A penetration tester is attempting to capture a handshake between a client and an access point by monitoring a WPA2-PSK secured wireless network. The tester is monitoring the correct channel for the…

A Karma attack responds to client probe requests by impersonating any requested SSID to lure clients to a rogue AP, which is an evil twin technique unrelated to capturing a legitimate WPA2 handshake.

A deauthentication attack sends spoofed 802.11 deauth frames to a connected client, forcibly disconnecting it from the access point. When the client reconnects, it performs the WPA2 4-way handshake, which the tester can then capture from the monitored channel. This is the standard technique for obtaining a handshake without waiting passively for a natural reconnection event.

A fragmentation attack exploits weaknesses in the WEP protocol to reconstruct keystreams and is not applicable to WPA2-secured networks.

An SSID broadcast flood is not a recognized standard attack technique for forcing handshake capture and would not cause a targeted client to re-authenticate to its legitimate AP.