EC-Council Certified Ethical Hacker (CEH) v12

Recovering the Pre-Shared Key (PSK) for a WPA2-Personal network, typically after capturing a 4-way handshake, often involves offline dictionary or brute-force attacks.

• Requires capturing the 4-way handshake between a client and AP.
• Attacks are performed offline against the captured handshake.
• PSK strength directly impacts the feasibility of cracking.

Kismet is a powerful open-source wireless network detector, sniffer, and intrusion detection system. It passively collects 802.11 frames to discover wireless networks (APs and clients), SSIDs, detect hidden networks, and identify rogue access points or other wireless anomalies.

• Operates in passive mode, avoiding active probing.
• Analyzes raw 802.11 frames (beacon, probe, data).
• Used for network discovery, mapping, and intrusion detection.

Simultaneous Authentication of Equals (SAE) is the key exchange protocol used in WPA3-Personal, replacing the WPA2 4-way handshake, to provide stronger security against offline dictionary attacks.

• Mandatory for WPA3-Personal networks.
• Provides forward secrecy and resistance to side-channel attacks.
• Makes passive offline dictionary attacks significantly harder or impossible.

The 2.4 GHz Wi-Fi frequency band is prone to interference from a multitude of non-Wi-Fi devices, including microwave ovens, cordless phones, Bluetooth devices, and baby monitors, due to their shared use of this unlicensed spectrum.

• Shared with many common household and industrial devices.
• Fewer non-overlapping channels (3 in most regions).
• Leads to slower speeds and unreliable connections if not properly managed.

Aireplay-ng is a tool within the Aircrack-ng suite used to inject frames into a wireless network, most notably for deauthentication attacks to capture WPA/WPA2 handshakes.

• Part of the Aircrack-ng suite.
• Used to send deauthentication frames to clients.
• Forces clients to reconnect, allowing handshake capture for cracking.

A type of attack where a rogue wireless access point (AP) mimics a legitimate one, often using the same SSID, to trick unsuspecting users into connecting to it. Once connected, the attacker can intercept, monitor, or manipulate their network traffic.

• Uses a rogue AP with a spoofed SSID.
• Often targets open or easily guessable networks.
• Facilitates man-in-the-middle attacks.

Kismet is a passive wireless network detector, sniffer, and intrusion detection system that identifies wireless networks, clients, and their relationships without actively transmitting.

• Operates in passive mode, minimizing detection.
• Identifies APs, clients, SSIDs (including hidden ones).
• Can visualize network topology and client-AP associations.

PEAP (Protected Extensible Authentication Protocol) using MSCHAPv2 as its inner authentication method can be vulnerable to offline dictionary attacks if the MSCHAPv2 hashes are captured within EAPOL frames.

• PEAP creates an encrypted tunnel for inner EAP methods.
• MSCHAPv2 is a common inner method, but its hashes can be cracked offline.
• Tools like EAPHammer or Responder can be used to capture and crack these hashes.

An IEEE standard that enhances wireless network security by providing integrity protection and confidentiality for management frames (such as deauthentication, disassociation, and beacon frames). This prevents attackers from forging these frames to disrupt network operations or perform denial-of-service attacks.

• Protects management frames from spoofing and tampering.
• Uses Message Integrity Check (MIC) for integrity.
• Crucial for mitigating deauthentication and disassociation DoS attacks.

The Message Integrity Code (MIC) is a cryptographic checksum included in the WPA/WPA2 4-way handshake messages. It ensures the integrity of the handshake messages and is critical for offline passphrase cracking, as a correct passphrase will yield a matching MIC.

• Verifies integrity of handshake messages.
• Calculated using the Pairwise Transient Key (PTK).
• Used to confirm a guessed passphrase in offline cracking.

The Reaver attack is an online brute-force attack against Wi-Fi Protected Setup (WPS) PINs. It exploits a design flaw in WPS where the Access Point (AP) confirms the correctness of the first four digits of the PIN and the last three digits (plus checksum) separately, effectively dividing an 8-digit PIN into two smaller, easier-to-brute-force sections.

• Exploits WPS PIN validation in two halves.
• Significantly reduces brute-force attempts.
• Typically an online attack, can be slow but effective.

MAC address filtering, a basic wireless security measure, can be easily bypassed by an attacker who spoofs the MAC address of an authorized device.

• Relies on the uniqueness of MAC addresses for access control.
• MAC addresses are easily discoverable for active clients.
• Spoofing allows an attacker to impersonate an authorized device.

