WPAxFuzz: Sniffing Out Vulnerabilities in Wi-Fi Implementations

This work attempts to provide a way of scrutinizing the security robustness Wi-Fi implementations in an automated fashion. To this end, our knowledge, we contribute first full-featured and extensible fuzzer. At time writing, tool, made publicly available as open source, covers IEEE 802.11 management control frame types provides separate module for pair messages Simultaneous Authentication Equals (SAE) authentication key exchange method. It can be primarily used detect vulnerabilities potentially existing wireless Access Points (AP) under newest Protected 3 (WPA3) certification, but its functionalities also exploited against WPA2-compatible APs. Moreover, fuzzer incorporates: (a) dual-mode network monitoring that monitors, real time, behavior connected AP stations logs possible service or connection disruptions (b) attack tool verify any glitches found automatically craft corresponding exploit. We present results after testing assortment off-the-shelf APs by different renowned vendors. Adhering coordinated disclosure process, have reported discovered issues affected vendors, already receiving positive feedback from some them.