Add support for WPA3 + OWE

Author: kimocoder

wifite/args.py

@@ -312,9 +312,22 @@ def _add_wpa_args(self, wpa):
         wpa.add_argument('--wpa',
                          action='store_true',
                          dest='wpa_filter',
-                         help=Color.s('Show only {C}WPA-encrypted networks{W} (includes {C}WPS{W})'))
+                         help=Color.s('Show only {C}WPA/WPA2-encrypted networks{W} (may include {C}WPS{W})'))
         wpa.add_argument('-wpa', help=argparse.SUPPRESS, action='store_true', dest='wpa_filter')
 
+        wpa.add_argument('--wpa3',
+                         action='store_true',
+                         dest='wpa3_filter',
+                         help=Color.s('Show only {C}WPA3-encrypted networks{W} (SAE/OWE)'))
+        wpa.add_argument('-wpa3', help=argparse.SUPPRESS, action='store_true', dest='wpa3_filter')
+
+        wpa.add_argument('--owe',
+                         action='store_true',
+                         dest='owe_filter',
+                         help=Color.s('Show only {C}OWE-encrypted networks{W} (Enhanced Open)'))
+        wpa.add_argument('-owe', help=argparse.SUPPRESS, action='store_true', dest='owe_filter')
+
+
         wpa.add_argument('--hs-dir',
                          action='store',
                          dest='wpa_handshake_dir',

wifite/attack/all.py

@@ -65,34 +65,53 @@ def attack_single(cls, target, targets_remaining):
             # TODO: EvilTwin attack
             pass
 
-        elif 'WEP' in target.encryption:
+        elif target.primary_encryption == 'WEP':
             attacks.append(AttackWEP(target))
 
-        elif 'WPA' in target.encryption:
+        elif target.primary_encryption.startswith('WPA'): # Covers WPA, WPA2, WPA3
             # WPA can have multiple attack vectors:
 
             # WPS
-            if not Configuration.use_pmkid_only and target.wps is WPSState.UNLOCKED and AttackWPS.can_attack_wps():
+            # For WPA3, WPS is not applicable in the same way.
+            # WPS is generally being phased out with WPA3, though some transition modes might exist.
+            # We will only attempt WPS if it's explicitly WPA or WPA2 (not WPA3).
+            if target.primary_encryption != 'WPA3' and \
+               not Configuration.use_pmkid_only and \
+               target.wps is WPSState.UNLOCKED and \
+               AttackWPS.can_attack_wps():
+
                 # Pixie-Dust
                 if Configuration.wps_pixie:
                     attacks.append(AttackWPS(target, pixie_dust=True))
 
                 # Null PIN zero-day attack
-                if Configuration.wps_pin:
+                if Configuration.wps_pin: # This implies not wps_pixie_only
                     attacks.append(AttackWPS(target, pixie_dust=False, null_pin=True))
 
                 # PIN attack
-                if Configuration.wps_pin:
+                if Configuration.wps_pin: # This implies not wps_pixie_only
                     attacks.append(AttackWPS(target, pixie_dust=False))
 
-            if not Configuration.wps_only:
+            # PMKID and Handshake attacks are applicable to WPA, WPA2, and WPA3
+            if not Configuration.wps_only: # If --wps-only is not set
                 # PMKID
-                attacks.append(AttackPMKID(target))
+                if not Configuration.dont_use_pmkid: # If --no-pmkid is not set
+                    attacks.append(AttackPMKID(target))
 
                 # Handshake capture
+                if not Configuration.use_pmkid_only: # If --pmkid (means pmkid-only) is not set
+                    attacks.append(AttackWPA(target))
+            elif target.primary_encryption == 'WPA3' and Configuration.wps_only:
+                # Special case: If it's WPA3 and --wps-only is specified,
+                # WPS attacks are skipped. We should still allow PMKID/Handshake for WPA3.
+                Color.pl('{!} {O}Note: --wps-only is active, but target is WPA3. WPS attacks are not applicable.')
+                Color.pl('{+} {C}Proceeding with PMKID and Handshake attacks for WPA3 target.{W}')
+                if not Configuration.dont_use_pmkid:
+                    attacks.append(AttackPMKID(target))
                 if not Configuration.use_pmkid_only:
                     attacks.append(AttackWPA(target))
 
