nerdexam
EC-Council

312-50V9 · Question #40

During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?

The correct answer is A. The tester must capture the WPA2 authentication handshake and then crack it. WPA2 cannot be cracked in real time, but capturing the 4-way authentication handshake allows offline dictionary or brute-force attacks against the passphrase.

Hacking Wireless Networks

Question

During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?

Options

  • AThe tester must capture the WPA2 authentication handshake and then crack it.
  • BThe tester must use the tool inSSIDer to crack it using the ESSID of the network.
  • CThe tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
  • DThe tester must change the MAC address of the wireless network card and then use the AirTraf

How the community answered

(58 responses)
  • A
    86% (50)
  • B
    7% (4)
  • C
    5% (3)
  • D
    2% (1)

Why each option

WPA2 cannot be cracked in real time, but capturing the 4-way authentication handshake allows offline dictionary or brute-force attacks against the passphrase.

AThe tester must capture the WPA2 authentication handshake and then crack it.Correct

WPA2-Personal uses a 4-way handshake during client association to derive the Pairwise Transient Key (PTK). By capturing this handshake with a tool like airodump-ng (and optionally forcing a deauthentication), a tester can run offline cracking tools such as aircrack-ng or hashcat against the handshake to recover the Pre-Shared Key (PSK). This is the standard and effective method for attacking WPA2-Personal.

BThe tester must use the tool inSSIDer to crack it using the ESSID of the network.

inSSIDer is a Wi-Fi network discovery and analysis tool used for scanning and visualizing networks, not a WPA2 password cracking utility.

CThe tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.

WPA2's compliance with IEEE 802.11i does not make it immune to offline passphrase cracking - weak passphrases remain exploitable via the captured handshake attack.

DThe tester must change the MAC address of the wireless network card and then use the AirTraf

Changing the MAC address is used for identity spoofing or bypassing MAC-based access controls, not for decrypting WPA2 encryption or recovering the network key.

Concept tested: WPA2 handshake capture and offline cracking technique

Source: https://www.aircrack-ng.org/doku.php?id=cracking_wpa

Topics

#WPA2 cracking#4-way handshake capture#wireless attack methodology#802.11i

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice