> For the complete documentation index, see [llms.txt](https://wifi-hacking.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wifi-hacking.cavementech.com/open-authentication.md).
# Open Authentication
### Open Authentication without Password
Once we know your ESSID we can connect to the network, for that we create a “free.conf’ file to connect from bash using “wpa\_supplicant”.
```
nano free.conf
```
```bash
network={
ssid="$ESSID"
key_mgmt=NONE
scan_ssid=1
}
```
```bash
sudo wpa_supplicant -Dnl80211 -iwlan2 -c free.conf
```
* **`wpa_supplicant`**: A daemon used to manage WPA/WPA2 authentication for Wi-Fi networks.
* **`-Dnl80211`**: Specifies the wireless driver backend.
* `nl80211` is the modern driver used for most Linux wireless devices.
* If `nl80211` doesn't work, you might try `wext` (legacy driver).
* **`-iwlan2`**: Specifies the wireless interface (`wlan2` in this case).
* You should check your actual interface name using `iwconfig` or `ip link show`.
* **`-c free.conf`**: Specifies the configuration file (`free.conf`) containing network credentials and settings.
In another terminal as root:
sudo dhclient wlan2 -v
* **`sudo`**: Runs the command with superuser privileges.
* **`dhclient`**: A DHCP (Dynamic Host Configuration Protocol) client that requests an IP address from a DHCP server.
* **`wlan2`**: The name of the wireless interface requesting the IP.
* **`-v`**: Enables verbose mode to display detailed output.
Once connected to the network and get IP with “dhclient” we can access the IP at IP 192.168.16.1 where we see a login where we can test default credentials such as admin/admin, accessing the admin panel where you can find the flag.
```
admin/admin
```
#### Alternate Method to connect
### Opportunistic Wireless Encryption
**Opportunistic Wireless Encryption (OWE)**, also known as Enhanced Open provides encryption without requiring a password.
The Key Difference: Look at the `airodump-ng` output for **ENC and AUTH**.
* Standard Open (Lab 1): Shows `ENC: OPN` and `AUTH: [empty]`.
* OWE (Lab 1.1): Shows `ENC: WPA3`, `CIPHER: CCMP`, and `AUTH: OWE`.
* Wireshark View: Open your `.pcap` file. Unlike Lab 1 where you could see HTTP POST data in plaintext , the OWE traffic will appear as 802.11 QoS Data and will be encrypted, making the data unreadable to the sniffer
#### Connecting the Client
Next, you simulate a client connecting to this encrypted "open" network.
* Start the Client: Use `wpa_supplicant` to connect an interface (e.g., `wlan1`) using the OWE configuration
```
network={
ssid="SweetB-OWE"
key_mgmt=OWE
pairwise=CCMP
}
```
```
wpa_supplicant -i wlan1 -c owe.conf
```
* Observe the Handshake: Watch the output for `Key negotiation completed`. You will notice that while no password was entered, the system negotiates a PMKSA-CACHE and a PTK CCMP (encryption key).
#### Traffic Sniffing & Analysis
Now, use a 2nd radio to capture the traffic and analyze it.
Enable Monitor Mode:
```
airmon-ng start wlan2
```
Locate the Target: Scan all bands to find the channel and BSSID of `SweetB-OWE`:
```
airodump-ng --band abg wlan2mon
```
Capture to PCAP: Once you have the channel (`-c`) and BSSID (`--bssid`), start a focused capture:
```
airodump-ng -c <#> --essid SweetB-OWE --bssid -w --output-format pcap
```
```
airodump-ng -c 6 --essid SweetB-OWE --bssid CE:9E:05:59:B3:CE -w output_owe --output-format pcap wlan2mon
```
#### Key Takeaway
On a standard open network, any attacker can see your HTTP traffic in plaintext. In an OWE environment, even though there is no password, the traffic between the client and the AP is encrypted, protecting users from passive sniffing
