{"id":24797402,"url":"https://github.com/germanaizek/hostapd-wpe-ng","last_synced_at":"2026-01-05T06:53:19.662Z","repository":{"id":238026145,"uuid":"795712579","full_name":"GermanAizek/hostapd-wpe-ng","owner":"GermanAizek","description":"Modified new hostapd-2.10 to facilitate AP impersonation attacks for research and education only","archived":false,"fork":false,"pushed_at":"2024-05-05T01:09:49.000Z","size":175,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-01-30T01:29:40.997Z","etag":null,"topics":["802-1x","asleap","cupid-mode","eap","eap-fast","eap-ttls","eaphammer","heartbleed","hostapd","hostapd-wpe","hostapd-wpe-ng","ieee8021x","karma-mode","mschapv2","wpa-supplicant"],"latest_commit_sha":null,"homepage":"","language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GermanAizek.png","metadata":{"files":{"readme":"README","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-03T21:45:11.000Z","updated_at":"2024-05-05T01:09:53.000Z","dependencies_parsed_at":null,"dependency_job_id":"0d645ef5-b6b3-4fae-bf23-72530a569692","html_url":"https://github.com/GermanAizek/hostapd-wpe-ng","commit_stats":null,"previous_names":["germanaizek/hostapd-wpe-ng"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GermanAizek%2Fhostapd-wpe-ng","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GermanAizek%2Fhostapd-wpe-ng/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GermanAizek%2Fhostapd-wpe-ng/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GermanAizek%2Fhostapd-wpe-ng/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GermanAizek","download_url":"https://codeload.github.com/GermanAizek/hostapd-wpe-ng/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245352092,"owners_count":20601093,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["802-1x","asleap","cupid-mode","eap","eap-fast","eap-ttls","eaphammer","heartbleed","hostapd","hostapd-wpe","hostapd-wpe-ng","ieee8021x","karma-mode","mschapv2","wpa-supplicant"],"created_at":"2025-01-30T01:28:19.098Z","updated_at":"2026-01-05T06:53:19.619Z","avatar_url":"https://github.com/GermanAizek.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"hostapd-wpe (Wireless Pwnage Edition)\nbrad.antoniewicz@foundstone.com\ntwitter: @brad_anton\n------------------------------------------\n\nThe current hostapd-wpe.patch is for: hostapd-2.6.tar.gz\n\nAbout\n----------\n\nhostapd-wpe is the replacement for FreeRADIUS-WPE \n(http://www.willhackforsushi.com/?page_id=37).\n\nIt implements IEEE 802.1x Authenticator and Authentication\nServer impersonation attacks to obtain client credentials,\nestablish connectivity to the client, and launch other attacks\nwhere applicable. \n\nhostapd-wpe supports the following EAP types for impersonation:\n    1. EAP-FAST/MSCHAPv2 (Phase 0)\n    2. PEAP/MSCHAPv2\n    3. EAP-TTLS/MSCHAPv2\n    4. EAP-TTLS/MSCHAP\n    5. EAP-TTLS/CHAP\n    6. EAP-TTLS/PAP\n\nOnce impersonation is underway, hostapd-wpe will return an\nEAP-Success message so that the client believes they are connected\nto their legitimate authenticator. \n\nFor 802.11 clients, hostapd-wpe also implements Karma-style gratuitous \nprobe responses. Inspiration for this was provided by JoMo-Kun's \npatch for older versions of hostapd. \n\n        http://www.foofus.net/?page_id=115\n\nhostapd-wpe also implements CVE-2014-0160 (Heartbleed) attacks against\nvulnerable clients. Inspiration for this was provided by the Cupid PoC:\n\n        https://github.com/lgrangeia/cupid\n\nhostapd-wpe logs all data to stdout and hostapd-wpe.log\n\nQuick Usage\n--------\nOnce hostapd-wpe.patch is applied, hostapd-wpe.conf will be created\nat /path/to/build/hostapd/hostapd-wpe.conf. See that file for more \ninformation. Note that /path/to/build/hostapd/hostapd-wpe.eap_users \nwill also be created, and hostapd-wpe is dependent on it. \n\nBasic usage is:\n\n    hostapd-wpe hostapd-wpe.conf \n\nCredentials will be displayed on the screen and stored in hostapd-wpe.log\n\nAdditional WPE command line options are:\n\n    -s  Return EAP-Success messages after credentials are harvested\n    -k  Gratuitous probe responses (Karma mode) \n    -c  Attempt to exploit CVE-2014-0160 (Cupid mode)\n\nBuilding \n---------\n\n    $ git clone https://github.com/OpenSecurityResearch/hostapd-wpe \n\n    Ubuntu/Debian/Kali Building - \n    -----------------------------------------------------------------------\n        $ apt-get update\n        $ apt-get install libssl-dev libnl-dev\n        \n        if you're using Kali 2.0 install:\n        $ apt-get install libssl-dev libnl-genl-3-dev\n        \n\n    General - \n    ------------------------------------------------------------------------\n    \tNow apply the