Wireless Access

last person joined: yesterday 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

Pen Testing Mesh

This thread has been viewed 1 times

  • 1.  Pen Testing Mesh

    Posted Jun 16, 2017 02:34 PM

    Im looking to Pen Test my Aruba Mesh network and validate security. No Idea how to do this. Any advice? 



  • 2.  RE: Pen Testing Mesh

    EMPLOYEE
    Posted Jun 16, 2017 02:45 PM

    You would need to be more specific on what you are trying to test? Wired security, wireless security of the mesh, etc?



  • 3.  RE: Pen Testing Mesh

    Posted Jun 16, 2017 03:06 PM
    Wireless security of the mesh


  • 4.  RE: Pen Testing Mesh

    EMPLOYEE
    Posted Jun 16, 2017 03:09 PM

    Not really then no. Use a sufficiently complex passphrase on the WPA2 and you should be fine. Because it's not really needed to be 'known', I usually bang out a random string on a text file, copy/paste into the mesh profile and save it. From there, it's saved on the controller and deployed to APs securely from there. Once up, so long as the passphrase is solid, the mesh link will be secure. 



  • 5.  RE: Pen Testing Mesh

    Posted Jun 16, 2017 03:14 PM
    The mesh link is broadcasting its own SSID correct? That being said, agree with you, as long as encryption is enabled with long PSK all should be good. The SSID can be hidden but that shouldn't matter as pen testing tools should still pick it up. Could you potentially disrupt the link by sending a deauth request and capturing the 4 way handshake?


  • 6.  RE: Pen Testing Mesh

    EMPLOYEE
    Posted Jun 16, 2017 03:29 PM

    The mesh SSID is broadcast, but normal clients won't be able to see it (FromDS and ToDS are set to '1'). You would need a hacked/modded WLAN driver/card to see it and be able to send packets that way.

     

    Yes, if you have a card/driver to send deauths you could disrupt the link. Capturing the 4 way isn't going to do you much good, esp when using a sufficiently complex key (the mesh is WPA2 AES, so same strenth as WLAN AES WPA2).