Original subtitles

1

Okay so far we know WPA enterprise is an authentication method that can be used with WPA or WPA to networks.

2

So it uses encryption and it each user have to use their own unique username and password to authenticate

3

and connect to the network.

4

And we said all of this is managed using a radius or a central server.

5

Now let me show you an example of a network that uses WPA enterprise just so you get an idea of how

6

it works.

7

So if I go to Wi-Fi here you'll see that I have a network here called company network.

8

If I try to connect to this you'll see it won't even try to establish a connection.

9

The first thing that it's going to do is it's going to ask me to enter a username and password.

10

Now the same happens here if I go to an OS X machine.

11

So if I just connect to it in here you'll see that I'm going to be asked for a username and password.

12

The only difference is the log in box looks a little bit different.

13

Now if you think of the idea it's very similar to what happens with captive portals it's just implemented

14

in a much more secure manner as shown before.

15

Captive for tools also ask the users to enter a username and password.

16

And if they're correct they'll allow them to use the password.

17

The only difference is captive portals are open networks.

18

They do not use any encryption.

19

Therefore we were able to go in monitor mode sniff all the data and if a user authenticates will be

20

able to capture their username and password.

21

Not only that because it's an open network we were able to connect run an AARP spoofing network redirect

22

the flow of packets through our computer.

23

And that way we were able to read the usernames and passwords as well.

24

Now both of these methods will not work with WPA enterprise enterprise first because like I said it

25

uses encryption.

26

Therefore even if we go in monitor mode and sniff data that the data is going to be encrypted and because

27

we don't have the key then we won't be able to find the passwords that's entered by the users.

28

The other problem because as we see in we can't connect to the network without having a key.

29

Therefore we can't run an IP spoofing attack because we can only do that attack after we connect to

30

the network.

31

Therefore both of these methods are useless against WPA enterprise.

32

And the only way to attack it is use in an evil to an attack.

33

Now there are two ways to do that.

34

You can create a traditional evil IP just like I showed you before.

35

The only thing is you want to make sure that the log in page that you automatically display to the person

36

when they connect.

37

Looks like a logon box because with captive portals We've seen by default users log in use a page using

38

the hashtag M-L web page with this.

39

We've seen that in Windows.

40

You get you have to log in here and OS X you get a box or log in box like this one.

41

So you're going to have to fool your target to think the DML page is what they usually use with OS X

42

that this might be easier because like we've seen with captive four toes.

43

OS X will still show in the hasty M-L page inside the window.

44

So you'll just have to style your fake log and page a little bit to make it look like a system log and

45

box when it comes to Windows.

46

It's going to be a little bit more challenging because as we see in Windows automatically opens the

47

log in page and the default web browser.

48

So the user will feel that there is something suspicious in there.

49

Another problem you'll see in here you can see that it says secured.

50

Also and OS X if you look at the network name here on the top you'll see there is a lock beside it.

51

Now as you remember when we were creating our fake access point it has to be an open network so they

52

can connect to it and then authenticate.

53

Therefore the traditional method of doing this is good but it might not fool all users.

54

The advantage of this method is that the user is going to send the passwords through the DML form which

55

is sent in our fake log in page and therefore it will be very easy for us to capture it and read it.

56

As I showed you before now executing this method is identical to target in a captive portal.

57

So I covered all of these steps before in details and therefore I'm not going to be covering it in here.

58

I'm just simply mentioning that you can actually use that method to target this type of networks.

59

What I'm going to show you though the next method which is a little bit more advanced now this is also

60

an evil twin attack will be also creating a fake access point but will actually configure this access

61

point to use WPA enterprise.

62

So when the user connect to it they'll get a log and box a system log in box.

63

So in Windows they'll get something like this in OS X.

64

They'll get something like this but once they put the password obviously the password will be sent to

65

us because we will be running the radius server the central authentication server that I was talking

66

about.

67

And that way it will be much easier to fool your target to connect to your network because these networks

68

are usually used in large enterprises.

69

So again like I said similar to fake access points the users are used to connect to a number of routers

70

and are used to see a number of routers around them.

71

So what we'll be doing is we will be authenticating them from the router and we'll be creating a router

72

that looks identical to the router it's going to have the same name.

73

It's going to be used in the exact same configuration that so they'll be logging in.

74

Exactly the same way that they usually log in.

75

Therefore they're not going to be suspicious of the whole process.

76

The only problem with this method is the data sent to us or the password is going to be encrypted and

77

therefore will actually have to use a wordlist attack to try and crack this password.

78

Now in the next lectures I'm going to talk in details about how to execute this attack how to create

79

a fake access point with WPA enterprise.

80

And I'll also be discussing why the password is going to be encrypted and how to decrypt it.