Ethical Hacking Wireless Security 2 — Questions and Answers
Question 1: Which WPA2 attack captures and cracks the four-way handshake to recover the network passphrase?
- KRACK attack
- Deauth and handshake capture with Aircrack-ng (Correct answer)
- PMKID attack
- Pixie Dust attack
Correct answer: Deauth and handshake capture with Aircrack-ng
Capturing a WPA2 four-way handshake with airodump-ng (often triggered by a deauth attack) and cracking it offline with Aircrack-ng and a wordlist is the classic WPA2 attack method.
Question 2: What is the KRACK attack and which protocol does it target?
- Key Reinstallation Attack targeting WPA2 by replaying cryptographic handshake messages (Correct answer)
- Keyless Remote Access Cracking targeting automotive wireless systems
- Key Recovery Attack targeting WEP encryption
- Known-text Rainbow Attack Cryptanalysis targeting WPA3
Correct answer: Key Reinstallation Attack targeting WPA2 by replaying cryptographic handshake messages
KRACK (Key Reinstallation Attack) targets WPA2 by replaying handshake messages to reset cryptographic nonces, allowing nonce reuse that can decrypt and potentially inject wireless traffic.
Question 3: Which tool is used for wireless packet injection and monitoring in penetration tests?
- Wireshark
- Aircrack-ng (Correct answer)
- Nessus
- Metasploit
Correct answer: Aircrack-ng
The Aircrack-ng suite includes tools for packet capture (airodump-ng), packet injection (aireplay-ng), and WEP/WPA cracking (aircrack-ng), making it the standard wireless pentesting toolkit.
Question 4: What is the 'PMKID attack' and how does it differ from handshake-based WPA2 cracking?
- PMKID attack requires a client to be connected; handshake cracking does not
- PMKID attack can be performed against the AP directly without waiting for a client to connect; handshake cracking requires capturing a client connection (Correct answer)
- PMKID attack is only effective against WPA3; handshake cracking targets WPA2
- PMKID attack uses rainbow tables; handshake cracking uses wordlists
Correct answer: PMKID attack can be performed against the AP directly without waiting for a client to connect; handshake cracking requires capturing a client connection
The PMKID attack extracts a PMKID directly from the AP without waiting for a client to authenticate, making it possible to crack WPA2 passphrases with just the AP present.
Question 5: What does placing a wireless adapter in 'monitor mode' allow a penetration tester to do?
- Connect to multiple SSIDs simultaneously
- Passively capture all wireless frames in range without associating with an AP (Correct answer)
- Boost wireless signal strength for longer range attacks
- Bypass WPA2 authentication automatically
Correct answer: Passively capture all wireless frames in range without associating with an AP
Monitor mode (promiscuous mode for wireless) allows the network adapter to capture all wireless frames in range, including frames not destined for that adapter, enabling passive reconnaissance.
Question 6: What is a 'rogue access point' in the context of wireless penetration testing?
- An AP with outdated firmware vulnerable to known exploits
- An unauthorized AP set up to intercept or provide unauthorized access to a network (Correct answer)
- A legitimate AP configured with weak encryption
- An AP that broadcasts multiple SSIDs simultaneously
Correct answer: An unauthorized AP set up to intercept or provide unauthorized access to a network
A rogue access point is an unauthorized wireless AP connected to a network (often by an insider or attacker) that bypasses security controls and provides a covert entry point.
Ethical Hacking Wireless Security 2
Which WPA2 attack captures and cracks the four-way handshake to recover the network passphrase?