MGT Recon
Last updated
Last updated
In MGT networks misconfigured users can send their Identity (username) in clear text before performing the TLS tunnel, so with “airodump-ng” we can passively obtain this information. For this we simply use “airodump-ng” on the correct channel and wait for the clients to connect.
Then open the CAP with wireshark.
Once we have the capture we can use Wireshark filtered by “eap” and look for packets with “Response, Identity”.
GLOBAL\Anonymous
GLOBAL\GlobalAdmin
Or use wifi_db
You can use tshark too:
To create the TLS tunnel between the MGT network and a client the AP sends the certificate to the client in clear text, so anyone can see it. This information can be useful to create a fake certificate with the same fields in a RogueAP attack or to obtain information about the corporate domain, internal mails or other relevant information about the AP.
You can get this information directly from wireshark too:
In Wireshark, just filter by certificates using the AP BBSID as filter.
First we need the identities as discussed above.
GLOBAL\GlobalAdmin
Once we have a valid user we can force each of the EAP authentication methods to verify which methods the AP supports. We can use “EAP_buster ” for this task.
To DO : I am not getting any valid answers
