Cupid-WPA

Cupid-WPA provides cupid-hostapd, a fork of hostapd, to create fake wireless networks that exploit the Heartbleed vulnerability in terminals attempting to connect via EAP-PEAP, EAP-TLS, or EAP-TTLS protocols. This allows extraction of sensitive information from vulnerable clients.

The companion cupid-wpasupplicant fork enables attacks against wireless access points by exploiting the same vulnerability when connecting as a client. Additional utilities like cupid-hostapd_cli, cupid-wpa_cli, cupid-wpa_passphrase, and cupid-wpa_supplicant support configuration, management, and PSK generation for WPA networks.

Use cases include penetration testing wireless networks vulnerable to Hertbleed, demonstrating risks in EAP-TLS implementations. See the presentation slides for an introduction: http://www.slideshare.net/lgrangeia.

The tools use patched versions of hostapd v2.1 and wpa_supplicant v2.1 with libunsafessl1.0.2, incorporating an unsafe OpenSSL variant vulnerable to Heartbleed (CVE-2014-0160 variant for Hertbleed). Cupid-hostapd sets up an IEEE 802.11 AP with 802.1X/WPA/WPA2/EAP/RADIUS authentication, triggering Heartbleed during TLS handshakes in EAP-PEAP, EAP-TLS, or EAP-TTLS tunnels to leak memory contents from connecting clients. Cupid-wpasupplicant reverses this, acting as a client to exploit vulnerable APs during authentication.