CEH Wireless Network Hacking 1

Question 1

Which fundamental cryptographic weakness in WEP makes it vulnerable to key recovery attacks?

Accepted Answer

Reuse of short 24-bit Initialization Vectors leading to keystream collisions

Answer

WEP uses a 24-bit IV that cycles rapidly in busy networks, causing IV reuse and allowing attackers to recover the RC4 keystream and decrypt traffic.

Question 2

During a WPA2-Personal attack, an attacker captures the four-way handshake. What is the attacker's next step to crack the passphrase?

Accepted Answer

Perform a dictionary or brute-force attack against the captured EAPOL handshake offline

Answer

The captured four-way handshake contains enough information to perform an offline dictionary or brute-force attack to guess the pre-shared key without further interaction with the network.

Question 3

An attacker sets up an access point with the same SSID as a legitimate network and a stronger signal to lure victims. This attack is called a(n):

Accepted Answer

Rogue AP / Evil Twin attack

Answer

An Evil Twin (or Rogue AP) attack involves creating a fraudulent access point that mimics a legitimate one, causing clients to connect to it instead and enabling traffic interception.

Question 4

Which tool is most commonly used in CEH scenarios to capture WPA/WPA2 handshakes and crack wireless keys using wordlists?

Accepted Answer

Aircrack-ng

Answer

Aircrack-ng is the standard wireless security auditing suite that includes tools for capturing handshakes (airodump-ng) and cracking them (aircrack-ng) using dictionary attacks.

Question 5

What is the primary vulnerability exploited by the WPS PIN attack (Reaver)?

Accepted Answer

The WPS PIN is split into two halves that can be brute-forced independently, reducing combinations from 10^8 to ~11,000

Answer

The WPS protocol verifies the two halves of the 8-digit PIN separately, reducing the brute-force search space from 100 million to about 11,000 combinations.

CEH Practice Test

CEH Practice Test

CEH Wireless Network Hacking 1