312-50 Question 381
Single answer▪ Wireless Hacking ToolsDuring an authorized wireless assessment of a corporate office, you discover an employee SSID using WPA2-PSK. The client wants to know whether weak pre-shared keys could be recovered without disrupting production traffic more than necessary. Several employees are actively connected to the access point, but no new devices are joining during your observation window. Which tool is the most appropriate to quickly force the capture of a usable WPA/WPA2 4-way handshake for an offline password audit in this scenario?
- A
aireplay-ng, by sending deauthentication frames to a connected client so it reconnects and generates a new handshake
- B
AirSnort, by passively collecting enough encrypted packets to recover the WPA2 pre-shared key directly
- C
Kismet, by injecting forged EAPOL frames to create a valid handshake without affecting clients
- D
Reaver, by initiating a WPS PIN brute-force attack against the WPA2-PSK network regardless of WPS status
Show answer and explanation
Correct answer: A
Explanation
The best answer is aireplay-ng because the scenario emphasizes minimizing disruption while obtaining a WPA2 handshake for offline auditing. In real assessments, a common workflow is to use airodump-ng to monitor the target BSSID and capture traffic, then use aireplay-ng to send a limited deauthentication burst to an associated station. When that client reconnects, the assessor captures the WPA/WPA2 4-way handshake and tests password strength offline. This aligns with widely documented Aircrack-ng practices for authorized testing. By contrast, AirSnort is historically tied to WEP, Kismet is mainly for passive discovery and monitoring rather than handshake generation through injection, and Reaver is a WPS-focused tool that is only applicable when WPS is enabled and in scope. From a best-practice standpoint, assessors should use the least disruptive method necessary, ensure explicit authorization for active techniques such as deauthentication, and prefer offline key auditing once a handshake is captured.
- A. Correct.
Correct. In a WPA/WPA2-PSK assessment, aireplay-ng is commonly used with compatible wireless adapters in monitor mode to send deauthentication frames to an associated client. When the client reconnects, the assessor can capture the resulting 4-way handshake using tools such as airodump-ng and then perform an offline password attack with an approved cracking tool. This is a practical technique when clients are already connected but no natural reconnect is occurring during the test window.
- B. Incorrect.
Incorrect. AirSnort is an older tool associated with attacks against WEP, not WPA2-PSK. Its packet-collection approach targeted weaknesses in WEP key recovery and does not directly recover WPA2 pre-shared keys by passively collecting traffic in the same way. Choosing this option reflects the misconception that all wireless key recovery tools work across WEP and WPA/WPA2 equally.
- C. Incorrect.
Incorrect. Kismet is primarily a wireless detection, sniffer, and IDS tool. It can discover networks, clients, and many wireless events, but it is not used to inject forged EAPOL frames to create a legitimate WPA/WPA2 handshake. A valid 4-way handshake normally occurs during client authentication or reassociation, not by simply fabricating packets with Kismet.
- D. Incorrect.
Incorrect. Reaver is designed to attack WPS implementations by brute-forcing or otherwise abusing the WPS PIN mechanism. It is not the best answer here because the scenario asks specifically for the quickest way to force capture of a usable WPA/WPA2 4-way handshake when clients are already connected. Also, Reaver depends on WPS being enabled and vulnerable, which the scenario does not establish.