Home > Network Pentesting

Wireless Authentication Types

Wireless authentication types define how devices prove their identity before joining a Wi-Fi network. Understanding these methods is essential for wireless pentesting because each authentication type exposes different weaknesses, attack vectors, and cracking techniques. Modern Wi-Fi networks mainly rely on WPA2 and WPA3, but legacy methods still appear in older hardware and IoT devices. This chapter explains all common wireless authentication types and how they impact security assessments.

Open (No Authentication)

Open networks allow any device to connect without a password.

Characteristics

  • No authentication

  • No encryption

  • Traffic fully visible in plaintext

  • Used in cafes, public hotspots, guest networks

Security Impact

Open networks allow:

  • Packet sniffing

  • Credential interception

  • Session hijacking

  • Evil Twin attacks

  • Traffic manipulation

Pentesters capture complete traffic easily on open networks.

Capturing Traffic

sudo tcpdump -i wlan0mon

All packets are readable, including HTTP and many app protocols.

WEP (Wired Equivalent Privacy)

WEP is a legacy security protocol still found on very old routers and IoT devices. It is broken and can be cracked quickly.

Characteristics

  • Uses RC4 stream cipher

  • 40-bit or 104-bit keys

  • Weak IV (Initialization Vector) reuse

  • Vulnerable to key recovery

Why WEP Is Insecure

  • IV collisions allow mathematical key recovery

  • Keys never rotate

  • Weak cryptography

A few minutes of packet capture is often enough to recover the key.

Capturing WEP Traffic

sudo airodump-ng wlan0mon

Cracking WEP

sudo aircrack-ng capture.cap

WEP should be considered insecure in all environments.

WPA (Wi-Fi Protected Access)

WPA improved on WEP but still contains weaknesses.

Characteristics

  • Uses TKIP

  • PSK (pre-shared key) or Enterprise

  • Vulnerable to certain dictionary attacks

Most networks have moved to WPA2, but WPA may still appear on old systems.

Weaknesses

  • TKIP can be manipulated

  • Passphrase cracking still possible

  • Not secure on modern networks

WPA2-PSK (Pre-Shared Key)

WPA2-PSK is the most common home and small-office authentication type. It uses AES (CCMP) encryption and a shared password for all clients.

Characteristics

  • Strong AES encryption

  • Relies on a single shared passphrase

  • Authentication via 4-way handshake

Attack Surface

WPA2-PSK doesn’t require online password attempts.
Instead, attackers:

  1. Capture the 4-way handshake

  2. Crack the hash offline using wordlists

Capturing Handshake

sudo airodump-ng wlan0mon -c <channel> --bssid <AP_MAC> -w capture

Forcing Reconnect to Capture Handshake

sudo aireplay-ng --deauth 5 -a <AP_MAC> wlan0mon

Cracking WPA2-PSK

hashcat -m 22000 capture.hc22000 wordlist.txt

Weak passwords are easily cracked.

WPA2-Enterprise (802.1X / EAP)

WPA2-Enterprise uses a RADIUS server for authentication.
Each user has unique credentials.

Authentication Methods

Common EAP types include:

  • PEAP

  • EAP-TLS

  • EAP-TTLS

  • LEAP (obsolete)

Characteristics

  • No shared password

  • Secure if correctly configured

  • Certificate validation required

Attack Surface

Most attacks target misconfigured EAP settings:

  • Users ignoring certificate warnings

  • Weak inner authentication

  • Evil Twin attacks

Capturing EAPOL Traffic

sudo tcpdump -i wlan0mon ether proto 0x888e

If clients fail certificate checks, attackers can harvest credentials.

WPA3-SAE (Simultaneous Authentication of Equals)

WPA3-SAE replaces the WPA2 handshake with a stronger authentication handshake called Dragonfly.

Characteristics

  • Resists offline cracking

  • No handshake-based dictionary attacks

  • Strong protection even with weak passwords

  • Mandatory management frame protection

Weaknesses (Limited)

  • Downgrade attacks on mixed WPA2/WPA3 networks

  • Implementation bugs in early routers

  • Requires modern hardware

Pentesters focus on downgrade and Evil Twin variations rather than cracking.

OWE (Opportunistic Wireless Encryption)

OWE encrypts wireless traffic but does not authenticate clients.

Characteristics

  • Looks like WPA3-open

  • No password but encrypted traffic

  • No protection against Evil Twin

OWE protects traffic confidentiality but not network legitimacy.

SAE vs PSK Summary

Type Security Attack Vector
WPA2-PSK Good, depends on password Offline cracking
WPA3-SAE Very strong Downgrade / implementation flaws
WEP Broken Immediate cracking
WPA Reduced Dictionary, TKIP flaws
WPA2-Enterprise Strong if configured Certificate mismatch attacks

Management Frame Protection (802.11w / PMF)

Management Frame Protection secures:

  • Deauthentication frames

  • Disassociation frames

  • Action frames

Why PMF Matters

Without PMF, attackers can:

  • Disconnect clients (deauth attack)

  • Force reconnections

  • Trigger handshake captures

PMF is required in WPA3 networks, reducing common attack surface.

Choosing the Right Authentication Technique for Pentesting

Pentesters determine attack paths based on authentication type:

  • Open: Sniffing, Evil Twin

  • WEP: IV capture and cracking

  • WPA2-PSK: Handshake or PMKID capture → offline cracking

  • WPA2-Enterprise: Evil Twin EAP harvesting

  • WPA3-SAE: Downgrade attacks

  • OWE: Evil Twin manipulation

  • PMF-enabled networks: Limited deauth, advanced techniques required

Understanding these helps choose correct tools, positioning, and exploitation methods.

Intel Dump

  • Open networks provide no protection and allow full sniffing

  • WEP is broken and easily cracked

  • WPA and WPA2-PSK vulnerable to handshake capture + cracking

  • WPA2-Enterprise uses EAP/RADIUS and is vulnerable to Evil Twin

  • WPA3-SAE prevents offline cracking but can be downgraded

  • OWE encrypts traffic without authentication

  • PMF protects against deauth and MITM triggers

HOME LEARN COMMUNITY DASHBOARD