The Basics of Rogue APs
When a client connects to a wireless network,
the device will save the network into a list
called the Preferred Network List (PNL).
A PNL allows devices to reconnect to a familiar network
when it is detected again.
Typically, large wireless networks have
multiple APs advertising the same ESSID.
This allows them to be able to connect to the Internet from multiple locations.
To illustrate this, let’s imagine an office with two APs and a device.
This device is connected to the network and is mobile.
The user of this device is moving with it from one end of the office to the other.
As a device moves out of range from one AP, it loses its connection.
If the device then tries to reconnect and is closer to the second AP,
it will recognize the familiar network ESSID and connect to the second AP.
In this module, we will take advantage of this
by advertising the same ESSID as an existing AP.
If our rogue AP broadcasts a strong enough signal,
the client may attempt to connect to us instead of the existing AP.
Even though we might not have the same pre-shared key (PSK)
as the AP the client was expecting,
we will be able to capture the first two messages of the 4-way handshake.
This should give us just the right amount of information to crack the PSK.
However, devices are increasingly sophisticated
and many save the encryption details in the PNL when the network is saved.
This means for a successful attack,
our rogue AP will have to match the encryption details of the target.
With some of the basics out of the way,
let’s begin discovering the necessary information about our target.