312-50V11 · Question #267
During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?
The correct answer is A. The tester must capture the WPA2 authentication handshake and then crack it. Cracking WPA2 requires capturing the 4-way authentication handshake between a client and access point and then performing an offline dictionary or brute-force attack against it.
Question
During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?
Options
- AThe tester must capture the WPA2 authentication handshake and then crack it.
- BThe tester must use the tool inSSIDer to crack it using the ESSID of the network.
- CThe tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
- DThe tester must change the MAC address of the wireless network card and then use the AirTraf
How the community answered
(35 responses)- A74% (26)
- B3% (1)
- C17% (6)
- D6% (2)
Why each option
Cracking WPA2 requires capturing the 4-way authentication handshake between a client and access point and then performing an offline dictionary or brute-force attack against it.
WPA2-Personal authentication generates a 4-way handshake that contains enough cryptographic material to verify a guessed passphrase without further network interaction. A penetration tester captures this handshake using a tool such as airodump-ng, then submits the capture file to an offline cracking tool like aircrack-ng or hashcat paired with a wordlist. This offline attack methodology is the standard and technically valid approach for testing WPA2-Personal pre-shared key strength.
inSSIDer is a Wi-Fi discovery and signal analysis tool, not a cracking utility, and knowing the ESSID alone provides no means to decrypt WPA2 encryption.
IEEE 802.11i compliance means WPA2 uses strong encryption algorithms, but it does not make WPA2 immune to offline dictionary attacks when the handshake has been captured and the passphrase is weak.
Spoofing a MAC address is a technique for bypassing MAC-based access control lists and has no effect on WPA2 encryption or passphrase recovery.
Concept tested: WPA2 4-way handshake capture and offline cracking
Source: https://csrc.nist.gov/publications/detail/sp/800-97/final
Topics
Community Discussion
No community discussion yet for this question.