Wireless encryption keeps your Wi-Fi data private even though it travels through open air that anyone can sniff. For the CEH exam, you must understand which standards are strong (WPA2, WPA3), which is broken (WEP), and how attackers capture handshakes to crack passwords.
Jump to a section
A simple way to picture Hacking Wireless Networks
400 pages of confidential blueprints for a new skyscraper are locked inside a steel filing cabinet. To get a copy, a thief must either pick the lock (a hard, slow task) or persuade a security guard to let them walk out with the whole cabinet (social engineering).
Now imagine that instead of a cabinet, the architect stands in a meeting room and flashes each page onto a screen using an overhead projector. The thief, sitting in the audience, simply holds up a smartphone and photographs every page as it appears. They never touch the cabinet, never break a lock, and never speak to a guard. The architect sees a blur of light; the thief captures 400 pages in 30 minutes.
Wireless networks are exactly that overhead projector. Wired Ethernet (the filing cabinet) requires physical access to a cable or a switch port. Wi-Fi broadcasts data through the air using radio waves. Anyone within range—a car parked outside, a neighbour two floors up—can "see" that data if it isn't encrypted. Encryption (WPA2, WPA3) scrambles the pages so the photo is useless. But if the encryption is weak (WEP) or the password is guessed (brute-force or phishing), the thief decodes the photos just as easily. The core problem is that radio waves don't respect walls, locks, or security badges. The signal is literally public property; only the encryption keeps it private.
A wireless network replaces the physical Ethernet cable with radio waves. Your laptop contains a wireless Network Interface Controller (NIC) that transmits and receives on specific radio frequencies—typically 2.4 GHz or 5 GHz. An Access Point (AP), also called a wireless router, acts as a central hub. The AP broadcasts its presence by sending out beacon frames (small packets of data that announce the network name, called the SSID (Service Set Identifier)). Your device scans these beacons, you select a network, and your device performs an association process to join.
Encryption is the mechanism that scrambles data so only authorised devices can read it. There are three main standards you must know for the exam:
Wired Equivalent Privacy (WEP) — WEP was the first encryption standard for Wi-Fi, developed in 1999. It uses the RC4 stream cipher and a static key (a fixed password shared by all devices). WEP is fundamentally broken because the RC4 algorithm has a mathematical flaw: an attacker can capture enough data packets (around 20,000 to 50,000) to calculate the key using tools like Aircrack-ng. WEP also uses a small Initialization Vector (IV) of only 24 bits, which means the same IV repeats after a short time, allowing replay attacks. The CEH exam treats WEP as completely insecure—never use it.
Wi-Fi Protected Access 2 (WPA2) — WPA2 replaced WPA in 2004 and is still the most common standard today. It uses AES-CCMP (Advanced Encryption Standard with Counter Mode Cipher Block Chaining Message Authentication Code Protocol). AES is a strong block cipher approved by the U.S. government. WPA2 can operate in two modes: Personal (WPA2-PSK) where a pre-shared key (the Wi-Fi password) is used, and Enterprise (WPA2-802.1X) which uses a separate authentication server (like RADIUS). The main vulnerability in WPA2-PSK is the 4-Way Handshake. When a device connects, it exchanges four packets with the AP that contain cryptographic material. An attacker can capture these packets (a process called "capturing the handshake") and then run offline brute-force or dictionary attacks against the password. The KRACK (Key Reinstallation Attack) vulnerability in 2017 exploited a flaw in the 4-Way Handshake itself, allowing attackers to decrypt traffic without knowing the password.
Wi-Fi Protected Access 3 (WPA3) — WPA3 was introduced in 2018 to address WPA2's shortcomings. It uses Simultaneous Authentication of Equals (SAE), also known as the Dragonfly Key Exchange, which provides perfect forward secrecy—even if the password is later compromised, past traffic remains secure. WPA3 also replaces the 4-Way Handshake with a more robust authentication process that resists offline dictionary attacks. The exam considers WPA3 the current gold standard, though many consumer routers still default to WPA2.
