WPA2-Enterprise¶
- Authentication: 802.1X/EAP (e.g., PEAP-MSCHAPv2, EAP-TTLS, prefer EAP-TLS)
- Cipher: AES-CCMP
Vulnerabilities¶
Evil-Twin / Credential Theft¶
Attack succeeds primarily when clients fail to validate the RADIUS server certificate (wrong CA, CN/SAN mismatch, or user click-through). Misconfigurations are common.
If PMF is not enabled, spoofed deauth/disassoc frames can force roaming to the evil-twin. PMF blocks this coercion but does not prevent pre-association beacon/probe spoofing.
EAP Types and credentials to capture:¶
PEAP-MSCHAPv2
- Weak, crackable password‑based inner method (MSCHAPv2).
- Typically consists of AD credentials.
EAP-TTLS (inner PAP/GTC)
- The cleartext PAP/GTC token can be captured.
- PAP are immediately usable. Typically AD credentials.
- GTC are typically OTP and should be used immediately.