WPA

• Authentication: PSK
• Cipher: TKIP/RC4

Vulnerabilities

4-Way Handshake Capture

• Listen for clients to connect to the WiFi AP and capture the 4-way handshake to decrypt it and recover the AP's PSK.
• Exploitation:
  • Automated Attack
  • 4-Way Handshake Capture

Clientless PMKID Capture

Vulnerable routers will include the PMKID in the first EAPOL frame it sends an associating client. The PMKID can be cracked to discover the PSK

• Exploitation:
  • Automated Attack
  • Clientless PMKID Capture

Reference

• New attack on WPA/WPA2 using PMKID - https://hashcat.net/forum/thread-7717.html

WPS Weaknesses

• Online PIN bruteforce
  • Requires weak lockouts on PIN attempts.
• "Pixie Dust" - Offline PIN recovery
  • Capture WPS M1/M2/M3 exchange packets and crack offline.
  • Exploitation: See "Pixie Dust" - Offline PIN recovery
• Weak/default PIN algorithms
  • Some vendors use predictable PIN algorithms.