ID: MEDIUM-13

Title: WPA/WPA2 handshake capturable and susceptible to offline password cracking

Severity: Medium

CVSS Score: 6.5

CVSS Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description: The WPA/WPA2 four-way handshake exchanged between a client and the router during authentication can be captured by an attacker within wireless range, and subsequently subjected to offline password cracking without any further interaction with the access point. Two capture methods were demonstrated. First, a passive capture was performed by monitoring the wireless channel until a legitimate client connected, successfully capturing the handshake. Second, an active capture was performed by broadcasting deauthentication frames using aireplay-ng, forcing a connected client to reauthenticate and producing a new handshake capture. Both methods successfully captured a valid WPA/WPA2 handshake, confirmed via Wireshark analysis of the capture files. Offline cracking was subsequently attempted using aircrack-ng. A dictionary attack using the rockyou wordlist did not recover the password, indicating the default PSK has some resistance to common wordlist attacks. However, a targeted wordlist containing the known PSK confirmed the handshake is valid and crackable. The risk of this finding is significantly compounded by the finding documented in MEDIUM-08, where the WPS PIN and WPA PSK are identical by default.

Remediation: Configure a strong, unique WPA/WPA2 password that is not present in common wordlists and is not shared with any other credential such as the WPS PIN. Consider migrating to WPA3 and disable WPS as recommended in INFO-18.

More information: See Wi-Fi Testing chapter.