CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Perform a de-authentication attack on all clients

  Why it's wrong here

  Reaver's primary function is to brute-force Wi-Fi Protected Setup (WPS) PINs to obtain the WPA2 Pre-Shared Key, not to perform de-authentication attacks. De-authentication frames are typically sent by tools like aireplay-ng from the Aircrack-ng suite, which are designed to force clients off a network, often to facilitate the capture of a WPA2 handshake or other specific attack vectors. Reaver does not possess this capability as it operates on a different attack principle.

• ✗

  Capture a WPA2 4-way handshake for offline cracking

  Why it's wrong here

  Reaver's operational mechanism bypasses the need for capturing a WPA2 4-way handshake entirely. Instead of passively sniffing for the handshake to perform offline dictionary attacks on the PSK, Reaver actively exploits a design flaw in the Wi-Fi Protected Setup (WPS) protocol by brute-forcing the WPS PIN. This direct attack on WPS aims to recover the PSK without relying on client connections or the capture of authentication frames.

• ✗

  Scan for hidden SSIDs in the area

  Why it's wrong here

  Reaver is specifically designed to target and exploit the WPS vulnerability of an access point, not to discover network names or scan for hidden SSIDs. Scanning for hidden SSIDs, which are access points that do not broadcast their Service Set Identifier (SSID), is a function typically performed by network discovery tools such as airodump-ng or Kismet. These tools passively listen for probe requests or responses to reveal hidden networks, a task outside Reaver's scope.

• ✓

  Obtain the WPS PIN and subsequently the WPA2 PSK

  Why this is correct

  Reaver is a dedicated tool for exploiting the Wi-Fi Protected Setup (WPS) vulnerability. It systematically brute-forces the 7-digit WPS PIN in two halves, significantly reducing the number of attempts required compared to a full 8-digit PIN. Once the correct WPS PIN is identified through this process, Reaver can then request and display the WPA2 Pre-Shared Key (PSK) directly from the access point, effectively compromising the network's security.

Go deeper

Related to this question