Overview

EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on providing an easy-to-use interface that can be leveraged to execute powerful wireless attacks with minimal manual configuration.

To illustrate how fast this tool is, here’s an example of how to set up and execute a credential-stealing evil twin attack against a WPA2-TTLS network in just two commands:

# Generate Certificates
./eaphammer --cert-wizard

# Launch Attack
./eaphammer -i wlan0 --channel 4 --auth wpa --essid CorpWifi --creds

Leverages a lightly modified version of hostapd-wpe (shoutout to Brad Anton for creating the original), dnsmasq, asleap, hcxpcaptool and hcxdumptool for PMKID attacks, Responder, and Python 3.5+.

Features

  • Steal RADIUS credentials from WPA-EAP and WPA2-EAP networks.
  • Perform hostile portal attacks to steal AD creds and perform indirect wireless pivots
  • Perform captive portal attacks
  • Built-in Responder integration
  • Support for Open networks and WPA-EAP/WPA2-EAP
  • No manual configuration necessary for most attacks.
  • No manual configuration necessary for installation and setup process
  • Leverages latest version of hostapd (2.8)
  • Support for evil twin and karma attacks
  • Generate timed Powershell payloads for indirect wireless pivots
  • Integrated HTTP server for Hostile Portal attacks
  • Support for SSID cloaking
  • Fast and automated PMKID attacks against PSK networks using hcxtools
  • Password spraying across multiple usernames against a single ESSID

New (as of Version 1.9.0): Wiki

Documentation has now been moved to a Wiki (thanks @FreqyXin!)

EAP Downgrade Attacks (as of Version 1.8.1)

See: http://solstice.sh/wireless/eaphammer/2019/09/10/eap-downgrade-attacks/

WPA/2-PSK Handshake Features (as of Version 1.7.0):

EAPHammer now supports WPA/2-PSK along with WPA handshake captures.

OWE (added as of Version 1.5.0):

EAPHammer now supports rogue AP attacks against OWE and OWE-Transition mode networks.

PMF (added as of Version 1.4.0)

EAPHammer now supports 802.11w (Protected Management Frames), Loud Karma attacks, and Known Beacon attacks (documentation coming soon).

Improved Certificate Handling

EAPHammer’s Cert Wizard has been expanded to provide users with the ability to create, import, and manage SSL certificates in a highly flexible manner. Cert Wizard’s previous functionality has been preserved as Cert Wizard’s Interactive Mode, which uses the same syntax as previous versions. See XIV. Cert Wizard for additional details.

TLS / SSL Backwards Compatibility

EAPHammer now uses a local build of libssl that exists independently of the systemwide install. This local version is compiled with support for SSLv3, allowing EAPHammer to be used against legacy clients without compromising the integrity of the attacker’s operating system.

Supported EAP Methods

EAPHammer supports the following EAP methods:

  • EAP-PEAP/MSCHAPv2
  • EAP-PEAP/GTC
  • EAP-PEAP/MD5
  • EAP-TTLS/PAP
  • EAP-TTLS/MSCHAP
  • EAP-TTLS/MSCHAPv2
  • EAP-TTLS/MSCHAPv2 (no EAP)
  • EAP-TTLS/CHAP
  • EAP-TTLS/MD5
  • EAP-TTLS/GTC
  • EAP-MD5

802.11a and 802.11n Support

EAPHammer now supports attacks against 802.11a and 802.11n networks. This includes the ability to create access points that support the following features:

  • Both 2.4 GHz and 5 GHz channel support
  • Full MIMO support (multiple input, multiple output)
  • Frame aggregation
  • Support for 40 MHz channel widths using channel bonding
  • High Throughput Mode
  • Short Guard Interval (Short GI)
  • Modulation & coding scheme (MCS)
  • RIFS
  • HT power management

Upcoming Features

  • Perform seamless MITM attacks with partial HSTS bypasses
  • directed rogue AP attacks (deauth then evil twin from PNL, deauth then karma + ACL)
  • Integrated website cloner for cloning captive portal login pages
  • Integrated HTTP server for captive portals

Current release: v1.12.0

Supports Python 3.5+.

LEAVE A REPLY

Please enter your comment!
Please enter your name here