Original subtitles

1

In this lecture and in the next few lectures I'd like to talk about WPA enterprise.

2

What it is how it works and how to market.

3

Now all the networks that we've seen so far in this course and in my other hacking courses whether they're

4

WPA or WPA to networks all of them were used in a form of authentication called DSK case stands for

5

pre-shared key.

6

And what we mean by that is there is one shared key that any device that want to connect to the network

7

can use and they'll get access to the network.

8

So there is one key in the network that key is shared between all the clients all the devices that want

9

to connect to the network.

10

And if you have that key then you can authenticate and connect to the network.

11

Now because this is a very simple concept the router manages the authentication in this case because

12

we only have one key.

13

So whenever a client wants to connect to the network they have to give that one specific key.

14

And if that key is correct the router will allow the client to access the network or the internet.

15

If not then theyll just refuse them and not even give them an IP address.

16

Now WPA enterprise is another form of authentication.

17

So we have a fire escape which is pre-shared key authentication and we have another form of authentication

18

called WPA enterprise.

19

Now as the name suggests it's designed for bigger and larger networks.

20

It's usually used in large organizations such as Big companies universities and so on.

21

The idea behind this is each user that wants to connect to the network needs to have their own username

22

and their own password.

23

So there is no shared key.

24

Each client has to have their own key to connect to the network.

25

Now this is actually a more secure implementation and it has a lot of advantages.

26

First of all it's more secure because each user will have a unique key so their traffic will also be

27

encrypted using this unique key and it's more practical because if you want to deny a certain user from

28

connecting you won't have to change the one password.

29

You'll just have to remove their password from the authentication server.

30

That because of this idea and the implementation the router cannot handle this.

31

And we usually use a central server for authentication.

32

Now the central server is very handy because we can add users and prevent users from connecting to the

33

network without having to change the password for the whole network.

34

So one use an MP a pre-shared key if we wanted to prevent a certain user or if we wanted if we thought

35

that our password got stolen.

36

Then we have to change the password and then we have to give the new password to all of the users that

37

we want to allow to connect to the network and the WPA enterprise case.

38

We don't have to do that if we think up certain passwords stolen or if we want to prevent a certain

39

user from connecting then we can just modify our central server there as Radius server and remove the

40

password that we don't want to allow on our network.

41

Now WPA enterprises also considered to be more secure because like I said each user get their own key

42

and their traffic is encrypted using their own unique key.

43

Whereas in S-K in the pre-shared key authentication all the traffic through the network will be encrypted

44

using the one single shared key.

45

So regardless of the user they'll all be using the same exact key.

46

So right here I have a diagram of the way WPA enterprise usually configured.

47

Now the access point will not be handle and authentication.

48

Like I said.

49

So the client is going to use some sort of authentication usually a username and password.

50

It's going to send it to the access point the access point will not do any form of verification.

51

It literally just forward that to the radius server the radius server is the brain or is the entity

52

that decides whether this form of authentication is correct or not.

53

If the username and password are correct it's going to tell the access point.

54

OK.

55

These are correct.

56

Allow this device to access the resource whether it's the Internet or the network.

57

So the access point is going to assign an IP address to this computer and allow it to access the network.

58

Therefore when we want to add new users or prevent users from connecting all we have to do is just modify

59

our server here and remove the users that we we don't want them to connect.

60

Now WPA enterprise uses and Orphic authentication protocol called EAP.

61

But there are other implementations that you might face like EAP first L AP anti-alias.

62

Now I'm just trying to give you a basic understanding of what we mean by WPA enterprise and how it works.

63

And in the next lecture we're going to discuss how we can hack this and gain access to networks that

64

use this form of authentication.