1 of 11

WPA Handshake Capture Attack

RED Team Attack

2 of 11

WPA Handshake Capture is a process used in network security to capture the four-way handshake that occurs when a device connects to a WPA or WPA2-secured Wi-Fi network. This handshake is a crucial step in establishing a secure connection, involving the negotiation of cryptographic keys for data encryption

WPA Handshake Capture

3 of 11

How this works?

When clients connect to a WPA/WPA2 encrypted network, they have a 4-way handshake with the router.

We need this 4-way handshake to recover the password.

We can crack the password offline once we get the handshake.

Attack is completely passive on the router.

4 of 11

Aircrack-ng suite

Suite of tools used to recover wireless encryptions keys and carry all sorts of attacks against wireless

Kali Linux

Attacker machine

Alfa Network Adapter

The adapter we can turn into monitor mode.

Tools

5 of 11

airodump-ng–-bssid00:13:10:73:FC:C5 –c 6 –w dump mon0
--bssid is the mac address of the router • -c is the channel of the router
-w is where to save the dump file • dump is the file name Keep that running in it’s own terminal until a client connects

Capture packets from the victim AP

6 of 11

aircrack-ng will crack the password. We specify the bssid, the dump file, and a wordlist to guess the password with.
Wordlist = /pentest/database/sqlmap/txt/wordlist.txt • aircrack-ng –w <list> –b 00:13:10:73:FC:C5 dump*.cap • Aircrack-ng –w /pentest/database

Cracking the Captured Handshake

7 of 11

Authentication

Links with external identity providers, no password storage.

Database

Unique identifiers, usernames, and adjustable password strength.

Certificate

Secures user connections and code-based object signing.

8 of 11

User Statement manages permissions

Enforces default password strength, with customization options for security.

Emphasize password hashing and encryption for user data protection.

Focus on robust passwords, least privilege, and regular permission reviews.

Default Password Strength

Setting Permissions

Best Practices

Security Considerations

9 of 11

Decision-making on Insurance Claims and Breach Notifications

Severity Assessment:

Evaluate the severity of the cybersecurity incident, considering compromised data, financial impact, and legal implications.

Cyber Insurance Claim Considerations:

Assess the need to file a claim with the cyber insurance provider, considering policy coverage and alignment with incident-related expenses.

Breach Notification Decision:

Determine whether to send breach notifications, weighing legal obligations and potential impact on organizational reputation.

10 of 11

CONCLUSION

The response to the cybersecurity incident demands a judicious blend of technical expertise, legal guidance, and collaborative decision-making. The severity assessment serves as a compass, guiding actions on cyber insurance claims and breach notifications. Collaboration is paramount, ensuring a comprehensive and resilient response.
Transparency and effective communication emerge as linchpins in maintaining trust and mitigating reputational risks. This human-centric approach aligns with organizational values, fortifying our commitment to cybersecurity resilience.