CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use aircrack-ng to crack the WEP key from the handshake

  Why it's wrong here

  Using aircrack-ng to crack a WEP key from a WPA2 4-way handshake is fundamentally incorrect because WEP and WPA2 are distinct security protocols with different key derivation and authentication mechanisms. WEP cracking primarily relies on collecting a large number of Initialization Vectors (IVs) to exploit cryptographic weaknesses, whereas a WPA2 handshake is used for offline dictionary or brute-force attacks against the Pre-Shared Key (PSK). A WPA2 handshake contains no relevant information for WEP key recovery.

• ✓

  Run a dictionary attack using aircrack-ng with a wordlist

  Why this is correct

  Running a dictionary attack using aircrack-ng with a wordlist is the correct approach because the captured WPA2 4-way handshake contains the necessary cryptographic elements, such as the ANonce, SNonce, and the Message Integrity Code (MIC). Aircrack-ng can iterate through a wordlist, calculate the Pairwise Master Key (PMK) and subsequent MIC for each potential Pre-Shared Key (PSK), and compare it to the MIC within the captured handshake. A match indicates the correct PSK has been found, allowing the attacker to decrypt network traffic.

• ✗

  Brute-force the WPS PIN using Reaver

  Why it's wrong here

  Brute-forcing the WPS PIN using Reaver is an attack targeting Wi-Fi Protected Setup (WPS), a separate protocol designed for simplified network configuration, not the WPA2 4-way handshake itself. Reaver exploits a design flaw in WPS's PIN authentication process, allowing an attacker to guess the 8-digit PIN in two halves through active online attempts against the access point. This method does not utilize a captured WPA2 handshake and is ineffective if WPS is disabled or not present on the target network.

• ✗

  De-authenticate the client from the network again to capture another handshake

  Why it's wrong here

  De-authenticating the client from the network again to capture another handshake is unnecessary and provides no additional advantage for cracking the WPA2 Pre-Shared Key (PSK). A single complete and valid 4-way handshake contains all the cryptographic material required for an offline dictionary attack against the PSK. Capturing multiple handshakes from the same network with the same PSK merely duplicates the existing data and does not enhance the chances or speed of cracking the password.

Go deeper

Related to this question