Skip to content
HackIndex logo

HackIndex

Identifying Enterprise vs Personal Authentication

3 min read Mar 17, 2026

WPA Enterprise and WPA Personal use fundamentally different authentication mechanisms and require completely different attack approaches. Confusing the two wastes time. Enterprise networks use 802.1X with a RADIUS server — there is no PSK to crack. Attacking them requires a rogue AP that impersonates the legitimate network and harvests EAP credentials. Personal networks use a pre-shared key that can be captured and cracked offline.

The distinction is visible in beacon frames before you attempt anything.

Identify Authentication Type with airodump-ng

The AUTH column in airodump-ng output shows the authentication method at a glance:

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon 
 BSSID              PWR  Beacons  CH   MB   ENC   CIPHER  AUTH  ESSID

 AA:BB:CC:DD:EE:FF  -48       92   6  130   WPA2  CCMP    PSK   HomeNetwork
 11:22:33:44:55:66  -55       61  11  195   WPA2  CCMP    MGT   CorpWifi
 77:88:99:AA:BB:CC  -72       14   6  130   WPA2  CCMP    MGT   CORP_GUEST

PSK confirms WPA/WPA2 Personal. MGT confirms 802.1X management-based authentication — WPA Enterprise. Any network showing MGT requires an enterprise attack path.

Confirm with iw and Check EAP Method

airodump-ng shows MGT but does not reveal which EAP method the enterprise network uses. That matters because PEAP/MSCHAPv2 is crackable while EAP-TLS with mutual certificate authentication is not. Check the RSN information element:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 30 "11:22:33:44:55:66" 
BSS 11:22:33:44:55:66(on wlan0)
	SSID: CorpWifi
	RSN:	 * Version: 1
		 * Group cipher: CCMP
		 * Pairwise ciphers: CCMP
		 * Authentication suites: 802.1X
		 * Capabilities: MFP-capable

Authentication suites: 802.1X confirms enterprise authentication. The beacon alone does not reveal the EAP method — that is only visible in the EAP negotiation frames exchanged during a connection attempt. To identify the EAP method you need to either capture an association or set up a rogue AP and observe what the client offers.

Identify EAP Method from a Live Capture

If a client is connecting to the enterprise AP, capture the exchange and filter for EAP frames in Wireshark or tshark:

┌──(kali㉿kali)-[~]
└─$ tshark -i wlan0mon -Y "eap" -T fields -e eap.type -e eap.identity 
25	
1	[email protected]

EAP type values to note: 25 = PEAP, 21 = TTLS, 13 = EAP-TLS, 26 = MSCHAPv2. PEAP (25) wrapping MSCHAPv2 (26) is the most common enterprise configuration and is the crackable path. EAP-TLS (13) requires client certificates and is not crackable through credential harvesting alone.

The identity field leaks the username before the TLS tunnel is established in PEAP Phase 1. This gives you a valid username even before cracking any hash.

Capture the EAP Exchange with airodump-ng

Target the enterprise AP and write to a capture file for later analysis:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid 11:22:33:44:55:66 --channel 11 --write corp-capture wlan0mon

Open the resulting cap file in Wireshark and filter on eap to inspect the full exchange. If no clients connect during passive capture, the EAP method determination moves to the rogue AP phase where hostapd-mana logs the method as clients attempt to authenticate.

Check for Mixed Personal and Enterprise on the Same SSID

Some networks broadcast the same SSID on multiple BSSIDs with different authentication types — one PSK for IoT devices and one Enterprise for staff. Check all BSSIDs associated with the target SSID before assuming a single auth type:

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon | grep "CorpWifi" 
 11:22:33:44:55:66  -55  61  11  195  WPA2  CCMP  MGT  CorpWifi
 AA:BB:CC:11:22:33  -61  44   6  130  WPA2  CCMP  PSK  CorpWifi

The same SSID appearing with both MGT and PSK auth means the network has separate SSIDs for different client types. The PSK BSSID is a direct handshake capture target even if the enterprise BSSID is not.

References