Indirect signs of PSK being changed
#2
If the old PSK is known, hcxdumptool --weakcandidate will do that. No alert == PSK changed.
If the old PSK is known, you can use hcxpcapngtool --all option to identify PSK changes.
If ESSID and PSK changed, hcxdumptool will notify you (M1M2RGOGUE). Now compare M1M2RGOGUE results with M2M3 or M1M4 or M3M4 results.

BTW:
We must assume, that if the PSK changed by admin, authorized users will change their PSK, too.
Reply


Messages In This Thread
RE: Indirect signs of PSK being changed - by ZerBea - 04-04-2020, 08:18 AM