44Why does this require a specific linux dist?
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#45Earlier quoted context omitted.
WPS makes stealing the WPA PSK as trivially easy as WEP. Basically, WPS protects the WPA key with a 7-digit PIN - cracking that PIN is enough to authenticate with the router and have it provide the encryption key. It seems like this should be easy to defend against, but everything I've ever read about WPS says no one seems to be putting any such protections in place. http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup…
>WPS protects the WPA key with a 7-digit PIN - cracking that PIN is enough to authenticate with the router and have it provide the encryption key. Not only that, but routers verify the first and second halves of the PIN separately. So instead of brute forcing in a keyspace of 10000000, you only need to find one number up to 10000, and a second number up to 1000. (The second half of the PIN is actually a 4-digit numbe…
I've also read that if you have the pin, you can get the password even after WPS is turned off, which means it's a permanent pwn.
Random comment I read somewhere, so may not be reliable.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#46This is misleading. When using WPA the client and access point perform mutual authentication. This means that if you don't know the password, you cannot set up a rogue access point that "copies the target access point's settings". Because you don't know the password! And if you'd use a random password, the client will refuse to connect to the rogue AP. The tool is actually creating a second, unencrypted network. On W…
Or setup an exact replica of the targeted device's (WPA-protected) home AP, and then tunnel the raw encrypted 802.11 frames back to that AP over the Internet. Ta-da - your target now has absolutely seamless remote access to their own home Wi-Fi, with mutual authentication and end-to-end hardware accelerated AES encryption. :P
Only "drawback" (if you're of a malicious nature) is that you can't do any evil. The only thing you'll see is the raw encrypted Wi-Fi traffic, flowing straight through your "rogue AP" and into the Wi-Fi over IP tunnel. :)
Disclaimer: That's what http://anyfi.net does and I'm on the team that built it.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#47Earlier quoted context omitted.
WPS makes stealing the WPA PSK as trivially easy as WEP. Basically, WPS protects the WPA key with a 7-digit PIN - cracking that PIN is enough to authenticate with the router and have it provide the encryption key. It seems like this should be easy to defend against, but everything I've ever read about WPS says no one seems to be putting any such protections in place. http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup…
WPS push button and WPS PIN are two separate features. If you only have WPS Push Button enabled you are not vulnerable.
But WPS PIN is the default, mandatory WPS method. WPS Push Button is an optional part of the spec.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#48This is misleading. When using WPA the client and access point perform mutual authentication. This means that if you don't know the password, you cannot set up a rogue access point that "copies the target access point's settings". Because you don't know the password! And if you'd use a random password, the client will refuse to connect to the rogue AP. The tool is actually creating a second, unencrypted network. On W…
agree. However it is a crafty mix between a classic attack (the deauth-part) and social engineering (the password part).
The KARMA way is more elegant, however you still might have to crack the actuall pre-shared key. I'd put it in as another helpful tool that might ease your pentest approach, besides Reaver, maybe.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#49My network connection security setting is 'WPA & WPA2 Personal'. This works on WPA but apparently not on WPA2. Will this attack work on my wifi?
Yes, Because it generates and unecrypted wifi with the same SSID as your access point. If you connect to that, it will server you the site and you enter your "password" wich is actually your WPA/WP2 Pre Shared Key.
If you want to be save against this special kind of attack, you could use a RADIUS-based authentification, where every user gets a certificate and Username/Password instead of one general shared key.
It is a little tricky, but if you are running a NAS from a vendor like synology or qnap you could use their RADIUS packages to set it up.
Re: Wifiphisher: Fast automated phishing attacks against WPA networks
#50Earlier quoted context omitted.
The code is never trasnmitted. The data is encrypted with the code and only the code on the other side can be used to decrypt it. Most brute-force systems work by capturing packets to hard drive and then attempting to decrypt them offline. Or you can upload your captures to the cloud: https://www.cloudcracker.com/
What about setting up a WEP access point to impersonate the WPA one, then getting the password from that? Still seems more likely to work than what it's doing now.
You'd still need the Pre-Shared key to create a legitemate looking access point, so it is kind of a catch-22.
WPA/WPA2 as a system is actually not that bad (for home use).