# Attacking WPA Enterprise

> Identify WPA Enterprise networks with weak certificate validation and harvest MSCHAPv2 credentials with rogue APs (hostapd-mana, EAPHammer).

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/attacking-wpa-enterprise
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

WPA Enterprise replaces a shared password with per-user credentials authenticated over EAP against a RADIUS server. Its weakness is trust: with PEAP or EAP-TTLS, if the client does not properly validate the RADIUS server certificate, an attacker can stand up a rogue enterprise AP, present any certificate, and capture the victim's MSCHAPv2 challenge-response for offline cracking. PEN-210 covers identifying that misconfiguration and exploiting it to harvest domain credentials.

## Detecting Enterprise Weaknesses

The attack only works when clients accept an untrusted certificate. Confirming the network uses WPA Enterprise, identifying the EAP method (PEAP, EAP-TTLS, EAP-TLS), and testing whether clients validate the server certificate determines viability. EAP-TLS (mutual certificates) resists this; PEAP/EAP-TTLS with lax validation is the exploitable case.

## Harvesting EAP Credentials

hostapd-mana configured as a rogue enterprise AP presents a certificate and captures the MSCHAPv2 exchange when a client connects, which then cracks offline (see the hash-cracking module). EAPHammer streamlines the whole chain: certificate generation, evil-twin credential capture, GTC downgrade to harvest plaintext, and hostile-portal attacks. A FreeRADIUS backend makes the rogue AP indistinguishable from a real enterprise deployment.

## Study material

- [Detecting WPA Enterprise PEAP Without Certificate Validation](https://hackindex.io/platforms/wireless/vulnerability-discovery/detecting-wpa-enterprise-peap-unvalidated-certificate.md) (read, core)
- [Harvesting EAP Credentials with hostapd-mana](https://hackindex.io/platforms/wireless/exploitation/harvesting-eap-credentials-hostapd-mana.md) (read, core)
- [EAPHammer Enterprise Wireless Attacks](https://hackindex.io/platforms/wireless/exploitation/eaphammer-enterprise-attacks.md) (read, core)