312-50 Question 469
Single answer▪ CryptanalysisDuring an authorized wireless security assessment, you capture a WPA/WPA2-PSK 4-way handshake from a client's access point. The organization wants you to demonstrate whether weak passphrases can be recovered without interacting further with the live network. Which action is the MOST appropriate cryptanalysis step to take next?
- A
Perform an offline dictionary or rule-based attack against the captured handshake using candidate passphrases
- B
Replay the captured handshake packets to force the access point to reveal the pre-shared key in plaintext
- C
Use the captured handshake to derive the private key of the access point's TLS certificate
- D
Launch a SQL injection attack against the wireless controller to recover the WPA/WPA2 pre-shared key
Show answer and explanation
Correct answer: A
Explanation
The key cryptanalysis concept here is that WPA/WPA2-PSK security depends heavily on passphrase strength. After capturing a valid 4-way handshake, an attacker or assessor can conduct offline password guessing because each guess can be validated locally without sending packets to the access point. This makes weak or common passphrases especially vulnerable. This aligns with practical guidance from Wi-Fi security best practices and industry documentation: WPA/WPA2-PSK is resistant to direct key disclosure, but weak passwords are susceptible to offline dictionary, brute-force, or rule-based attacks once handshake material is captured. In contrast, replaying the handshake does not reveal the PSK, unrelated key systems such as TLS certificates cannot be derived from the capture, and SQL injection is a different attack class entirely.
- A. Correct.
Correct. In WPA/WPA2-PSK, the 4-way handshake provides enough material to verify password guesses offline. An assessor can test candidate passphrases by deriving the Pairwise Master Key (PMK) from the guessed passphrase and SSID, then checking whether the computed values match the captured handshake data. This is a practical cryptanalysis technique because it targets weak passwords without generating additional traffic against the production network.
- B. Incorrect.
Incorrect. Replaying a captured 4-way handshake does not cause the access point to disclose the pre-shared key in plaintext. The handshake proves possession of keying material and establishes session keys; it does not transmit the PSK itself. This option reflects a common misconception that captured authentication exchanges can simply be replayed to reveal secrets.
- C. Incorrect.
Incorrect. A WPA/WPA2 4-way handshake is unrelated to deriving a TLS certificate's private key. Wireless PSK authentication and public key certificate systems are separate cryptographic mechanisms. Capturing one does not provide a feasible method for recovering the other.
- D. Incorrect.
Incorrect. SQL injection is a web application attack technique, not a cryptanalysis step applied to a captured wireless handshake. While compromising a controller through another vulnerability could potentially expose configuration data, it is outside the scope of cryptanalysis of the captured WPA/WPA2 exchange and does not address the requirement to proceed without further interaction with the live network.