312-50 Question 391
Single answer▪ Wireless Security ToolsDuring an authorized wireless assessment, you need to verify whether a client device can be forced to reconnect to a WPA2-PSK access point so that a new 4-way handshake can be captured for offline password auditing. The client is currently connected, but no new handshakes are being observed. Which tool is the most appropriate to actively trigger the reconnect event needed for this test?
- A
aireplay-ng
- B
airmon-ng
- C
aircrack-ng
- D
Kismet
Show answer and explanation
Correct answer: A
Explanation
In WPA/WPA2-PSK assessments, the 4-way handshake is captured when a client authenticates or reauthenticates to the access point. If no new handshake is naturally occurring, an assessor may, with explicit authorization, send deauthentication frames to force a reconnect. In the Aircrack-ng suite, aireplay-ng is the tool specifically associated with frame injection tasks such as deauthentication. airodump-ng is typically used alongside it to capture the resulting handshake, while aircrack-ng is used afterward for offline password auditing. airmon-ng only helps place the adapter into monitor mode, and Kismet is primarily passive. This aligns with common wireless testing workflows documented by the Aircrack-ng project and general wireless assessment best practices: prepare the adapter for monitor mode, capture traffic, trigger a reconnect if authorized, then perform offline analysis.
- A. Correct.
Correct. aireplay-ng is used for wireless frame injection tasks, including sending deauthentication frames to disconnect a client from an AP. In an authorized test, this can force the client to reconnect, allowing the assessor to capture a fresh WPA/WPA2 4-way handshake with a separate capture tool such as airodump-ng. This is a standard practical use of aireplay-ng within the Aircrack-ng suite.
- B. Incorrect.
Incorrect. airmon-ng is primarily used to enable and manage monitor mode on wireless interfaces and to help identify interfering processes. It prepares the interface for sniffing or injection but does not itself perform the deauthentication attack used to force a reconnect.
- C. Incorrect.
Incorrect. aircrack-ng is mainly used to perform offline key cracking or password auditing against captured handshakes or IVs. It does not trigger client disconnects or generate the wireless management frames needed to force a new handshake capture.
- D. Incorrect.
Incorrect. Kismet is a powerful passive wireless detection and IDS tool used for discovering networks, clients, and wireless events. While it is excellent for monitoring and reconnaissance, it is not the standard tool in this scenario for actively injecting deauthentication frames to trigger a reconnect.