IEEE 802.11w, or Protected Management Frames (PMF), is a standard that enhances wireless network security by protecting management frames from tampering and spoofing.

• Protects deauthentication, disassociation, and other management frames.
• Mitigates denial-of-service attacks against wireless networks.
• Mandatory in WPA3 for enhanced security.

Wireless Denial-of-Service (DoS) attacks aim to prevent legitimate users from accessing a wireless network or its services, often by overwhelming the access point or exploiting vulnerabilities.

• Can involve deauthentication floods, jamming, or exploiting AP vulnerabilities.
• Impacts availability of the wireless network.
• Targeted attacks against AP firmware are a specific form of DoS.

Various devices can cause interference in the 5 GHz wireless band, impacting Wi-Fi network performance and reliability.

• 5 GHz Wi-Fi offers higher bandwidth and less congestion than 2.4 GHz.
• Sources of interference include radar, satellite communication, and certain cordless phones.
• Dynamic Frequency Selection (DFS) is used by Wi-Fi to avoid radar interference.

Rainbow tables are generally inefficient for cracking WPA2-Personal due to the use of the SSID as a salt in the PBKDF2 key derivation function. This requires a unique rainbow table to be precomputed for each potential SSID, rendering the approach impractical for universal attacks.

• SSID acts as a salt during PMK generation.
• Different SSIDs produce different PMKs for the same passphrase.
• Requires a separate rainbow table for each SSID, making it unscalable.

Enhanced Open (Opportunistic Wireless Encryption) is a Wi-Fi standard (integrated into WPA3) that provides individualized data encryption for open, public Wi-Fi networks. It secures communication between the client and the access point without requiring any pre-shared key or user authentication credentials.

• Provides opportunistic encryption for open Wi-Fi.
• Based on Diffie-Hellman key exchange for per-client session keys.
• Protects against passive eavesdropping on open networks.

A protocol that encapsulates EAP (Extensible Authentication Protocol) methods within a TLS (Transport Layer Security) tunnel, providing secure authentication, especially for username/password-based systems over 802.1X networks.

• Commonly used with WPA2-Enterprise and 802.1X.
• Establishes a secure TLS tunnel before client authentication.
• Protects EAP methods like MSCHAPv2 from eavesdropping.

EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) uses digital certificates for mutual authentication, where both the client and the authentication server verify each other's identity.

• Requires a Public Key Infrastructure (PKI).
• Provides strong protection against Man-in-the-Middle attacks.
• Client trusts the server's certificate, and the server trusts the client's certificate.

PBKDF2 (Password-Based Key Derivation Function 2) is a key stretching algorithm used in WPA/WPA2-Personal to derive the Pairwise Master Key (PMK) from the human-readable passphrase (PSK) and the SSID. Its iterative nature makes offline brute-force attacks computationally expensive.

• Takes passphrase, salt (SSID), iteration count, and key length as input.
• Generates the 256-bit PMK.
• Core component of WPA/WPA2-Personal security, and its weakness to dictionary attacks.

An Evil Twin attack often uses deauthentication frames to disconnect legitimate clients from their access points, compelling them to search for and connect to the attacker's rogue access point, which mimics the legitimate network's SSID.

• Deauthentication forces clients off network.
• Clients automatically search for known SSIDs.
• Rogue AP receives connections, enabling traffic interception.

An 802.11 deauthentication frame is a management frame used to terminate an existing connection between a wireless client and an access point.

• It is an unauthenticated frame, making it vulnerable to spoofing.
• Attackers use it to force clients to disconnect and reauthenticate.
• This action generates a 4-way handshake, which can be captured for cracking.

The most secure current wireless standard combining WPA3's enhanced cryptographic protections and key management with EAP-TLS for robust mutual authentication using digital certificates, offering superior defense against various wireless attacks.

• WPA3 provides Forward Secrecy and improved key management.
• EAP-TLS uses client and server certificates for mutual authentication.
• Offers the strongest protection against passive eavesdropping and impersonation.

Aircrack-ng is a powerful suite of tools used for auditing and cracking WEP and WPA/WPA2 wireless networks. For WEP, it leverages vulnerabilities like weak Initialization Vectors (IVs) and packet injection to gather enough data to statistically derive the WEP key.

• Uses statistical attacks (e.g., FMS attack).
• Requires collecting a large number of IVs.
• Can perform packet injection to accelerate IV collection.