s0lst1c3 Posts

We’ve gone over a lot of information in the last three sections of this writeup. Now it’s time to make sense of it all, and talk about how each of the techniques we described fits into our toolkit from an operational perspective.

In this next section, we will discuss how to use Management Frame ACLs (MFACLs) in EAPHammer to exert granular probe-level control over the offensive techniques we have described in previous sections (see: https://github.com/s0lst1c3/eaphammer). We’ll also discuss how these attacks work at an algorithmic level, and provide insight into how using MFACLs affects EAPHammer’s runtime efficiency.

In this next section of the series, we will describe how improvements in client device security have made karma attacks much less effective. We’ll then discuss three offensive techniques developed by Dominic White (@singe), Ian de Villiers, and George Chatzisofroniou (@sophron) that can be used to circumvent some of these improvements [1][2].

This is a four part series of blog posts intended to provide a detailed roadmap of rogue AP fundamentals aimed at people who are interested in learning more about modern wireless security at both an operational and technical level. In this series, we’ll go over nearly all of the ways that an adversary can abuse 802.11 to initiate a Person-In-the-Middle (PITM) attack. Additionally, we’ll discuss why these techniques were developed, tracing the history of both rogue AP attacks and corresponding mitigations from the early 2000s to the present day. Finally, this series will provide operational guidance for both offensive and defensive practitioners.