INSTALLATION
Requires libssl and libpcap

tar xvfz xtest-1.xx.tar.gz
cd xtest-1.xx.tar
./configure
make && make install

USAGE CASES
1.  Using the 802.1x Supplicant to authenticate to an ethernet switch with 802.1x EAP-MD5 Authentication method enabled:
./xtest -u username -p password -r

2.  EAP-MD5 is a weak authentication method that is vulnerable to an offline dictionary attack.  Unfortunately, it appears to be used to protect IP Phones and VoIP Infrastructure, as tested firmware in vendor IP Phones use EAP-MD5.  Assuming that you have captured a network trace from an IP Phone's 802.1x Supplicant successfully authenticating to the ethernet switch:
./xtest -c file.pcap -w dict.txt

WHAT IS XTEST?
XTest is a simple, practical, and free, wired 802.1x supplicant security tool implementing the RFC 3847 EAP-MD5 Authentication method.  It can be used to assess the password strength within wired ethernet environments that rely on 802.1x to protect IP Phones and the VoIP Infrastructure against rogue PC access.  XTest is developed in C and freely available to anyone, under the GPLv3 license.

WHY?
XTest was developed with the specific aim of improving the security of environments that use 802.1x to protect IP Phone endpoints and their supporting VoIP Infrastructure.  With the increasing prevalence of 802.1x Supplicant support in wired hard Phones, 802.1x will be increasingly used to ensure that remote IP Phones placed in areas with low physical security will have their directly connected ethernet switch ports secured against unauthorized access.  Furthermore, the tool can demonstrate the danger[1,2] of relying solely on 802.1x, because the current wired 802.1x implementation only requires authentication when the port initially comes up/up.  Subsequent packets are not authenticated, allowing an attacker to share a connection on a hub with the valid 802.1x supplicant, allowing unauthorized switchport access.

FEATURES
* 802.1x Supplicant:  XTest can test the username and password against an 802.1x Authenticator (Ethernet Switch), and supports re-authentication.  This is a simple and easy method of comparing the password against a valid 802.1x Supplicant running on an IP Phone or a PC.
* Offline pcap dictionary attacK:  If you capture a valid 802.1x authentication sequence into a pcap file, XTest will run a dictionary attack against the pcap using a supplied wordlist.  XTest will elicit the password from the pcap if the dictionary file contains the valid password.
* Shared Hub unauthorized access:  Using a shared hub, XTest can use the successful authentication of a valid 802.1x supplicant to gain unauthorized access to the network.

REQUIREMENTS:
libpcap
XTest is designed for, and has been tested on, BackTrack.  It runs just fine in a default installation of BackTrack.

TESTED PLATFORMS:
802.1x Supplicants:
Cisco Unified IP Phone 7971G-GE
Cisco Unified IP Phone 7961G-GE
Cisco Unified IP Phone 7941G-GE
Cisco Unified IP Phone 7942G
Cisco Unified IP Phone 7945G

802.1x Authenticator:
Cisco Catalyst 3560 (WS-C3560G-24PS)

Radius Server:
CiscoSecure ACS 4.1


CREDITS:
Josh Wright and his eapmd5pass
Steve Riley
Svyatoslav Pidgorny

Feedback:
viper@viperlab.net


AUTHOR(S):
VIPER Lab
Arjun Sambamoorthy
Sabareesan Soundarapandian
Abhijeet Hatekar
Jason Ostrom

[1] Article:  "Steve Riley on Security"
http://blogs.technet.com/steriley/archive/2005/08/11/August-article_3A00_-802.1X-on-wired-networks-considered-harmful.aspx

[2] "Getting Around 802.1x Port-based Network Access Control Through Physical Insecurity"
http://sl.mvps.org/docs/802dot1x.htm
