CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Perform a de-authentication attack on the target AP

  Why it's wrong here

  Reaver is specifically designed to exploit vulnerabilities in Wi-Fi Protected Setup (WPS) by systematically brute-forcing the WPS PIN. It does not perform de-authentication attacks, which are typically executed using tools like aireplay-ng to disconnect clients from an access point. De-authentication attacks are primarily used to force a client to re-authenticate, often to capture a WPA/WPA2 handshake, a function distinct from Reaver's WPS-focused operation.

• ✗

  Capture the 4-way handshake for WPA cracking

  Why it's wrong here

  Capturing the 4-way handshake, which is essential for offline WPA/WPA2-PSK cracking, is not a function of Reaver. This process typically involves monitoring wireless traffic with tools such as airodump-ng to intercept the exchange between a client and an access point during authentication. Reaver operates by directly interacting with the WPS protocol to guess the PIN, thereby bypassing the need to capture and crack the WPA handshake.

• ✓

  Brute-force the WPS PIN to recover the Wi-Fi passphrase

  Why this is correct

  Reaver is a specialized tool engineered to exploit a design flaw in the Wi-Fi Protected Setup (WPS) protocol. It systematically attempts to guess the 8-digit WPS PIN by brute-forcing the first four digits, then the next three, and finally the checksum digit. This method leverages the fact that WPS validates the PIN in two halves, significantly reducing the number of possible combinations and allowing Reaver to recover the Wi-Fi passphrase.

• ✗

  Scan for nearby access points and their BSSIDs

  Why it's wrong here

  Scanning for nearby access points and their Basic Service Set Identifiers (BSSIDs) is a network discovery function performed by tools like airodump-ng or iwlist scan. Reaver, on the other hand, is an attack tool that requires the target AP's BSSID, along with its associated wireless interface, as input parameters to initiate its WPS brute-force attack. It does not possess built-in capabilities for network reconnaissance or AP enumeration.

Go deeper

Related to this question