OSWP · Module 12
Attacking WPA Enterprise
Identify WPA Enterprise networks with weak certificate validation and harvest MSCHAPv2 credentials with rogue APs (hostapd-mana, EAPHammer).
~2 h 3 resources Last updated September 27, 2026
WPA Enterprise replaces a shared password with per-user credentials authenticated over EAP against a RADIUS server. Its weakness is trust: with PEAP or EAP-TTLS, if the client does not properly validate the RADIUS server certificate, an attacker can stand up a rogue enterprise AP, present any certificate, and capture the victim's MSCHAPv2 challenge-response for offline cracking. PEN-210 covers identifying that misconfiguration and exploiting it to harvest domain credentials.
Detecting Enterprise Weaknesses
The attack only works when clients accept an untrusted certificate. Confirming the network uses WPA Enterprise, identifying the EAP method (PEAP, EAP-TTLS, EAP-TLS), and testing whether clients validate the server certificate determines viability. EAP-TLS (mutual certificates) resists this; PEAP/EAP-TTLS with lax validation is the exploitable case.
Harvesting EAP Credentials
hostapd-mana configured as a rogue enterprise AP presents a certificate and captures the MSCHAPv2 exchange when a client connects, which then cracks offline (see the hash-cracking module). EAPHammer streamlines the whole chain: certificate generation, evil-twin credential capture, GTC downgrade to harvest plaintext, and hostile-portal attacks. A FreeRADIUS backend makes the rogue AP indistinguishable from a real enterprise deployment.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 3 min readHarvesting EAP Credentials with hostapd-mana