Attackers also target wireless networks through deauthentication attacks. An attacker sends spoofed deauthentication frames (packets that tell a device to disconnect) to force a client to re-connect. When the client re-connects, the 4-Way Handshake is generated again, and the attacker captures it. This is the most common first step in WPA/WPA2 cracking.
Beyond encryption cracking, attackers use rogue access points—an evil twin—where they set up an AP with the same SSID as a legitimate network. Unsuspecting users connect to the rouge AP, and the attacker can monitor or modify all their traffic. This is a type of man-in-the-middle (MITM) attack. The tool Airbase-ng is commonly used to create these rogue APs.
Finally, the exam expects you to know the key wireless security tools: Aircrack-ng suite (airmon-ng to enable monitor mode on your NIC, airodump-ng to capture packets, aireplay-ng to inject packets and conduct deauthentication attacks, aircrack-ng to crack WEP and WPA2 keys), Kismet (a sniffer and intrusion detection system), Wireshark (for deep packet inspection), and Reaver (for brute-forcing WPS PINs on routers where Wi-Fi Protected Setup is enabled).
Enable Monitor Mode
Use the command `airmon-ng start wlan0` on a Linux system (Kali) to switch your wireless NIC from managed mode (normal client) to monitor mode. Monitor mode allows the NIC to capture all packets on a channel without associating to a network—essential for sniffing Wi-Fi traffic.
Scan for Target Network
Run `airodump-ng wlan0mon` to display all visible access points and clients. Identify your target by BSSID (MAC address) and channel. Record these details. Focus the scan on that channel to reduce noise and capture relevant packets.
Capture the 4-Way Handshake
Run `airodump-ng -c [channel] --bssid [BSSID] -w capture wlan0mon`. If no client is connected, use `aireplay-ng -0 10 -a [BSSID] wlan0mon` to send deauthentication frames, forcing a client to disconnect and reconnect. The handshake will appear in the airodump output as "WPA handshake: [BSSID]".
Crack the Password
Run `aircrack-ng -w /path/to/wordlist.txt capture-01.cap`. The tool compares each password in the wordlist against the handshake. If the password is in the list, it is displayed. For complex passwords, use hashcat with GPU acceleration.
Launch a Rogue AP Attack (Optional)
Use `airbase-ng -e "TargetSSID" -c [channel] wlan0mon` to create an evil twin AP. Then use a tool like `ettercap` or `dnsmasq` to serve fake DHCP and DNS, redirecting traffic to capture login credentials or inject malicious payloads.
An IT security consultant is hired to test the wireless network of a medium-sized retail company with 30 employees. The company uses WPA2-PSK with a single password printed on a sticker in the break room.
The consultant starts with reconnaissance. They use a laptop with a wireless NIC that supports monitor mode (many built-in NICs do not; a USB adapter like the Alfa AWUS036ACH is common). They boot a Linux distribution like Kali Linux, which has all the necessary tools pre-installed. The first command is airmon-ng start wlan0 to enable monitor mode on the interface.
Next, they run airodump-ng wlan0mon to scan all nearby networks. They note the BSSID (the MAC address of the target AP), the channel it operates on, and the SSID. They then focus the capture on that single channel by specifying airodump-ng -c 6 --bssid XX:XX:XX:XX:XX:XX -w capture wlan0mon. The -w capture flags save all captured packets to files named "capture-01.cap", etc.
If no client is currently connecting, the consultant needs to force a connection to capture the handshake. They open a second terminal and run aireplay-ng -0 10 -a XX:XX:XX:XX:XX:XX -c YY:YY:YY:YY:YY:YY wlan0mon. The -0 flag sends deauthentication packets; the 10 tells it to send ten packets; -a is the AP's BSSID; -c is the client's MAC address. The client disconnects and immediately reconnects, generating the 4-Way Handshake. Airodump-ng displays "WPA handshake: XX:XX:XX:XX:XX:XX" to confirm capture.
