312-50 Question 380
Single answer▪ Wireless Hacking MethodologyDuring an authorized wireless assessment, you discover a target corporate SSID uses WPA2-PSK and WPS is disabled. Passive capture shows no nearby clients are reconnecting, so you do not yet have a 4-way handshake. The rules of engagement allow limited disruption to obtain evidence of weak wireless credentials, but they prohibit password spraying against production services. Which action is the most appropriate next step to obtain material for an offline password-cracking attempt while minimizing impact?
- A
Send a targeted deauthentication frame to a connected client, capture the resulting WPA2 4-way handshake, and then attempt offline cracking of the PSK
- B
Launch an online brute-force attack directly against the access point's WPA2 authentication process until the PSK is accepted
- C
Exploit WPS PIN enrollment to recover the WPA2 passphrase from the access point
- D
Capture ARP traffic from the wireless network and use it to derive the WPA2-PSK without a handshake
Show answer and explanation
Correct answer: A
Explanation
For WPA2-PSK networks, the ethical hacking methodology is to first identify the protection type and attack surface, then collect the cryptographic material needed for offline analysis. With WPS disabled, there is no WPS PIN path. Without a captured 4-way handshake or PMKID, you do not yet have what is needed for practical offline password cracking. If passive monitoring does not yield a handshake, a narrowly scoped deauthentication of an already connected client is a common and effective technique to trigger reconnection and capture the handshake. After capture, tools can test candidate passphrases offline without repeated interaction with the target AP, reducing operational risk. This approach is consistent with industry wireless assessment practice and guidance from wireless security tooling documentation such as Aircrack-ng methodology, as well as the IEEE 802.11i/WPA2 authentication model in which the 4-way handshake is used to confirm possession of the PMK derived from the PSK.
- A. Correct.
Correct. In WPA/WPA2-PSK assessments, the standard methodology is to capture a valid 4-way handshake or PMKID and then perform offline cracking against the captured material. If no client naturally reconnects, a limited deauthentication of a connected station can trigger reauthentication and produce the handshake with relatively low impact compared to sustained disruption. This aligns with common wireless testing workflow used in CEH-level scenarios: reconnaissance, capture authentication material, then conduct offline key recovery.
- B. Incorrect.
Incorrect. WPA2-PSK is not typically attacked by repeatedly submitting password guesses online to the access point in the way web or VPN logins might be. The practical and accepted method is offline cracking after capturing handshake material. An online brute-force approach is inefficient, noisy, likely operationally disruptive, and may violate rules of engagement even if password spraying against other services is prohibited.
- C. Incorrect.
Incorrect. The scenario explicitly states that WPS is disabled. WPS PIN attacks depend on WPS being enabled and vulnerable; if it is disabled, that attack path is not applicable. This option reflects a common mistake of choosing a known wireless attack without validating that the prerequisite feature is present.
- D. Incorrect.
Incorrect. ARP traffic can be useful in some legacy wireless attack workflows, especially around packet replay or traffic generation in older WEP scenarios, but ARP packets do not let you derive a WPA2-PSK by themselves. For WPA2-PSK, you need authentication material such as a 4-way handshake or PMKID to validate password guesses offline.