+
         if not attacks:
             Color.pl('{!} {R}Error: {O}Unable to attack: no attacks available')
             return True  # Keep attacking other targets (skip)

wifite/attack/wpa.py

@@ -2,7 +2,8 @@
 # -*- coding: utf-8 -*-
 
 from ..model.attack import Attack
-from ..tools.aircrack import Aircrack
+from ..tools.aircrack import Aircrack # Still used for other things like WEP
+from ..tools.hashcat import Hashcat
 from ..tools.airodump import Airodump
 from ..tools.aireplay import Aireplay
 from ..config import Configuration
@@ -65,17 +66,29 @@ def run(self):
             self.success = False
             return False
 
-        Color.pl('\n{+} {C}Cracking WPA Handshake:{W} Running {C}aircrack-ng{W} with '
-                 '{C}%s{W} wordlist' % os.path.split(Configuration.wordlist)[-1])
+        # Determine if the target is WPA3-SAE
+        target_is_wpa3_sae = self.target.primary_authentication == 'SAE'
+
+        cracker = "Hashcat" # Default to Hashcat
+        # TODO: Potentially add a fallback or user choice for aircrack-ng for non-SAE?
+        # For now, transitioning WPA/WPA2 cracking to Hashcat as well for consistency,
+        # as Hashcat mode 2500 (hccapx) is generally preferred over aircrack-ng.
+        # Aircrack.crack_handshake might be removed or kept for WEP only in future.
+
+        Color.pl(f'\n{{+}} {{C}}Cracking {"WPA3-SAE" if target_is_wpa3_sae else "WPA/WPA2"} Handshake:{{W}} Running {{C}}{cracker}{{W}} with '
+                 f'{{C}}{os.path.split(Configuration.wordlist)[-1] if Configuration.wordlist else "default wordlist"}{{W}} wordlist')
+
+        try:
+            key = Hashcat.crack_handshake(handshake, target_is_wpa3_sae, show_command=Configuration.verbose > 1)
+        except ValueError as e: # Catch errors from hash file generation (e.g. bad capture)
+            Color.pl(f"[!] Error during hash file generation for cracking: {e}")
+            key = None
 
-        # Crack it
-        key = Aircrack.crack_handshake(handshake, show_command=False)
         if key is None:
-            Color.pl('{!} {R}Failed to crack handshake: {O}%s{R} did not contain password{W}' %
-                     Configuration.wordlist.split(os.sep)[-1])
+            Color.pl(f"[!] Failed to crack handshake: {Configuration.wordlist.split(os.sep)[-1] if Configuration.wordlist else 'Wordlist'} did not contain password")
             self.success = False
         else:
-            Color.pl('{+} {G}Cracked WPA Handshake{W} PSK: {G}%s{W}\n' % key)
+            Color.pl(f"[+] Cracked {'WPA3-SAE' if target_is_wpa3_sae else 'WPA/WPA2'} Handshake Key: {key}\n")
             self.crack_result = CrackResultWPA(handshake.bssid, handshake.essid, handshake.capfile, key)
             self.crack_result.dump()
             self.success = True

wifite/config.py

@@ -148,7 +148,9 @@ def initialize(cls, load_interface=True):
         cls.wep_keep_ivs = False  # Retain .ivs files across multiple attacks.
 
         # WPA variables
-        cls.wpa_filter = False  # Only attack WPA networks
+        cls.wpa_filter = False  # Only attack WPA/WPA2 networks
+        cls.wpa3_filter = False # Only attack WPA3 networks
+        cls.owe_filter = False # Only attack OWE networks
         cls.wpa_deauth_timeout = 15  # Wait time between deauths
         cls.wpa_attack_timeout = 300  # Wait time before failing
         cls.wpa_handshake_dir = 'hs'  # Dir to store handshakes
@@ -428,6 +430,12 @@ def parse_wpa_args(cls, args):
         if args.wpa_filter:
             cls.wpa_filter = args.wpa_filter
 
