[gBarreras]

Hello all,
I've read some Man in the Middle tutorials and demonstrations. I've never done it, though.
As far as I know, it's easy to execute a a MitM attack on a client connected to an open network.
The attacker only has to create a honeypot with the same essid as the open network where the client is connected. He may need to overlap the original network.
For that purpose, the client has to receive higher signal from the fake network than the original one. Then, the client is going to connect to the honeypot and he's going to be attacked by a MitM attack.

My question is: in a WEP/WPA/WPA2...Let's imagine a WPA2 network, which is protected by a password authentication.
The attacker has to create a honeypot whith the same essid and also set the same password as the original network, right?
Otherwise the client, who will try to connect automatically with the stored password, won't be able to connect to the network, because the passwords won't match.
In the case the fake network has different encryption configuracion from the original(like WEP, or open authentication), the client will not be able to match the original data remembered with the fake network, even if both have the same essid and bssid.
So, in order to do a MitM attack againts a client connected to a WEP/WPA/WPA2 you have to crack the password before. Is that correct?

Thaaaank you!


This is my first post, by the way .

[gBarreras]

Hello all,
I've read some Man in the Middle tutorials and demonstrations. I've never done it, though.
As far as I know, it's easy to execute a a MitM attack on a client connected to an open network.
The attacker only has to create a honeypot with the same essid as the open network where the client is connected. He may need to overlap the original network.
For that purpose, the client has to receive higher signal from the fake network than the original one. Then, the client is going to connect to the honeypot and he's going to be attacked by a MitM attack.

My question is: in a WEP/WPA/WPA2...Let's imagine a WPA2 network, which is protected by a password authentication.
The attacker has to create a honeypot whith the same essid and also set the same password as the original network, right?
Otherwise the client, who will try to connect automatically with the stored password, won't be able to connect to the network, because the passwords won't match.
In the case the fake network has different encryption configuracion from the original(like WEP, or open authentication), the client will not be able to match the original data remembered with the fake network, even if both have the same essid and bssid.
So, in order to do a MitM attack againts a client connected to a WEP/WPA/WPA2 you have to crack the password before. Is that correct?

Thaaaank you!


This is my first post, by the way .

[hunt3r972]

The thing you are talking about is the "Evil Twin Attack" when you perform a evil twin attack, this is how it runs:

1- Your PC must have a connection to the internet (you can do this with every smartphone now)
2- Your PC must run a DHCP service to give an IP address to your victime
3- Your have to create the Fake Access Point with the same name
4- Your PC has to forward the packets from your fake AP interface to the interface connected to the internet (this is why you must have an internet connection. By this way the victim will do everything he wants on the internet)
4- Launch DeAuth Packets to your victim using aireplay-ng. He will be disconnected from the original access point
5- DeAuth attack are based on the AP's Mac address. He will not reconnect to the original AP because you told him to don't reconnect to the original AP Mac Address, but he will reconnect to your fake AP because the name is the same but not the MAC Address (and because everybody choose to auto connect to their AP)
6- He will be now connected to the fake AP and everything will be forwarded throught your interface connected to the internet. You can now sniff this interface to see the packet flow into it (so you don't need to be a MITM attacker)

Tell me if you didn't understand something and I'll explain better

[RaccoonCity_mybb_import13707]

Yes. That's right, if you want to do a man in the middle attack you'll have to be connected to the internet. The thing with MitM is that you are turning into I would say, "copy of the router". When the computer connects to a website it will not go directly to the router, it will go to your computer IN THE MIDDLE. Here you can redirect his traffic onto any other website.

So if this guy goes to www.youtube.com you can redirect youtube onto facebook instead.

I hope you understood, tell me if you didn't understand and I can explain it further. Happy hacking.

[Ligeti]

If using WPA/WPA2, then yes you must crack the password first...
If WEP is used, then run a caffe latte attack (from airbase-ng)...
BTW, if you are building a bridge then you don't need a DHCP server.

Good luck

[hunt3r972]

Don't need to crack password he is just confusing between Evil Twin and MITM attack ...
The thing he described is a Evil Twin attack not an MITM attack.

If you create an AP with the same ESSID and deauth the client from the AP he is connected to, his computer will automatically reconnect to the fake one. The thing is that the reconnection is quick so the classic user will not notice that something changed. Of course this will not work if the victime is a smart guy that check everything when it goes wrong.

[Ligeti]

No one is confusing Evil Twin with MiTM here, I think that gBarreras is confusing honeypots with evil twin though. Because:
A honeypot is just a free (open) wireless network, Evil Twin on the other hand is a fake duplication of the original with a benefit, which is the signal power.

The password is needed to decrypt the packets, otherwise, what's the point?

AND... you'll have to reconnect manually when the AP configuration is changed! I don't know if this is a common issue or... a special case (I didn't dig into it much), but I sure tested it with Windows 7, Samsung Pocket (Android), and an Acer Tablet (Android).

Your thoughts?

Peace

Edit: I am really interested in your opinion guys...

[Ligeti]

alright, I see it now, hunt3r972 is right, u don't need to crack the password unless u are doing a MiTM... I thought (for a good reason) that the client will use encryption because it is configured to do so... Sorry about any confusions I may caused.

[hunt3r972]

If he wants to sniff the network so yes he will need the WPA/WPA2 key, you're right.
If he wants to do an MITM attack he will also need the WPA/WPA2 key to connect to it to do his MITM attack, you're right too.

The thing that made me think he is confusing about MITM and Evil Twin is that he wants to create a fake AP with the same ESSID that will allow him to sniff the victime

[The Real Slim Shady]

If he wants to sniff the network so yes he will need the WPA/WPA2 key, you're right.
If he wants to do an MITM attack he will also need the WPA/WPA2 key to connect to it to do his MITM attack, you're right too.

The thing that made me think he is confusing about MITM and Evil Twin is that he wants to create a fake AP with the same ESSID that will allow him to sniff the victime

You can do an "Evil Twin" AP and MITM attack in the same "hack". The two are not mutually exclusive.

MITM is a technique used on a network to get between the victim and his destination. How that victim connects to the network is irrelevant. If you deauth someone and youve got an Evil Twin with a stronger signal that they auto-connect to with no passphrase then you can perform a MITM.

the OP's confusion is about the evil twin... how the victim would connect if the fake AP had a passphrase... but in reality this is irrelevant. the device will often connect automatically to any network it can with a strong signal.