WLAN Security Protocols: WEP, WPA, WPA2, and WPA3

WEP (Wired Equivalent Privacy)

• An original security standard WLANs used
• It has weak encryption that can easily be cracked
• It uses a weak 40-bit key
• It is outdated and unsuitable for modern networks

WPA (Wi-Fi Protected Access)

• An advancement over WEP
• It uses Temporal Key Integrity Protocol (TKIP)
• Dynamic keys are used, making it more secure than WEP
• It is outdated and has some security vulnerabilities

WPA2 (Wi-Fi Protected Access 2)

• Built as an evolution of WPA
• Advanced Encryption Standard (AES) is employed
• Security is enhanced significantly
• It is a widely used standard for WLANs

WPA and WPA2 Features

• Supports compatibility with older devices
• Existing security vulnerabilities stem from WPA

WPA3 (Wi-Fi Protected Access 3)

• The newest security standard for devices
• Uses Simultaneous Authentication of Equals (SAE)
• It enhances security against brute-force attacks
• Currently the most secure standard for WLANs

WPS (Wi-Fi Protected Setup)

• Enables automatic device connections to a network
• Connection occurs by pushing a button or entering a PIN
• It is practical but poses security risks, especially with the PIN option

WEP Hacking

• WEP is vulnerable to brute-force attacks
• The entire network traffic can get intercepted during an attack
• The encrypted key can be cracked through brute-force
• WEP is easily cracked, because it uses weak 40-bit keys

WPA and WPA2 Hacking (with WPS)

• With WPS enabled and set to PIN-based config, an 8-digit PIN can be easily hacked
• The attack is relatively fast because the PIN comprises only 4+4 digits

WPA and WPA2 Hacking (without WPS)

• Deauthenticate the target to force re-authentication
• Four-way handshake of the victim gets recorded
• Use a dictionary attack on the hash to crack the password

Protecting Against Attacks

• Do not use WEP for security
• Opt for WPA2 or WPA3
• Disable WPS
• Set a very difficult password

ARP-Spoofing

• A “Man-in-the-Middle” is positioned during an attack by sending fake ARP messages to both the router and the victim
• The attacker tells the router that their MAC address is that of the victim, and vice versa; all data packets are routed through the attacker
• The ARP protocol doesn’t verify the IP and MAC address pairings, enabling the attacker to pose as either the router or victim

DNS-Spoofing

• The attacker manipulates the victim’s DNS queries by directing them to a fake website
• The attacker sends false DNS responses with a fake IP address, redirecting the victim

Summary of Spoofing Attacks

• During ARP-Spoofing the attacker intercepts data by spreading false MAC addresses, positioning themselves between the router and victim
• DNS queries are manipulated during DNS-Spoofing to redirect the victim, leading to phishing

Proxies Explained

• Proxys secure clients by regulating outgoing traffic and hiding the client's IP address Reverse proxys secure servers by regulating ingoing traffic, and they hide the server IP for load balance

Firewalls vs IDS vs IPS

• A Firewall either blocks or allows traffic based on set rules
• An IDS actively detects and reports suspicious activity but does not intervene
• An IPS actively detects and blocks suspicious activity

Certificates

• Certificates determine if a server is trustworthy
• The server must renew the certificate every 3 months
• An HTTPS site always needs a present and current certificate
• Without a valid certificate, the connection is marked as unsafe, and modern browsers may block access

Trust Chain

• The CA signature involves combining the server's public key with the CA's private key to form an encrypted server public key
• Trust is established if the encrypted server public key, combined with the CA public key, matches the server's public key

LOLBins

• In "Living off the Land" attacks, the attacker uses existing programs and scripts of the system to avoid detection

IPv6 Addresses

• IPv6 can theoretically assign every device a unique, public IP, making NAT unnecessary

Zero Trust Explained

• With zero trust, no one is automatically trusted within or outside the network
• System, data, and application access is granted based on verification, regardless of network location

Browsing Anonymity

• Browsing Chrome over Tor anonymizes traffic but lacks the privacy features of Tor Browser
• Using Chrome within Tor Browser is theoretically the best solution, but is rarely practical, given that there are many anonymity layers
• Tor Browser alone provides the most security, while Chrome with Tor offers basic anonymity only

Anonymity Networks

• Kali anonsurf routes traffic completely over the Tor network
• Starlink IPs cannot provide the geolocation data that traditional ISPs can

Asymmetric Encryption : ElGamal

• A public/private key pair is created, and the public key is shared to allow others to send encrypted messages that only you can read

Diffie-Hellman Key Exchange

• A symmetrical key is created without transmitting it over the internet
• Parties exchange public data to reconstruct the same shared key