+        if hasattr(args, 'wpa3_filter') and args.wpa3_filter:
+            cls.wpa3_filter = args.wpa3_filter
+
+        if hasattr(args, 'owe_filter') and args.owe_filter:
+            cls.owe_filter = args.owe_filter
+
         if args.wordlist:
             if not os.path.exists(args.wordlist):
                 cls.wordlist = None
@@ -558,16 +566,23 @@ def parse_encryption(cls):
         cls.encryption_filter = []
         if cls.wep_filter:
             cls.encryption_filter.append('WEP')
-        if cls.wpa_filter:
-            cls.encryption_filter.append('WPA')
-        if cls.wps_filter:
+        if cls.wpa_filter: # WPA/WPA2
+            cls.encryption_filter.append('WPA') 
+        if cls.wpa3_filter:
+            cls.encryption_filter.append('WPA3')
+        if cls.owe_filter:
+            cls.encryption_filter.append('OWE')
+        if cls.wps_filter: # WPS can be on WPA/WPA2
             cls.encryption_filter.append('WPS')
 
-        if len(cls.encryption_filter) == 3:
-            Color.pl('{+} {C}option:{W} targeting {G}all encrypted networks{W}')
-        elif not cls.encryption_filter:
-            # Default to scan all types
-            cls.encryption_filter = ['WEP', 'WPA', 'WPS']
+        cls.encryption_filter = sorted(list(set(cls.encryption_filter))) # Remove duplicates and sort
+
+        if not cls.encryption_filter:
+            # Default to scan all known types if no specific filter is chosen
+            cls.encryption_filter = ['WEP', 'WPA', 'WPA3', 'OWE', 'WPS']
+            Color.pl('{+} {C}option:{W} targeting {G}all known encryption types{W} by default')
+        elif len(cls.encryption_filter) == 5 and 'WPS' in cls.encryption_filter and 'OWE' in cls.encryption_filter: # Approximation for "all"
+             Color.pl('{+} {C}option:{W} targeting {G}all specified encrypted networks{W}')
         else:
             Color.pl('{+} {C}option:{W} targeting {G}%s-encrypted{W} networks' % '/'.join(cls.encryption_filter))
 

wifite/model/target.py

@@ -61,9 +61,9 @@ def __init__(self, fields):
                     2 Last time seen  (2015-05-27 19:28:46)
                     3 channel         (6)
                     4 Speed           (54)
-                    5 Privacy         (WPA2)
+                    5 Privacy         (WPA2 OWE)
                     6 Cipher          (CCMP TKIP)
-                    7 Authentication  (PSK)
+                    7 Authentication  (PSK SAE)
                     8 Power           (-62)
                     9 beacons         (2)
                     10 # IV           (0)
@@ -76,20 +76,37 @@ def __init__(self, fields):
         self.wps = WPSState.NONE
         self.bssid = fields[0].strip()
         self.channel = fields[3].strip()
-        self.encryption = fields[5].strip()
-        self.authentication = fields[7].strip()
-
-        # airodump sometimes does not report the encryption type for some reason
-        # In this case (len = 0), defaults to WPA (which is the most common)
-        if 'WPA' in self.encryption or len(self.encryption) == 0:
-            self.encryption = 'WPA'
+        self.encryption = fields[5].strip() # Contains encryption type(s) like "WPA2 WPA3 OWE"
+        self.authentication = fields[7].strip() # Contains auth type(s) like "PSK SAE MGT"
+
+        # Determine primary encryption and auth
+        if 'WPA3' in self.encryption:
+            self.primary_encryption = 'WPA3'
+        elif 'WPA2' in self.encryption:
+            self.primary_encryption = 'WPA2'
+        elif 'WPA' in self.encryption: # Handles cases where only "WPA" is present or if no other WPAx is found
+            self.primary_encryption = 'WPA'
         elif 'WEP' in self.encryption:
-            self.encryption = 'WEP'
-        elif 'WPS' in self.encryption:
-            self.encryption = 'WPS'
+            self.primary_encryption = 'WEP'
+        elif 'OWE' in self.encryption: # Opportunistic Wireless Encryption
+            self.primary_encryption = 'OWE'
+        elif len(self.encryption) == 0: # Default to WPA if not specified, as per old logic
+            self.primary_encryption = 'WPA'
+        else: # Fallback for unknown types
+            self.primary_encryption = self.encryption.split(' ')[0]
+
+
+        if 'SAE' in self.authentication:
+            self.primary_authentication = 'SAE'
+        elif 'PSK' in self.authentication:
+            self.primary_authentication = 'PSK'
+        elif 'MGT' in self.authentication: # Enterprise
+            self.primary_authentication = 'MGT'
+        elif 'OWE' in self.authentication: # OWE uses its own auth mechanism
+            self.primary_authentication = 'OWE'
+        else:
+            self.primary_authentication = self.authentication.split(' ')[0]
 
