Find the BSSID of the GrandTour AP (A)

Find the channel of the GrandTour AP (X)

Find an associated end host ESSID (C)

Run airodump-ng on the GrandTour channel, writing output to a file named wpaauth: # airodump-ng -c X --bssid A -w wpaauth wlan0mon While airodump-ng is running, we want to disassociate an attached client in order to capture the authentication handshake when it reattaches. To send a spoofed disassociation frame that appears to originate from an AP with BSSID A to a client with MAC C, run, in a separate window: # aireplay-ng --deauth 5 -a A -c C wlan0mon

Capture for approximately one-minute and ensure that you capture during the faked disassociation. Important: you should see a [ WPA Handshake: xx] message in the top right corner of airodump-ng. Dont exit airodump-ng until you observe the handshake! Run the disassociation again until you observe the handshake, if necessary.

Open the wpaauth-XX.cap trace in wireshark.

Apply a filter expression, eapol, in wireshark so that it only displays EAPOL frames.

3.What is the purpose of the EAPOL frames?

4. Briefly explain why an attacker needs to capture the EAPOL frames.

5. What is the MAC address (6B media access control address) of the supplicant?

6. What are the first four bytes of the APs nonce? 7. What are the first four bytes of the Message Integrity Check (MIC) in the APs first packet of the authentication handshake?

8. What are the first four bytes of the supplicant nonce?

9. What are the first four bytes of the MIC in the supplicants authentication response (second packet of handshake)?

10. What key did the supplicant use to compute the MIC in question 9?

11. What MIC algorithm did the supplicant use to compute the MIC in question 9?