WPA/WPA2 Enterprise Hacking: Rogue RADIUS & EAP Exploitation
Vivek Ramachandran and Thomas Dotreppe demonstrate weaponizing rogue RADIUS access points to exploit WPA/WPA2 Enterprise PEAP and EAP-TTLS networks.
Summary
The Enterprise Wi-Fi Trust Model
Corporate 802.11 networks utilize WPA/WPA2 Enterprise (802.1X) to authenticate individual users against central RADIUS servers via EAP protocols.
Building Rogue AP Honeypots with FreeRADIUS-WPE
Vivek Ramachandran and Thomas Dotreppe demonstrate deploying rogue access points configured with patched FreeRADIUS-WPE daemons.
Harvesting and Cracking MSCHAPv2 Hashes
The authors show how victim devices connect to rogue APs and submit MSCHAPv2 challenge responses, which attackers capture and crack offline using hashcat.
Enforcing Certificate Validation and EAP-TLS
The presentation details defensive wireless profiles, mandatory server certificate validation, and transitioning to certificate-based EAP-TLS authentication.
Related talks
Village Interviews·1 min
A rapid spotlight on the Maritime Hacking Village exploring shipboard control networks, satellite navigation, and vessel cybersecurity at DEF CON 34.
Car Hacking Village·24 min
Vlad Gostomelsky
GPS spoofing attacks against vehicle navigation and autonomous systems.
Village Presentations·1 hr 4 min
Wireless Warrior
Wireless Warrior analyzes military Low Probability of Intercept (LPI) and Detection (LPD) radio techniques, demonstrating stealthy amateur RF designs.