Hey my school has a locked wifi and it comes up as 802.1x peap on my android. I cant find any tutorials or anything exept really outdated stuff so could someone help with this?
802.1x peap hacking? |
Yayyy some Radius excitement. Seems your school is on the right track, but to my knowledge there is no direct way to hack "PEAP". There are ways to break it down but these methods seem to revolve around MITM and client side exploitation. That being said there isn't much to play around with, you will have to luck up and hope that TTLS protocol and certificates are improperly implemented. Improper cert usage would be either the school using a self signed certificate with the radius server, misconfiguration of clients to check for a certificate, & use of cert from a CA that has an improper RA function. A common attack is setting up a fake AP with a backend radius, capturing mschap challenge/response authentication packets with ASLEAP, and using hashcat or JTR to crack the hashes. There are other attacks but this all depends on how the radius is configured, you will have to do some digging around, as there are numerous of write ups and tutorials on EAP-LEAP-PEAP, ASLEAP, Radius, etc all over the wild.
Regards, -Gator- (Sep 11, 2014 10:34 AM)sp3ctrum Wrote: Yayyy some Radius excitement. Seems your school is on the right track, but to my knowledge there is no direct way to hack "PEAP". There are ways to break it down but these methods seem to revolve around MITM and client side exploitation. That being said there isn't much to play around with, you will have to luck up and hope that TTLS protocol and certificates are improperly implemented. Improper cert usage would be either the school using a self signed certificate with the radius server, misconfiguration of clients to check for a certificate, & use of cert from a CA that has an improper RA function. A common attack is setting up a fake AP with a backend radius, capturing mschap challenge/response authentication packets with ASLEAP, and using hashcat or JTR to crack the hashes. There are other attacks but this all depends on how the radius is configured, you will have to do some digging around, as there are numerous of write ups and tutorials on EAP-LEAP-PEAP, ASLEAP, Radius, etc all over the wild.Ok thanks I'm going to look around for some shit about this! :D |
|
|
