EAP_buster

• What?
• Offensive usage
• Defensive usage
• Installation
• Author and credits
• License

What?

EAP_buster is a simple bash script that lists what EAP methods are supported by the RADIUS server behind a WPA-Enterprise access point. In order to achieve this, it makes use of several wpa_supplicant configuration files along with WPA-Enterprise identities, which can be grabbed with some passive sniffing.

Offensive usage

During Red Team exercises, EAP_buster provides hints about what to expect from Wi-Fi clients when launching fake WPA-Enterprise access points.

Example: forget about grabbing passwords with fake AP attacks if clients are expected to authenticate through certificates only (EAP-TLS). Usage:

./EAP_buster.sh "${EAP_ESSID}" "${EAP_IDENTITY}" "${WIFI_INTERFACE}"

It should be noted that EAP_buster needs legitimate identities in order to start the 802.1X authentication process and get reliable results.

EAP identites can be passively collected using sniffing tools such as crEAP, just make sure you use a real identity and not an anonymous one.

Defensive usage

From a Systems Administrator standpoint, EAP_buster can be used to detect fake WPA-Enterprise access points, as they tend to support as many EAP methods as possible in order to offer legitimate clients every form of authentication (even if using clearly fake identities).

The following image shows what EAP methods are supported by default when using hostapd-wpe:

Installation

No installation process needed, EAP_buster's main functionality consists on launching wpa_supplicant several times.

Author and credits

Author: Miguel Amat @mamatb

References:

• EAP packet types
• Typical 802.1X authentication
• wpa_supplicant description
• /usr/share/doc/wpasupplicant/examples/wpa_supplicant.conf

License

All the code included in this project is licensed under the terms of the MIT license.