hostapd-wpe.patch:\n        \n        $ git clone https://github.com/OpenSecurityResearch/hostapd-wpe\n\n        $ wget http://hostap.epitest.fi/releases/hostapd-2.6.tar.gz\n        $ tar -zxf hostapd-2.6.tar.gz\n        $ cd hostapd-2.6\n        $ patch -p1 \u003c ../hostapd-wpe/hostapd-wpe.patch \n        $ cd hostapd\n        \n        If you're using Kali 2.0 edit .config file and uncomment:\n        CONFIG_LIBNL32=y\n        \n        $ make\n\n        I copied the certs directory and scripts from FreeRADIUS to ease that \n        portion of things. You should just be able to:\n\n        $ cd ../../hostapd-wpe/certs\n        $ ./bootstrap\n\n        then finally just:\n        \n        $ cd ../../hostapd-2.6/hostapd\n        $ sudo ./hostapd-wpe hostapd-wpe.conf\n\n\nRunning:\n----------------\n\n    With all of that complete, you can run hostapd. The patch will\n    create a new hostapd-wpe.conf, which you'll likely need to modify\n    in order to make it work for your attack. Once ready just run\n\n    hostapd hostapd-wpe.conf\n\n    Look in the output for the username/challenge/response. It'll be there\n    and in a hostapd-wpe.log file in the directory you ran hostapd from\n\n    for instance here are the EAP-FAST Phase 0 creds from stdout:\n\n    username: jdslfkjs\n    challenge: bc:87:6c:48:37:d3:92:6e\n    response: 2d:00:61:59:56:06:02:dd:35:4a:0f:99:c8:6b:e1:fb:a3:04:ca:82:40:92:7c:f0\n\n    and as always, we feed them into asleap to crack:\n\n    # asleap -C bc:87:6c:48:37:d3:92:6e -R 2d:00:61:59:56:06:02:dd:35:4a:0f:99:c8:6b:e1:fb:a3:04:ca:82:40:92:7c:f0 -W wordlist \n    asleap 2.2 - actively recover LEAP/PPTP passwords. \u003cjwright@hasborg.com\u003e\n    hash bytes:        b1ca\n    NT hash:           e614b958df9df49ec094b8730f0bb1ca\n    password:          bradtest\n\n    Alternatively MSCHAPv2 credentials are outputted in john the rippers NETNTLM format. \n\n\nEAP-Success\n--------------\n    Certain EAP types do not require the server to authenticate itself, just to validate\n    the client's submitted credentials. Since we're playing the authentication server, \n    that means we can easily just return an EAP-Success message to the client regardless\n    of what they send us. The client is happy because they've connected, but unfortunately\n    are unaware that they are connected to an unapproved authenticator. \n\n    At this point, the attacker can set up a dhcp server and give the client an IP and\n    then do whatever they'd like (e.g. redirect dns, launch attacks, MiTM, etc..)\n\n    MSCHAPv2 protects against this by having the server prove knowledge of the password\n    most supplicants adhere to this policy, but we return EAP-Success just in case. \n\nKarma-Style Probes\n------------------\n    This functionality simply waits for an client to send a directed probe, when it does, it \n    assumes that SSID and responds to the client. Only applicable to 802.11 clients. \n\nA note on MSCHAPv2\n-------------------\n    Microsoft offers something called \"Computer Based Authentication\". When a computer\n    joins a domain it is assigned a password. This password is stored on the system\n    and in active directory. We can harvest the MSCHAPv2 response from these systems but\n    its going to take a lifetime to crack. Unless you're just trying to solve for the \n    hash, and not the actual password :)\n\n    One other thing to note, if the client returns all zeros, it isnt joined to a domain. \n\nTesting Heartbleed\n---------------\n    If you're running Ubuntu and want to test Heartbleed you'll need to downgrade to a vulnerable\n    version of OpenSSL. That can be done by:\n\nwget https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/5436465/+files/openssl_1.0.1-4ubuntu5.11_i386.deb\nwget https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/5436465/+files/libssl-dev_1.0.1-4ubuntu5.11_i386.deb\nwget https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/5436465/+files/libssl-doc_1.0.1-4ubuntu5.11_all.deb\nwget https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/5436465/+files/libssl1.0.0_1.0.1-4ubuntu5.11_i386.deb\nsudo dpkg -i libssl1.0.0_1.0.1-4ubuntu5.11_i386.deb \nsudo dpkg --install libssl1.0.0_1.0.1-4ubuntu5.11_i386.deb \\\nlibssl-dev_1.0.1-4ubuntu5.11_i386.deb \\\nlibssl-doc_1.0.1-4ubuntu5.11_all.deb \\\nopenssl_1.0.1-4ubuntu5.11_i386.deb \n\n\n    The use wpa_supplicant to connect to hostapd-wpe -c \n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgermanaizek%2Fhostapd-wpe-ng","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgermanaizek%2Fhostapd-wpe-ng","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgermanaizek%2Fhostapd-wpe-ng/lists"}