Key Elements for Encryption

• Asymmetric Keys are used for signatures
• Symmetric keys are used for MAC

Encryption Key Points

• Used for authenticating a server’s realness
• Ephemeral session keys are securely negotiated using DHE/ECDHE
• Agreed-upon session key encrypts subsequent communications
• The use of Diffie-Hellman is continuously renewed

VPN Usage In Business

• The company either manages its own VPN server or hires a VPN provider to have a public IP address that is solely theirs; this is a "company VPN server"
• VPN usage allows employees to have a secure and adaptable way to be productive, irrelevant to location

User Connection

• Employees can connect to the company’s network through Ethernet or WLAN in their office space (internal IP Address will be assigned to device) while remote workers connect through a company VPN client (VPN server then assigns an IP address to device)
• Both locations grant the same amount of user resource access

Spoofing User Agent

• User agent spoofing involves changing the user agent string sent to impersonate another device, browser, or OS

Gathering Information Commands

• Shows all IP addresses in a give range netdiscover -r 10.0.2.1/24
• Zenman provides a GUI

ARP Spoofing Commands

• arpspoof -i [interface] -t [clientIP] [gatewayIP]
• arpspoof -i [interface] -t [gatewayIP] [clientIP]
• arpspoof -i eth0 -t 10.0.2.7 10.0.2.1
• arpspoof -i eth0 -t 10.0.2.1 10.0.2.7

Web Interface Usage

• bettercap -> provides a web interface (http-ui) user/pass -Commands
• bettercap -iface eth0
• help -> help [module] -> [module] on
• Set [parameter]
• Caplets.show

Arp Spoofing

• Net.probe on
• Set arp.spoof.fullduplex true
• Set arp.spoof.targets [ip]
• Arp.spoof on
• Set net.sniff.local true
• Net.sniff on

HSTS-Hijacking

• downgraded through “ssl strip”
• In Chrome the HTST secure DNS must be “off” to work normally

Commands and Protocols

• Set dns.spoof.address to redirect traffic -Set Dns.spoof.all true
• Set the "dns.spoof.domains" parameter to reroute from a certain site. -dns.spoof on

Backdoor Protocol

• Command Structure
• Msfvenom -help and *Msfvenom --list payload give possible options
• Msfvenom -payload [payload] [options] = [parameter] [out] is the construction for backdoor commands

Metasploit Usage

• Steps for use
• Msf console
• Use exploit/multi/handler for show options
• Set PAYLOAD windows/meterpreter/reverse_https
• Show Options for further instrcutions

Exploits

• Autoit can be used for non-friendly hacks
• port forwarding is not for local IP addresses

###Beef Explained

• If a Javascript script is preformed correctly it will connect the browser to beef

Meterpreter

• Command structure
• Msfconsole and Help

Website Upload

• Generates shellcode for uploaded and execution when launched
• help
• Weevly generate -[password]-[path/filename] creates a shellcode, then to execute command
• Weevly [url to file] -[password] connects to the URL for usage to initiate

Command Injection

• Allows you to run multiple commands in a row (ping command example)

XSS

• Client sided web application to store data with client
• <script>alert(“XSS”)</script>
• URL writing as GET and passing out

SQL Injection

• Various attacks for data integrity (Command examples below)
• Something' and 1=1-
• Something' and 1=0 --
• ‘,
• Something' or 1=1 -- -ZAP is an auto-scanner for target website vulnerabilities

Background Exploits

• Used with metasploit and veil-evaision (Background (current session))

Smuggling HTML

• Inserts short code into the HTML for downloads

Authentication Parameters

• Set EXE_Name (name/appearancesolexe
• Session
• Set session
• Set exelcustim/uar-www-html/backdoor.Exe Exploit

###Obfuscating

• Resorce Hacker and Confuser ex2 can preform functions

Password podcast

• Lockbit is a well renown ransomware group

WiFi Connections

• SSID-Irritum can incorrectly use wifi connections for other purposes

PFS

• Perfect forward secrecy with keys

###Computer Usage

• Quantencomputer problem with decryption,
• Requires the doubling of keys

Monitoring

• monitoring can only be viewed if an end-to-end is preformed

Key Windows Functions

• Windows recall to scan information, but be mindful of Ddos attacks

Exploits

• Cve nummern are indices dor exloits when a security breach is found

Protocols

• Ocsp protocol can do real time validity checks

Scams

• Like Linux, can be used to farm reputation or other activity

Injection

• Ki model input to trigger manipulation and commands

Protection Script

• Used for the client to send data to be checked externally ( Crowstrike example)

Malware

• Created an attack/damage with several malicious functions

Exploiting Devices

• Allows an exploit to connect on devices with several functions and ports

Security

Zero trust is where ever function is secured by encryption -open ssl is where tls is connected when safe -tablets with tls allow secure connection -safe boots do not require pc booting as often - telegram is not fully end-to-end -intel engine has independent funnctions

Security Exploits

• Can cause adds to drop on browsers or devices