What is WPA & WPA2 Enterprise & How it Works

In this lecture and in the next few lectures I'd like to talk about WPA Enterprise, what it is, how it works and how to hack it. Now, all the networks that we've seen so far in this course and in my other hacking courses, whether they're WPA or WPA, two networks, all of them were using a form of authentication called SK. SK stands for Pre-shared Key. And what we mean by that is there is one shared key that any device that wants to connect to the network can use, and they'll get access to the network. So there is one key in the network. That key is shared between all the clients, all the devices that want to connect to the network. And if you have that key, then you can authenticate and connect to the network. Now, because this is a very simple concept, the router manages the authentication in this case, because we only have one key. So whenever a client wants to connect to the network, they have to give that one specific key. And if that key is correct, the router will allow the client to access the network or the internet. If not, then they'll just refuse them and not even give them an IP address. Now WPA enterprise is another form of authentication. So we have PSK, which is Pre-shared key authentication, and we have another form of authentication called WPA Enterprise. Now, as the name suggests, it's designed for bigger and larger networks. It's usually used in large organizations such as big companies, universities and so on. The idea behind this is each user that wants to connect to the network needs to have their own username and their own password. So there is no shared key. Each client has to have their own key to connect to the network. Now this is actually a more secure implementation and it has a lot of advantages. First of all, it's more secure because each user will have a unique key, so their traffic will also be encrypted using this unique key. And it's more practical because if you want to deny a certain user from connecting, you won't have to change the one password. You'll just have to remove their password from the authentication server. Now because of this idea and this implementation, the router cannot handle this and we usually use a central server for authentication. Now the central server is very handy because we can add users and prevent users from connecting to the network without having to change the password for the whole network. So when using a pre-shared key, if we wanted to prevent a certain user or if we wanted, if we thought that our password got stolen, then we have to change the password and then we have to give the new password to all of the users that we want to allow to connect to the network. And the WPA enterprise case, we don't have to do that if we think a certain password is stolen or if we want to prevent a certain user from connecting, then we can just modify our central server, the radius server and remove the password that we don't want to allow on our network. Now, WPA Enterprise is also considered to be more secure because, like I said, each user gets their own key and their traffic is encrypted using their own unique key. Whereas in SK, in the Pre-shared key authentication, all the traffic through the network will be encrypted using the one single shared key. So regardless of the user, they'll all be using the same exact key. So right here I have a diagram of the way WPA Enterprise usually configured. Now, the access point will not be handling authentication, like I said. So the client is going to use some sort of authentication, usually a username and a password. It's going to send it to the access point. The access point will not do any form of verification. It will literally just forward that to the radius server. The radius server is the brain or is the entity that decides whether this form of authentication is correct or not. If the username and password are correct, it's going to tell the access point. Okay, these are correct. Allow this device to access the resource, whether it's the internet or the network. So the access point is going to assign an IP address to this computer and allow it to access the network. Therefore, when we want to add new users or prevent users from connecting, all we have to do is just modify our server here and remove the users that we don't want them to connect. Now, WPA Enterprise uses an authentication protocol called EAP, but there are other implementations that you might face, like Eap-fast, EAP and TLS. Now, I'm just trying to give you a basic understanding of what we mean by WPA enterprise and how it works. And in the next lecture we're going to discuss how we can hack this and gain access to networks that use this form of authentication.