-        if len(self.encryption) > 4:
-            self.encryption = self.encryption[:4].strip()
 
         self.power = int(fields[8].strip())
         if self.power < 0:
@@ -119,6 +136,14 @@ def __init__(self, fields):
 
         self.clients = []
 
+        # Store full encryption and authentication strings for detailed info if needed
+        self.full_encryption_string = self.encryption
+        self.full_authentication_string = self.authentication
+        # For compatibility with existing logic that expects a single string:
+        self.encryption = self.primary_encryption # Overwrite with primary for now
+        self.authentication = self.primary_authentication # Overwrite with primary for now
+
+
         self.validate()
 
     def __eq__(self, other):
@@ -142,6 +167,15 @@ def transfer_info(self, other):
                 other.essid_known = self.essid_known
                 other.essid_len = self.essid_len
 
+        # Transfer new fields as well
+        if hasattr(self, 'primary_encryption'):
+            other.primary_encryption = self.primary_encryption
+            other.full_encryption_string = self.full_encryption_string
+        if hasattr(self, 'primary_authentication'):
+            other.primary_authentication = self.primary_authentication
+            other.full_authentication_string = self.full_authentication_string
+
+
     def validate(self):
         """ Checks that the target is valid. """
         if self.channel == '-1':
@@ -203,16 +237,35 @@ def to_str(self, show_bssid=False, show_manufacturer=False):
         channel_color = '{C}' if int(self.channel) > 14 else '{G}'
         channel = Color.s(f'{channel_color}{str(self.channel).rjust(3)}')
 
-        encryption = self.encryption.rjust(3)
-        if 'WEP' in encryption:
-            encryption = Color.s('{G}%s' % encryption)
-        elif 'WPA' in encryption:
-            if 'PSK' in self.authentication:
-                encryption = Color.s('{O}%s-P' % encryption)
-            elif 'MGT' in self.authentication:
-                encryption = Color.s('{R}%s-E' % encryption)
-            else:
-                encryption = Color.s('{O}%s  ' % encryption)
+        # Use primary_encryption and primary_authentication for display
+        display_encryption = self.primary_encryption.rjust(4) # Adjusted rjust for WPA3
+        auth_suffix = ''
+        if self.primary_encryption == 'WPA3':
+            display_encryption = Color.s('{P}%s' % display_encryption) # Purple for WPA3
+            if self.primary_authentication == 'SAE':
+                auth_suffix = Color.s('{P}-S') # Purple for SAE
+            elif self.primary_authentication == 'MGT':
+                 auth_suffix = Color.s('{R}-E') # Red for Enterprise
+        elif self.primary_encryption == 'WPA2':
+            display_encryption = Color.s('{O}%s' % display_encryption) # Orange for WPA2
+            if self.primary_authentication == 'PSK':
+                auth_suffix = Color.s('{O}-P')
+            elif self.primary_authentication == 'MGT':
+                auth_suffix = Color.s('{R}-E')
+        elif self.primary_encryption == 'WPA':
+            display_encryption = Color.s('{O}%s' % display_encryption) # Orange for WPA
+            if self.primary_authentication == 'PSK':
+                auth_suffix = Color.s('{O}-P')
+            elif self.primary_authentication == 'MGT':
+                auth_suffix = Color.s('{R}-E')
+        elif self.primary_encryption == 'WEP':
+            display_encryption = Color.s('{G}%s' % display_encryption) # Green for WEP
+        elif self.primary_encryption == 'OWE':
+            display_encryption = Color.s('{B}%s' % display_encryption) # Blue for OWE
+        else:
+            display_encryption = Color.s('{W}%s' % display_encryption) # White for others
+
+        encryption_display_string = f"{display_encryption}{auth_suffix}".ljust(7) # Ensure consistent length
 
         power = f'{str(self.power).rjust(3)}db'
         if self.power > 50:
@@ -238,7 +291,7 @@ def to_str(self, show_bssid=False, show_manufacturer=False):
         if len(self.clients) > 0:
             clients = Color.s('{G}  ' + str(len(self.clients)))
 
-        result = f'{essid}  {bssid}{manufacturer}{channel}  {encryption}  {power}  {wps}  {clients}'
+        result = f'{essid}  {bssid}{manufacturer}{channel}  {encryption_display_string}  {power}  {wps}  {clients}'
 
         result += Color.s('{W}')
         return result