With the handshake captured, the consultant runs aircrack-ng -w wordlist.txt capture-01.cap, supplying a dictionary file of common passwords. If the password is "Summer2023!", aircrack-ng finds it quickly. The consultant then reports that the password is weak and recommends WPA3 with a 20-character random password, or migrating to WPA2-Enterprise with individual certificates.
In a more advanced test, the consultant might set up a rogue AP using airbase-ng -e "CompanyWiFi" -c 6 wlan0mon and then use a tool like ettercap to perform ARP spoofing on the dummy network, capturing login credentials from users who connect. This demonstrates the danger of evil twin attacks.
The CEH (312-50) exam tests wireless network hacking in the Network Security domain. Expect 3–5 questions directly on this topic. The examiners love to test your ability to distinguish between encryption standards and their exact weaknesses.
Key exam concepts you must memorise:
WEP uses RC4 and a 24-bit IV. It is cracked by capturing 20,000–50,000 packets. The tool is Aircrack-ng. Know that WEP is broken and should never be used.
WPA2 uses AES-CCMP (or TKIP for backward compatibility; TKIP is also broken but less exam-famous). The attack vector is the 4-Way Handshake. The KRACK attack exploits the handshake itself.
WPA3 uses SAE (Dragonfly Key Exchange). It resists offline dictionary attacks and provides perfect forward secrecy.
Deauthentication attacks force clients to reconnect to capture the handshake. The command is aireplay-ng -0.
Evil twin / rogue AP attacks use the same SSID as a legitimate network. The tool Airbase-ng or hostapd can set these up.
WPS (Wi-Fi Protected Setup) has an 8-digit PIN that can be brute-forced in hours because the protocol validates halves of the PIN independently (check for Reaver and Pixie Dust attack).
Common exam traps:
The exam might state that a network uses "WEP-128" and ask whether it is secure. WEP-128 still uses RC4 and is still broken—the key length does not fix the IV reuse flaw. The answer is always "no".
A question might describe a deauthentication attack but call it "disassociation". Disassociation is a different frame type, but the attack concept is the same. Look for "force client to re-connect" to identify it.
They might ask which tool is used to crack WPA2: (a) John the Ripper (for password hashes), (b) Hashcat (GPU-based cracking), (c) Aircrack-ng. Aircrack-ng is the correct answer for the wireless handshake, though Hashcat can also crack handshakes. The exam often expects Aircrack-ng.
A scenario about a "rogue AP" might describe a user maliciously connecting to an unknown network—but the attack is the attacker setting up the AP, not the victim connecting. Read carefully.
They love to test that WPA2-Enterprise uses 802.1X and RADIUS, whereas WPA2-Personal uses PSK.
For specific attack chains, remember: (1) Enable monitor mode (airmon-ng), (2) Scan (airodump-ng), (3) Deauth (aireplay-ng -0), (4) Capture handshake, (5) Crack (aircrack-ng or hashcat). This sequence appears in multiple choice format, often asking "what is the next step?"
WEP uses RC4 with a 24-bit IV and is broken after capturing 20,000–50,000 packets.
WPA2-PSK uses a 4-Way Handshake that can be captured via a deauthentication attack and cracked offline.
WPA3-SAE uses Simultaneous Authentication of Equals to resist offline dictionary attacks and provide perfect forward secrecy.
The typical attack chain is: enable monitor mode (airmon-ng), scan (airodump-ng), deauthenticate (aireplay-ng -0), capture handshake, crack (aircrack-ng or hashcat).
An evil twin attack uses a rogue access point with the same SSID to perform a man-in-the-middle attack.
Wi-Fi Protected Setup (WPS) with an 8-digit PIN can be brute-forced because the protocol validates halves of the PIN separately.
WPA2-Enterprise uses 802.1X and a RADIUS server; WPA2-Personal uses a pre-shared key.
KRACK (Key Reinstallation Attack) exploits the 4-Way Handshake in WPA2 to decrypt traffic without knowing the password.
These come up on the exam all the time. Here's how to tell them apart.
