📝
Home
Pentesting
  • 📝Home
  • ⚒️PENTESTING
    • Foundational
      • Gaining Access
      • Session Hijacking
      • Buffer Overflows
        • Finding the Offset
        • Spiking
        • Fuzzing
      • Attack Basics
        • Brute Force Attacks
        • Credential Stuffing and Password Spraying
        • Netcat Shell Stabilization
        • Reverse Shells vs Bind Shells
        • Staged vs Non-Staged Payloads
      • Footprinting
    • Reconnaissance
      • Discovering Email Addresses
      • Hunting Subdomains
    • Scanning and Enumeration
      • Banner Grabbing
      • Enumerating HTTP and HTTPS
      • Enumerating SMB
      • Enumerating SSH
      • NetBIOS Enumeration
      • SNMP Enumeration
      • Sniffing
    • Privilege Escalation
      • 🐧Linux Privilege Escalation
      • 🪟Windows Privilege Escalation
        • Initial Enumeration
    • Defense Evasion
      • Hiding Files and Covering Tracks
      • Network Evasion
    • Attacking Services
      • Attacking Kerberos
      • Attacking VPNs
      • Denial of Service
      • Exploiting FTP
      • Exploiting NFS
      • Exploiting SMTP
      • Exploiting Telnet
    • Attacking Active Directory
      • Initial Attack Vectors
        • Gaining Shell Access
        • LLMNR Poisoning
        • SMB Relay
        • Passback Attacks
        • IPv6 Attacks
      • Post-Compromise Enumeration
        • Bloodhound
        • ldapdomaindump
        • PowerView
        • PlumHound
      • Post-Compromise Attacks
        • GPP Attacks
        • Print Nightmare
        • Token Impersonation using Incognito
        • URL File Attack
        • Pass Attacks
        • Kerberoasting
        • LNK File Attacks
        • Mimikatz
      • Post-Domain Compromise Attacks
        • Dumping the NTDS.dit
        • Golden Ticket Attacks
      • Post Exploitation
    • Toolkit
      • Burp Suite
        • Intruder
      • Hping
        • Crafting TCP and UDP Packets
      • Metasploit
        • Meterpreter
        • Shell Handler
        • Gather Information
        • Gaining Root
    • Web Application Hacking
      • Attack Methodology
      • Attacking Web Applications
      • Authentication Bypass
      • Cross-Site Scripting
      • Cross-Site Request Forgery
      • File Inclusion
      • Server-Side Request Forgery
      • Injection
        • Command Injection
        • LDAP Injection
        • SQL Injection
  • 👽MALWARE ANALYSIS
    • Malware Analysis Primer
    • Malware Types
      • Rootkits
      • Viruses
      • WannaCry
    • Analyzing Malicious Windows Programs
    • Static Analysis
      • Basic Static Techniques
      • Advanced Static Analysis
    • Reverse Engineering
      • Crash Course in x86 Disassembly
      • Recognizing Code in Assembly Language
    • Dynamic Analysis
    • Detecting Malware
      • Evasion Techniques
      • Detecting Mimikatz
      • Hunting Malware
      • Hunting Metasploit
      • Hunting Persistence
  • 🏹THREAT HUNTING
    • Foundational
      • ATT&CK Framework
      • CIA Triad
    • APTs
  • 🐍PROGRAMMING & SCRIPTING
    • Foundational
      • Computer Memory
    • C Programming
    • Assembly Language
      • Assembly File Structure
      • Debugging with gdb
    • Bash
    • Python
      • Foundational
        • Booleans and Operators
        • Comprehensions
        • Conditionals
        • Dictionaries
        • Exceptions and Error Handling
        • Functions
        • Lambdas
        • Lists
        • Loops
        • Modules
        • Numbers
        • Reading and Writing Files
        • Sets
        • Sockets
        • String Formatting
        • Tuples
        • User Input
        • Variables
      • Extending Python
        • Virtual Environments
        • Sys Module
        • Requests
        • pwntools
    • Regular Expressions
    • SQL
  • 🕵️DIGITAL FORENSICS
    • Anti-Forensic Techniques
    • 🪟Windows Security Internals
      • Windows Security Internals
        • Kernel
          • Security Reference Monitor (SRM)
          • Object Manager
            • System Calls
            • NTSTATUS Codes
            • Object Handles
            • Query and Set Information System Calls
          • The I/O Manager & The Process and Thread Manager
          • The Memory Manager
          • The Configuration Manager
  • 💼GRC (CISSP Notes)
    • Security Assessment and Testing
    • Security Governance Principles
    • Security Policies Standards and Procedures
    • Preventing and Responding to Incidents
    • Organizational Roles and Responsibilities
    • Organizational Processes
  • 📦Networking
    • Foundational
      • DHCP
      • DNS Basics
      • HTTP Protocol
      • IPSec
      • IPv6 Fundamentals
    • Wireless Technologies
      • 802.11
      • Bluetooth
      • Wireless Authentication
      • Wireless Encryption
Powered by GitBook
On this page
  • WEP
  • Wi-Fi Protected Access (WPA / WPA2)
  1. Networking
  2. Wireless Technologies

Wireless Encryption

WEP

  • Main Goals

    • Confidentiality: prevents link-layer eavesdropping

    • Access Control: determines who may have access data

    • Data Integrity: protects the change of data by a third party

    • Efficiency

  • Flaws

    • Doesn't encrypt anything

      • No defined method for encryption key distribution

      • pre-shared keys are set once and not changed

      • Easy to recover plaintext messages encrypted with same key

    • RC4 algorithm

    • Created without academic, cryptologic or public review

  • Three options

    • 40-bit

    • 128-bit (104-bit key)

    • 232-bit (232-bit key)

  • Uses an initialization vector (IV)

    • provides for confidentiality and integrity

    • calculates a 32-bit integrity check (ICV) and appends it to the end of the data payload and then provides a 24-bit IV

    • Combined with a key to be input into an RC4 algorithm

    • Very easy to crack

      • relatively small

      • reused frequently

      • sent in clear text

Wi-Fi Protected Access (WPA / WPA2)

  • Uses Temporal Key Integrity Protocol (TKIP) (128-bit key) and the client's MAC address to accomplish much stronger encryption

  • the key is changed every 10,000 packets or so

  • Keys are transferred back and forth during an Extensible Authentication Protocol (EAP) authentication session

    • Uses a four-step handshake process to prove the client belongs to the AP

  • WPA2

    • can be tie EAP or a RADIUS server into the authentication side

    • Uses Kerberos tickets and other offerings

    • Uses Cipher Blocking Chaining Message Authentication Code Protocol (CCMP) to ensure integrity of the message during transit

    • The four-way handshake establishes a nonce (one time-use shared secret for the communication session)

  • Not easy to crack

Wireless Standard

Encryption Used

IV Size (Bits)

Key Length (Bits)

Integrity Check

WEP

RC4

24

40/104

CRC-32

WPA

RC4+TKIP

48

128

Michael Algorithm + CRC-32

WPA2

AES-CCMP

48

128

CBC-MAC (CCMP)

PreviousWireless Authentication

Last updated 1 year ago

📦