312-50 Question 379
Single answer▪ Wireless Hacking MethodologyDuring an authorized wireless assessment, you identify a target corporate SSID using WPA2-Personal (PSK). Passive capture shows no nearby clients are actively reconnecting, and the scope requires you to validate whether the pre-shared key is weak without disrupting production more than necessary. Which action is the most appropriate next step in the wireless hacking methodology?
- A
Capture the 4-way handshake by waiting for a legitimate client to connect, or if authorized, minimally trigger a reauthentication event, then perform an offline dictionary/brute-force attack against the captured handshake
- B
Begin flooding the access point with continuous deauthentication frames until all users disconnect, then read the plaintext password directly from the air
- C
Exploit WPS by default because all WPA2-Personal networks require WPS to be enabled and it always reveals the PSK quickly
- D
Launch an online password guessing attack directly against the access point by repeatedly attempting to associate with different PSKs until one succeeds
Show answer and explanation
Correct answer: A
Explanation
In a CEH-style wireless hacking methodology scenario, the tester should first identify the security type, then collect the appropriate authentication material, and finally attempt credential recovery in the least disruptive way allowed by scope. For WPA2-Personal, this usually means capturing a 4-way handshake during a client association or reassociation, or obtaining a PMKID when the AP supports it, and then testing the PSK offline with a wordlist or brute-force approach. This reflects common practice in tools such as Aircrack-ng or Hashcat-based workflows. Deauthentication, while often used to stimulate a reconnect, should be limited and explicitly authorized because it can interrupt service. By contrast, online guessing and assumptions about WPS are poor methodology choices. Best-practice guidance from wireless security testing and vendor documentation consistently emphasizes minimizing impact, validating scope before active interference, and preferring offline analysis where feasible.
- A. Correct.
Correct. For WPA/WPA2-Personal assessments, the standard methodology is to capture material from the 4-way handshake or a PMKID when available, then perform offline password cracking to test PSK strength. If no client is naturally reconnecting, the least disruptive authorized option is to wait for a legitimate reconnection or, if explicitly permitted, send a limited deauthentication/reassociation trigger to induce a new handshake. This aligns with practical wireless testing workflows and minimizes operational impact compared with prolonged disruption.
- B. Incorrect.
Incorrect. Deauthentication can be used in some environments to trigger a reconnect and obtain a handshake, but continuously flooding clients is unnecessarily disruptive and likely outside the requirement to avoid production impact. Also, WPA2 does not transmit the plaintext password over the air; capturing traffic does not reveal the PSK directly.
- C. Incorrect.
Incorrect. WPS is not required for WPA2-Personal, and many enterprise access points have WPS disabled. Assuming WPS is present and vulnerable is a common misconception. Even when enabled, WPS exploitation depends on the specific implementation and configuration; it is not a guaranteed or universally appropriate next step.
- D. Incorrect.
Incorrect. Repeatedly trying PSKs against the live access point is not the standard or efficient method for WPA2-PSK validation. Wireless assessments typically prefer offline cracking after handshake/PMKID capture because it avoids repeated online authentication attempts, reduces lockout and detection concerns, and is operationally more sound.