Wi-Fi Brokering
summary
Demonstrates a working toolchain that relays PEAP/MS‑CHAPv2 instead of cracking hashes: a rogue AP using hostapd‑mana hands inner MS‑CHAPv2 exchanges to a modified wpa_supplicant (sycophant) which relays to a real RADIUS/server via responder/ntlmrelayx, performs two TLS tunnels and separate 4‑way handshakes but a single MS‑CHAPv2 exchange, and successfully gets an IP and network access (demo DHCP 10.0.40.77). Attack avoids cracking (hashcat/5500) and is mitigated by enabling cryptobinding.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:55PEEP
- 1:54Challenge Response
- 3:02Current Attack
- 5:42Tools
- 7:10How it works
- 8:52Building it
- 10:38Demo
- 13:51Why does this work
- 15:11Problems
- 15:55Literature Review
- 17:17Crack and Add
- 18:27Rogue Access Point
- 18:55Example
- 26:24Comparing hashes
- 26:41Implementation
- 27:28Pseudocode
- 28:20Defense
- 31:39Future Work
- 32:23Meme
related talks
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
32m802.1x and Beyond!
47mKey Reinstallation Attacks: Breaking the WPA2 Protocol
52mWi-Fi Hacking for Web Pentesters
22mWhat really happens when you connect to public Wi-Fi?
34mPractical Side-Channel Attacks Against WPA-TKIP
40mSweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks
59mD1T1 - Real World Attacks Against Secure Elements