CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
Which of the following tools is specifically designed to exploit WPS vulnerabilities on wireless networks?
⚠ Common exam trap
Watch out — candidates often confuse aircrack-ng (which cracks WPA handshakes) with tools that exploit the WPS PIN vulnerability, but aircrack-ng has no WPS brute-force capability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reaver
Reaver is specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate limiting and the fact that the PIN is split into two halves, making it feasible to guess the 8-digit PIN in under 10,000 attempts. This allows an attacker to recover the WPA/WPA2 pre-shared key without needing to crack the actual encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a powerful, open-source password cracking utility primarily designed for offline brute-force and dictionary attacks against various password hash formats. While it can crack WPA/WPA2 PSK passwords if a handshake is captured and converted, it does not directly target or exploit the WPS protocol's PIN-based authentication mechanism. Its function is to test candidate passwords against known hashes, not to interact with a live WPS registrar.
- ✗
aircrack-ng
Why it's wrong here
Aircrack-ng is a comprehensive suite of tools for auditing wireless networks, primarily known for its capabilities in cracking WEP and WPA/WPA2-PSK encryption keys. It achieves WEP cracking through statistical attacks on captured IVs and WPA/WPA2 cracking by performing dictionary or brute-force attacks against captured four-way handshakes. However, aircrack-ng does not contain specific modules or functionalities to exploit the WPS protocol's inherent vulnerabilities by targeting its PIN authentication process.
- ✗
Kismet
Why it's wrong here
Kismet functions as a passive wireless network detector, sniffer, and intrusion detection system, primarily operating by collecting packets without injecting any data. Its core purpose is to identify visible and hidden wireless networks, map their topology, and detect potential anomalies or attacks by analyzing network traffic. While Kismet is invaluable for reconnaissance and understanding the wireless environment, it lacks the active attack capabilities required to specifically target and brute-force WPS registrar PINs.
- ✓
Reaver
Why this is correct
Reaver is a specialized tool explicitly designed to exploit a critical vulnerability in the Wi-Fi Protected Setup (WPS) protocol by performing a brute-force attack against the WPS registrar PIN. It leverages the fact that the 8-digit WPS PIN is validated in two halves, allowing an attacker to determine the first four digits and then the next three, with the last digit being a checksum. This significantly reduces the number of attempts required, making the brute-force attack feasible and highly effective against vulnerable WPS-enabled access points.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.