is that even possible ?!!

[minanagehsalalma]

can this method if it been optimized .... show the clear password or decrypt the encrypted password with some sort of mastery key??
https://www.youtube.com/watch?v=HoihKhQWZ7k&feature=youtu.be

[decidedlygray]

Nope

[minanagehsalalma]

@decidedlygray nope on what ?

[minanagehsalalma]

@decidedlygray bro please ....

[decidedlygray]

Hello there - my response was answering the question in the title of the issue “is that even possible ?!!”

As far as I know, nope, that is not possible when doing the “evil twin” type of attack.

The author of that video maybe set up their own access point and configured it to log credentials in the clear? But as far as I know, on a typical pentest, when you’re mimicking a standard 802.11 AP the best you can get is hashed credentials. The reason that is probably not useful is: what credentials would a user put into a random, untrusted AP? Probably not anything you want

[decidedlygray]

If you are looking to log cleartext credentials, you may want to look into a captive portal tool, like https://github.com/s0meguy1/RougeWifi/

[minanagehsalalma]

@decidedlygray you mean that this will not work on 802.11 because there is username and password fields ? If so ... Can the user name field be removed ?!! I know it's a Sally question ..

[minanagehsalalma]

And the rouge WiFi link you have sent ... This not what I was talking about.. I want to log a cleartext credentials with a rouge WPA enterprise ap .... I think the video is possible that he used peap algorithm... ?

[minanagehsalalma]

@decidedlygray I mean how can configurat hostapd-wpe to use PAP ??!
Please answer me
Thanks,

[minanagehsalalma]

@decidedlygray hi bro what is your answer ?

[decidedlygray]

Usually RADIUS servers use a protocol that involves challenge-response authentication, so the password isn't actually sent in a way that is easily recoverable.

However, there is an old attack that involves setting up a man-in-the-middle and using PEAPv1-GTC that may be what you're looking for. Some slides from a DEFCON talk a few years ago can be found here: https://www.defcon.org/images/defcon-21/dc-21-presentations/djwishbone-PuNk1nPo0p/DEFCON-21-djwishbone-PuNk1nPo0p-BYO-Disaster-Updated.pdf

The tool to do the attack, mentioned in those slides, can be found here: https://github.com/edthamm/lootbooty/ (the module is: https://github.com/edthamm/lootbooty/blob/master/modules/peapingtom.rb)

In theory, this functionality might be able to be integrated into hostapd-wpe in the future (not sure how hard to is to patch hostapd's radius server?), but as far as I know it is not currently supported.

[minanagehsalalma]

ok thanks .. i will try it after exams and tell you the results (^-^)

…

On Tue, May 1, 2018, 9:17 PM Decidedly Gray ***@***.***> wrote: Usually RADIUS servers use a protocol that involves challenge-response authentication, so the password isn't actually sent in a way that is easily recoverable. However, there is an old attack that involves setting up a man-in-the-middle and using PEAPv1-GTC that may be what you're looking for. Some slides from a DEFCON talk a few years ago can be found here: https://www.defcon.org/images/defcon-21/dc-21-presentations/djwishbone-PuNk1nPo0p/DEFCON-21-djwishbone-PuNk1nPo0p-BYO-Disaster-Updated.pdf The tool to do the attack, mentioned in those slides, can be found here: https://github.com/edthamm/lootbooty/ (the module is: https://github.com/edthamm/lootbooty/blob/master/modules/peapingtom.rb) In theory, this functionality *might* be able to be integrated into hostapd-wpe in the future (not sure how hard to is to patch hostapd's radius server?), but as far as I know it is not currently supported. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#20 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ATmETo9emi4Lrl2I5C8xo_NeS_2pFwjUks5tuKangaJpZM4TLkrZ> .

[W00t3k]

You can use this method without having to install lootbooty/freeradius - https://twitter.com/W00Tock/status/1019251419310972930

[minanagehsalalma]

@W00t3k can you type the full steps to do this here ?!
Thanks BTW ...
it will be great if you have a video showing this in it !!

[W00t3k]

I can put all the hostapd knowledge into a blog, I don't usually do video stuff. The blog will give you step by step instructions.

[minanagehsalalma]

@W00t3k OK that's Great !!! But don't forget to tell me when you are done 😀😀😀😀