Cracking WPA keys without the AP
The Caffe Latte and Hirte attacks allow us to crack the WEP key in the absence of the target AP, attacking the disconnected client.
In this section, we will see that it is also possible to crack a WPA key, being in this situation.
Recall from Chapter 5, WPA/WPA2 Cracking, that to crack a WPA key, we must capture a WPA four-way handshake to retrieve all the required parameters to run the cracking process: the A-nonce, the S-nonce, the client, the AP MAC addresses, and the MIC (Message Integrity Check).
It is worth noting that it is not necessary to complete the four-way handshake, as all these parameters are exchanged in the first two packets and the AP does not need to know the preshared key, as we can see in the ...
Get Kali Linux Wireless Penetration Testing Essentials now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
