hostapd-wpe

hostapd-wpe is a modified version of hostapd designed for wireless pwnage edition attacks. It impersonates legitimate access points to trick clients into authenticating and revealing credentials. The tool supports multiple EAP types including EAP-FAST/MSCHAPv2, PEAP/MSCHAPv2, EAP-TTLS/MSCHAPv2, and others, returning EAP-Success to maintain client connection belief.

Use cases include capturing WiFi credentials from enterprise networks using 802.1x, testing WPA/WPA2 enterprise security, and launching follow-on attacks once credentials are obtained. It also implements Karma-style probe responses and Heartbleed attacks against vulnerable clients.

All captured data including challenges, responses, and usernames are logged to stdout and hostapd-wpe.log, enabling offline cracking with tools like asleap.

hostapd-wpe acts as an IEEE 802.1x Authenticator and Authentication Server impersonator. When clients connect to the fake AP, it captures EAP authentication exchanges, specifically targeting MSCHAPv2 handshakes to extract NTLM challenges and responses. It supports EAP methods 1 (EAP-FAST/MSCHAPv2), 25 (PEAP/MSCHAPv2), and TTLS variants. After capturing credentials, it sends EAP-Success to keep clients associated. Additional features include gratuitous probe responses (Karma mode) and CVE-2014-0160 Heartbleed exploitation.