CEH Wireless Network Hacking 2 — Questions and Answers
Question 1: The KRACK (Key Reinstallation Attack) vulnerability affects which wireless security protocol?
- WEP
- WPA2 (Correct answer)
- WPA3
- 802.1X EAP-TLS
Correct answer: WPA2
KRACK exploits a flaw in the WPA2 four-way handshake, allowing an attacker to force nonce reuse by replaying handshake messages, potentially decrypting encrypted traffic.
Question 2: An attacker uses airodump-ng and discovers an access point with ESSID <length: 0>. What does this indicate?
- The AP is using WPA3 encryption
- The AP has SSID broadcast disabled (hidden SSID) (Correct answer)
- The AP has no clients connected
- The AP is a honeypot
Correct answer: The AP has SSID broadcast disabled (hidden SSID)
When an access point's SSID broadcast is disabled, tools like airodump-ng display the ESSID as empty or with length 0; the SSID can still be discovered through probe requests from clients.
Question 3: Which Bluetooth attack allows an attacker to send unsolicited messages or files to a discoverable Bluetooth device without pairing?
- Bluesnarfing
- Bluebugging
- Bluejacking (Correct answer)
- KNOB attack
Correct answer: Bluejacking
Bluejacking involves sending unsolicited messages (like vCards or text) to a discoverable Bluetooth device without requiring authentication or pairing.
Question 4: What technique does an attacker use to bypass MAC address filtering on a wireless network?
- Replay packets captured from the network
- Sniff the WLAN to capture a legitimate client's MAC address and spoof it (Correct answer)
- Crack the WPA2 key first, then change MAC filtering settings
- Use a directional antenna to overpower the AP signal
Correct answer: Sniff the WLAN to capture a legitimate client's MAC address and spoof it
MAC filtering is easily bypassed by passively monitoring the wireless network to identify an allowed MAC address, then spoofing that MAC on the attacker's wireless adapter.
Question 5: Wardriving is defined as:
- Cracking WPA2 passwords while stationary at a coffee shop
- Driving around in a vehicle with a Wi-Fi-enabled device to discover and map wireless networks (Correct answer)
- Using a directional antenna to attack a specific building's Wi-Fi
- Intercepting wireless traffic by parking near a target location
Correct answer: Driving around in a vehicle with a Wi-Fi-enabled device to discover and map wireless networks
Wardriving involves traveling through an area while using wireless scanning tools to discover, log, and sometimes map wireless networks, often combined with GPS.
Question 6: Which tool is commonly used as a rogue access point and wireless man-in-the-middle platform, often called the 'Hacker's Swiss Army Knife for Wi-Fi'?
- Kismet
- InSSIDer
- Wi-Fi Pineapple (Correct answer)
- NetStumbler
Correct answer: Wi-Fi Pineapple
The Wi-Fi Pineapple is a hardware platform designed for wireless auditing and man-in-the-middle attacks, capable of auto-associating clients and intercepting their traffic.
Question 7: In 802.11 terminology, what is a 'probe request' and how can attackers exploit it?
- A management frame sent by APs to announce their presence; exploited to flood the channel
- A management frame sent by clients searching for known networks; exploited to discover hidden SSIDs and track device movement (Correct answer)
- A control frame used in WPA3 handshakes; exploited via KRACK
- A data frame carrying EAPOL keys; exploited to recover PMK
Correct answer: A management frame sent by clients searching for known networks; exploited to discover hidden SSIDs and track device movement
Probe requests are sent by client devices to actively search for previously connected networks; attackers use them to discover hidden SSIDs and track users based on their device's preferred network list.
CEH Wireless Network Hacking 2
The KRACK (Key Reinstallation Attack) vulnerability affects which wireless security protocol?