Wireless Hacking: Cracking WPA3 and Enterprise Networks

Wylie Bayes

• 3 min read

Wireless networks represent a unique perimeter challenge for organizations. Unlike a wired network where an attacker must physically plug a cable into a switch, a wireless network bleeds out of the building. Anyone sitting in the parking lot with a high-gain antenna and a laptop can attempt to compromise your internal infrastructure.

For years, WPA2 has been the standard for Wi-Fi security. However, well-documented flaws have paved the way for a new protocol: WPA3. In this post, we will explore how attackers approach modern wireless networks, the resilience of WPA3, and the techniques used to breach Enterprise-grade Wi-Fi deployments.

The Death of WPA2 Personal

To understand modern wireless hacking, we have to look at how WPA2 falls short. In WPA2-Personal (Pre-Shared Key or PSK), the primary attack vector is capturing the 4-Way Handshake.

When a legitimate client connects to a WPA2 access point (AP), they exchange cryptographic nonces to prove they both know the password without actually sending the password over the air. An attacker can use a tool like aireplay-ng to send a "deauthentication" frame to a connected user, forcing them to briefly disconnect. When the user automatically reconnects, the attacker captures the resulting 4-way handshake.

Once captured, the attacker takes the handshake offline and uses Hashcat or John the Ripper to run a dictionary attack against it. If the password is weak, the network is compromised. Furthermore, in 2018, the PMKID attack allowed hackers to grab the necessary cryptographic hash directly from the AP without even needing a client to be connected.

Enter WPA3: Is it Uncrackable?

WPA3 was introduced by the Wi-Fi Alliance to fix the glaring vulnerabilities of WPA2. The most significant upgrade is the replacement of the PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), also known as the Dragonfly handshake.

SAE provides forward secrecy and, most importantly, makes offline dictionary attacks nearly impossible. An attacker cannot simply capture a handshake and brute-force it on a massive GPU rig; they must interact directly with the access point for every single password guess. This makes brute-forcing incredibly slow and highly detectable.

Bypassing WPA3

So, is WPA3 completely bulletproof? Not entirely.

  1. Transition Mode Downgrade Attacks: To support older devices, many organizations run WPA3 in "Transition Mode," allowing both WPA2 and WPA3 connections. Attackers can forge management frames to trick a WPA3-capable device into thinking the network only supports WPA2, forcing a downgrade. Once downgraded, the attacker captures the legacy 4-way handshake and cracks it offline.
  2. Dragonblood Vulnerabilities: Shortly after WPA3 was released, security researchers discovered a series of design flaws dubbed "Dragonblood." These included side-channel leaks (timing and cache-based) that allowed attackers to recover the password. While vendors have largely patched these, unpatched APs remain vulnerable.

Attacking WPA-Enterprise Networks

In corporate environments, a single shared password (PSK) is a terrible idea. When an employee leaves, you would have to change the Wi-Fi password for the entire company. Instead, businesses use WPA-Enterprise (802.1X).

In an Enterprise setup, users authenticate with their individual domain credentials (usually via a RADIUS server). Breaking into these networks requires entirely different tactics.

The Evil Twin Attack

The most common and effective way to breach an Enterprise network is the "Evil Twin" attack, utilizing tools like eaphammer or hostapd-wpe.

  1. The Setup: The attacker sets up a rogue access point broadcasting the exact same SSID (network name) as the corporate network, but with a stronger signal.
  2. The Lure: Legitimate employee devices automatically attempt to connect to the strongest signal they see.
  3. The Interception: When the client attempts to authenticate, the attacker's rogue AP intercepts the Extensible Authentication Protocol (EAP) exchange.
  4. The Downgrade: The attacker forces the client to use a weaker inner authentication method, such as MSCHAPv2.
  5. The Capture: The attacker captures the MSCHAPv2 challenge/response hash. They then take this hash offline and crack it using asleap or Hashcat to recover the employee's plaintext Active Directory password.

Defending Against Enterprise Attacks

To prevent Evil Twin attacks, organizations must enforce certificate validation. If client devices are strictly configured to only trust the specific digital certificate issued by the corporate RADIUS server, they will refuse to send their credentials to an attacker's rogue AP, rendering the attack useless.

Conclusion

Wireless hacking remains a highly relevant discipline. While WPA3 effectively kills the offline dictionary attacks that plagued WPA2, the prevalence of Transition Mode and legacy devices leaves many networks exposed. Furthermore, for Enterprise networks, the human element and improper client-side certificate configurations remain the path of least resistance for an attacker.