Ethical Hacking Wireless Security 1 — Questions and Answers
Question 1: Which wireless security protocol is considered obsolete and easily crackable due to weak RC4 encryption?
- WPA3
- WPA2
- WEP (Correct answer)
- 802.1X
Correct answer: WEP
WEP (Wired Equivalent Privacy) uses weak RC4 encryption with static keys and flawed IV reuse, making it crackable in minutes using tools like Aircrack-ng.
Question 2: What tool is used by ethical hackers to capture WPA2 handshakes for offline cracking?
- Nmap
- Aircrack-ng suite (airodump-ng) (Correct answer)
- Hydra
- Netcat
Correct answer: Aircrack-ng suite (airodump-ng)
Airodump-ng (part of the Aircrack-ng suite) captures 802.11 wireless packets and records WPA2 four-way handshakes that can then be cracked offline with a wordlist.
Question 3: What is a 'deauthentication attack' in wireless hacking?
- Flooding an AP with authentication requests
- Sending forged 802.11 deauthentication frames to force clients to disconnect and reauthenticate (Correct answer)
- Injecting malicious packets into encrypted wireless traffic
- Cracking the WPS PIN to recover the WPA2 passphrase
Correct answer: Sending forged 802.11 deauthentication frames to force clients to disconnect and reauthenticate
A deauthentication attack sends spoofed 802.11 deauth frames to force wireless clients offline, triggering reconnection attempts that can be captured as handshakes for cracking.
Question 4: What is an 'evil twin' wireless attack?
- Cracking a Wi-Fi password using a wordlist
- Creating a rogue AP with the same SSID as a legitimate network to intercept client traffic (Correct answer)
- Jamming legitimate wireless signals to force clients offline
- Eavesdropping on wireless traffic using a passive packet sniffer
Correct answer: Creating a rogue AP with the same SSID as a legitimate network to intercept client traffic
An evil twin attack creates a rogue access point with the same SSID and stronger signal as a legitimate AP, causing clients to connect to the attacker's AP and exposing their traffic.
Question 5: What vulnerability in WPS (Wi-Fi Protected Setup) allows its PIN to be cracked much faster than expected?
- The PIN is transmitted in plaintext during setup
- The 8-digit PIN is validated in two halves of 4 digits each, reducing possible combinations to ~11,000 (Correct answer)
- WPS uses a static PIN that never changes
- WPS disables account lockout by design
Correct answer: The 8-digit PIN is validated in two halves of 4 digits each, reducing possible combinations to ~11,000
WPS validates the 8-digit PIN in two separate 4-digit halves, reducing the brute-force search space from 100 million to only ~11,000 attempts, enabling attacks with tools like Reaver.
Question 6: What is 'wardriving'?
- Hacking wireless networks using a car antenna
- Driving around to discover and map wireless access points using a laptop and antenna (Correct answer)
- Jamming wireless signals from a moving vehicle
- Intercepting cellular communications from a car
Correct answer: Driving around to discover and map wireless access points using a laptop and antenna
Wardriving involves using a vehicle to travel through an area while scanning for available Wi-Fi networks, mapping SSIDs, encryption types, and GPS coordinates.
Ethical Hacking Wireless Security 1
Which wireless security protocol is considered obsolete and easily crackable due to weak RC4 encryption?