312-50 Question 383
Single answer▪ Wireless Hacking ToolsDuring an authorized wireless security assessment, you need to evaluate whether a client's WPA2-PSK wireless network is vulnerable to offline password cracking. The client has provided written approval to test only their SSID, and you want to minimize disruption to users while capturing the material needed for analysis. Which tool is the most appropriate choice to capture the WPA/WPA2 4-way handshake for this purpose?
- A
Aircrack-ng suite using airodump-ng to monitor the target channel and capture the handshake
- B
Kismet in passive mode because it can directly crack WPA2-PSK once it detects the SSID
- C
NetStumbler because it can force modern WPA2 clients to reconnect and export the handshake
- D
Wifite because it is primarily a WEP-only auditing tool and cannot assist with WPA2 handshake capture
Show answer and explanation
Correct answer: A
Explanation
To assess WPA2-PSK strength, an ethical hacker typically needs to capture the 4-way handshake and then perform offline password auditing against that capture using authorized wordlists or rule sets. Among widely recognized wireless assessment tools, the Aircrack-ng suite is a standard choice, with airodump-ng commonly used to monitor a target BSSID and capture handshake traffic on the appropriate channel. Kismet is valuable for passive detection and situational awareness, but it is not itself a WPA2 cracking solution. NetStumbler is outdated for this use case and lacks the packet-capture role expected in modern WPA2 assessments. Wifite can automate parts of wireless auditing, but it is not accurate to describe it as WEP-only, and for a focused CEH-style question on handshake capture, airodump-ng is the best answer. This reflects established wireless testing practices and the documented capabilities of these tools in their respective project documentation.
- A. Correct.
Correct. In a real CEH-style assessment, the Aircrack-ng suite is a standard and appropriate toolset for WPA/WPA2 testing. Specifically, airodump-ng can passively monitor the target access point on the correct channel and capture the WPA/WPA2 4-way handshake when a client associates or re-associates. That captured handshake can then be used for authorized offline password auditing. This aligns with common wireless assessment workflows and minimizes unnecessary interference when used carefully.
- B. Incorrect.
Incorrect. Kismet is a powerful wireless detector, sniffer, and IDS tool that excels at passive discovery and monitoring, but it does not directly crack WPA2-PSK merely by detecting an SSID. A common misconception is that discovery tools automatically perform credential attacks. In practice, Kismet can help identify networks and clients, but the actual handshake capture and offline cracking workflow typically involves other specialized tools.
- C. Incorrect.
Incorrect. NetStumbler is an older wireless discovery tool primarily associated with identifying access points, especially on legacy Windows-based assessments. It is not the appropriate modern choice for capturing WPA2 4-way handshakes or forcing client reconnections in current wireless engagements. Selecting it reflects the misconception that any wireless scanner can perform packet-capture-based WPA2 auditing.
- D. Incorrect.
Incorrect. Wifite is not a WEP-only tool. It is an automated wireless auditing wrapper that can assist with attacks against WEP, WPA/WPA2, and sometimes WPS, depending on the environment and installed supporting tools. However, the question asks for the most appropriate tool specifically to capture the handshake with controlled methodology. While Wifite may automate such workflows, the more directly accurate answer for targeted handshake capture is airodump-ng from the Aircrack-ng suite.