WEP
Uses RC4 stream cipher
24-bit Initialization Vector
Cracked by capturing 20k-50k packets
WPA2
Uses AES-CCMP block cipher
128-bit block, 4-Way Handshake
Cracked by offline dictionary attack on handshake
WPA2-Personal
Single pre-shared key (PSK)
No authentication server
Vulnerable to offline dictionary attack on PSK
WPA2-Enterprise
802.1X with RADIUS server
Unique credentials per user
Resists offline attacks; vulnerable to rogue RADIUS
Deauthentication Attack
Sends spoofed deauth frames from AP to client
Forces client to disconnect and reconnect
Used to capture WPA handshake
Disassociation Attack
Sends spoofed disassociation frames
Also disconnects client but from a different management frame type
Less common in exam; both achieve same goal
Aircrack-ng
CPU-based password cracking
Works directly on .cap files
Slower for large wordlists
Hashcat
GPU-based (faster)
Requires converting .cap to .hccapx format
Handles complex hash modes and large dictionaries
Mistake
WPA2 is completely secure because it uses AES encryption.
Correct
WPA2-PSK is vulnerable to offline dictionary attacks on the captured 4-Way Handshake. The AES encryption itself is strong, but the pre-shared key (password) can be guessed if weak.
People confuse the strength of the encryption algorithm with the strength of the authentication mechanism. The exam tests that you know the vulnerability is in the handshake, not in AES.
Mistake
If a Wi-Fi network has a password, it is encrypted and safe from eavesdropping.
Correct
A password does not encrypt data unless the protocol is WPA2 or WPA3. Open networks (no password) send data in plaintext. Even with a password, if the encryption is WEP, an attacker can crack it easily.
Many beginners equate 'password' with 'encryption'. The exam distinguishes between authentication (password) and encryption (protocol).
Mistake
A deauthentication attack permanently disconnects a device from the network.
Correct
A deauthentication attack only forces a client to disconnect temporarily. The client typically reconnects immediately, generating the handshake the attacker needs. It does not damage the device or permanently block access.
The word 'deauthentication' sounds permanent and destructive. The exam tests that you understand it is a short-term manipulation to force reconnection.
Mistake
WPA3 is completely immune to all attacks.
Correct
WPA3 resists offline dictionary attacks and provides forward secrecy, but it is not immune to everything. For example, downgrade attacks can force clients to use WPA2 instead, and side-channel attacks on Dragonfly implementations have been demonstrated.
Beginners want a 'perfect' solution. The exam wants you to recognise that WPA3 is the strongest option but still a target for downgrade and implementation flaws.
Mistake
Only advanced hackers can crack WPA2 passwords; it requires expensive equipment.
Correct
Any laptop with a compatible wireless NIC and free tools (Aircrack-ng, Kali Linux) can capture and crack a WPA2 handshake if the password is weak. A dictionary file with common passwords is freely available online.
The difficulty of cracking is exaggerated in pop culture. The exam tests that the tools are accessible and the process is straightforward.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
WPA2-Personal uses a single pre-shared key (password) for all users. WPA2-Enterprise uses 802.1X authentication with a RADIUS server, giving each user a unique credential (often a certificate) and better security.
No. WPA3 uses SAE, which prevents offline dictionary attacks by requiring real-time interaction with the AP for each password guess. However, downgrade attacks and side-channel attacks are possible in some implementations.
It forces a client to disconnect from an AP, usually to capture the 4-Way Handshake when the client reconnects. It is a first step in cracking WPA2-PSK passwords.
An attacker sets up a rogue access point broadcasting the same SSID as a legitimate network. Users connect to it thinking it is real, allowing the attacker to intercept or modify their traffic (man-in-the-middle).
It depends on password complexity. A weak password like "password123" might be cracked in seconds using a wordlist. A strong 20-character random password could take centuries with current hardware.
Key Reinstallation Attack is a vulnerability in the WPA2 4-Way Handshake that allows an attacker to decrypt traffic by forcing reuse of nonces and session keys. It affected all WPA2 networks but can be patched.
You've finished Hacking Wireless Networks. Continue through the 312-50 study guide to build a complete picture of the exam.
Done with this chapter?