# Identifying Enterprise vs Personal Authentication

> Differentiates enterprise (802.1X/EAP) from personal (PSK) wireless auth methods to guide credential attacks and lateral movement strategies.

- **URL:** https://hackindex.io/platforms/wireless/enumeration/identifying-enterprise-vs-personal-authentication
- **Path:** Wireless > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/wireless/enumeration.md)
- **Published:** 2026-03-17
- **Updated:** 2026-09-15

WPA Enterprise and WPA Personal use fundamentally different authentication mechanisms and require completely different attack approaches. Confusing the two wastes time. Enterprise networks use 802.1X with a RADIUS server: there is no PSK to crack. Attacking them requires a rogue AP that impersonates the legitimate network and harvests EAP credentials. Personal networks use a pre-shared key that can be captured and cracked offline.

The distinction is visible in beacon frames before you attempt anything.

## WPA Enterprise Identification from airodump-ng Output

The AUTH column in airodump-ng output shows the authentication method at a glance:

```bash
airodump-ng wlan0mon
#  BSSID              PWR  Beacons  CH   MB   ENC   CIPHER  AUTH  ESSID
#
#  AA:BB:CC:DD:EE:FF  -48       92   6  130   WPA2  CCMP    PSK   HomeNetwork
#  11:22:33:44:55:66  -55       61  11  195   WPA2  CCMP    MGT   CorpWifi
#  77:88:99:AA:BB:CC  -72       14   6  130   WPA2  CCMP    MGT   CORP_GUEST
```

**PSK** confirms WPA/WPA2 Personal. **MGT** confirms 802.1X management-based authentication: WPA Enterprise. Any network showing MGT requires an enterprise attack path.

## Confirm with iw and Check EAP Method

airodump-ng shows MGT but does not reveal which EAP method the enterprise network uses. That matters because PEAP/MSCHAPv2 is crackable while EAP-TLS with mutual certificate authentication is not. Check the RSN information element:

```bash
iw dev wlan0 scan | grep -A 30 "11:22:33:44:55:66"
# BSS 11:22:33:44:55:66(on wlan0)
# 	SSID: CorpWifi
# 	RSN:	 * Version: 1
# 		 * Group cipher: CCMP
# 		 * Pairwise ciphers: CCMP
# 		 * Authentication suites: 802.1X
# 		 * Capabilities: MFP-capable
```

**Authentication suites: 802.1X** confirms enterprise authentication. The beacon alone does not reveal the EAP method: that is only visible in the EAP negotiation frames exchanged during a connection attempt. To identify the EAP method you need to either capture an association or set up a rogue AP and observe what the client offers.

## Identify EAP Method from a Live Capture

If a client is connecting to the enterprise AP, capture the exchange and filter for EAP frames in Wireshark or tshark:

```bash
tshark -i wlan0mon -Y "eap" -T fields -e eap.type -e eap.identity
# 25	
# 1	corpuser@corp.local
```

EAP type values to note:

- `25` = PEAP
- `21` = TTLS
- `13` = EAP-TLS
- `26` = MSCHAPv2

PEAP (25) wrapping MSCHAPv2 (26) is the most common enterprise configuration and is the crackable path. EAP-TLS (13) requires client certificates and is not crackable through credential harvesting alone.

The identity field leaks the username before the TLS tunnel is established in PEAP Phase 1. This gives you a valid username even before cracking any hash.

## Capture the EAP Exchange with airodump-ng

Target the enterprise AP and write to a capture file for later analysis:

```bash
airodump-ng --bssid 11:22:33:44:55:66 --channel 11 --write corp-capture wlan0mon
```

Open the resulting cap file in Wireshark and filter on `eap` to inspect the full exchange. If no clients connect during passive capture, the EAP method determination moves to the rogue AP phase where hostapd-mana logs the method as clients attempt to authenticate.

## Check for Mixed Personal and Enterprise on the Same SSID

Some networks broadcast the same SSID on multiple BSSIDs with different authentication types: one PSK for IoT devices and one Enterprise for staff. Check all BSSIDs associated with the target SSID before assuming a single auth type:

```bash
airodump-ng wlan0mon | grep "CorpWifi"
#  11:22:33:44:55:66  -55  61  11  195  WPA2  CCMP  MGT  CorpWifi
#  AA:BB:CC:11:22:33  -61  44   6  130  WPA2  CCMP  PSK  CorpWifi
```

The same SSID appearing with both MGT and PSK auth means the network has separate SSIDs for different client types. The PSK BSSID is a direct handshake capture target even if the enterprise BSSID is not.

## References

- [Aircrack-ng: airodump-ng documentation](https://www.aircrack-ng.org/doku.php?id=airodump-ng) - AUTH column values and output field reference
- [Wireshark: EAP display filter reference](https://www.wireshark.org/docs/dfref/e/eap.html) - EAP type field values and identity filter reference