Certified Ethical Hacker (CEH) Wireless, Mobile, IoT, and OT Hacking Syllabus

Wireless, Mobile, IoT, and OT Hacking syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Wireless, Mobile, IoT, and OT Hacking in Certified Ethical Hacker (CEH), not a summary of it.

1. 1

   Hacking Wireless Networks

   4 topics

   • Wireless Concepts and Encryption
     • Wi-Fi standards and authentication modes
     • WEP, WPA, WPA2, WPA3 encryption
   • Wireless Threats and Attacks
     • Rogue access points and evil twin
     • WPA/WPA2 handshake capture and cracking
     • KRACK and WPS attacks
   • Wireless Hacking Methodology and Tools
     • Aircrack-ng suite and Wifite
     • Bluetooth attacks: bluejacking, bluesnarfing
   • Wireless Security Countermeasures
2. 2

   Hacking Mobile Platforms

   4 topics

   • Mobile Attack Vectors and OWASP Mobile Top 10
   • Hacking Android OS
     • Rooting and Android malware
     • APK analysis and reverse engineering
   • Hacking iOS
     • Jailbreaking and iOS threats
   • Mobile Device Management and Security
     • MDM, BYOD policies, app sandboxing
3. 3

   IoT and OT Hacking

   4 topics

   • IoT Concepts and Architecture
     • IoT communication models and protocols
     • OWASP IoT Top 10
   • IoT Attacks and Methodology
     • Firmware extraction and analysis
     • Common IoT attacks and hacking tools
   • OT Concepts and ICS/SCADA
     • ICS, SCADA, PLC, and HMI components
     • Modbus, DNP3, and Purdue model
   • OT Attacks and Countermeasures

Wireless, Mobile, IoT, and OT Hacking flashcards for Certified Ethical Hacker (CEH)

23 of 50 cards from the Wireless, Mobile, IoT, and OT Hacking deck — real questions with worked answers.

1. In wireless networking, what is an SSID and how does it differ from a BSSID?

   SSID (Service Set Identifier) is the human-readable network name (up to 32 characters) that identifies a WLAN. BSSID is the 48-bit MAC address of the access point's radio that uniquely identifies the basic service set.

2. Compare WEP, WPA, WPA2, and WPA3 by their core encryption/cipher.

   WEP uses RC4 with a weak 24-bit IV (broken). WPA uses RC4 with TKIP. WPA2 uses AES-CCMP. WPA3 uses AES with SAE (Simultaneous Authentication of Equals) and forward secrecy.

3. Why is WEP considered insecure?

   WEP uses RC4 with only a 24-bit Initialization Vector (IV), which is too short and is reused/sent in cleartext. IV collisions allow attackers to perform statistical (FMS/KoreK/PTW) attacks and recover the key from captured traffic.

4. What is the function of the 4-way handshake in WPA2?

   The 4-way handshake derives and confirms the Pairwise Transient Key (PTK) from the Pairwise Master Key (PMK) between client and AP, exchanging nonces (ANonce/SNonce) to establish session encryption keys without sending the PMK over the air.

5. In WPA3-Personal, what handshake replaces WPA2's PSK exchange and what attack does it prevent?

   SAE (Simultaneous Authentication of Equals), a Dragonfly key exchange. It prevents offline dictionary/brute-force attacks against captured handshakes and provides forward secrecy.

6. Define a rogue access point versus an evil twin attack.

   A rogue AP is any unauthorized AP plugged into a network (often by an insider). An evil twin is a malicious AP configured to impersonate a legitimate AP's SSID/BSSID to lure clients into connecting so traffic can be intercepted.

7. What is a KRACK attack?

   Key Reinstallation Attack: an attacker forces reinstallation of an already-in-use key during the WPA2 4-way handshake by replaying handshake message 3, resetting nonces/replay counters and allowing decryption or replay of frames.

8. What is WPS and why is it a security risk?

   Wi-Fi Protected Setup simplifies device connection via an 8-digit PIN. The PIN is validated in two halves (and the last digit is a checksum), reducing brute-force keyspace to ~11,000 combinations, making it vulnerable to tools like Reaver/Bully.

9. Describe a wireless deauthentication (deauth) attack and its purpose.

   The attacker spoofs management deauthentication frames (which are unencrypted in WPA2) to forcibly disconnect a client from the AP. It is used to capture handshakes, force evil-twin reconnection, or cause denial of service.

10. What is a jamming attack in wireless security?

    A denial-of-service attack that floods the radio frequency band with noise or interference signals, preventing legitimate devices from communicating on that channel/spectrum.

11. List the high-level phases of the wireless hacking methodology.

    1) Wi-Fi discovery/footprinting, 2) GPS mapping/wardriving, 3) Wireless traffic analysis (sniffing), 4) Launch wireless attacks, 5) Crack Wi-Fi encryption, 6) Compromise/access the network.

12. What is the aircrack-ng suite used for, and name three of its tools.

    It is a suite for auditing/cracking Wi-Fi. airmon-ng (enable monitor mode), airodump-ng (capture packets/handshakes), aireplay-ng (inject/deauth packets), and aircrack-ng (crack WEP/WPA keys).

13. What is the difference between active and passive wireless sniffing?

    Passive sniffing captures traffic without injecting packets (monitor mode listening only). Active sniffing injects packets (e.g., deauth, ARP replay) to generate or solicit traffic for capture or attack.

14. What does a tool like Kismet do that simple sniffers don't?

    Kismet is a passive wireless detector/sniffer/IDS that detects hidden (non-beaconing) SSIDs, identifies APs and clients, logs GPS coordinates, and detects wireless intrusions without transmitting.

15. Name four wireless security countermeasures against unauthorized access.

    Use WPA2/WPA3 with strong passphrases, disable WPS, enable MAC filtering, hide/limit SSID broadcast, segment wireless with VLANs/firewalls, deploy a Wireless IDS/IPS, and use 802.1X/RADIUS authentication.

16. What is 802.1X and how does it strengthen wireless security?

    802.1X is a port-based Network Access Control standard using EAP for authentication, with a supplicant (client), authenticator (AP/switch), and authentication server (RADIUS). It provides per-user credentials instead of a shared PSK.

17. What is the OWASP Mobile Top 10 (2024) category M1?

    M1: Improper Credential Usage - hardcoded credentials or insecure handling/storage of credentials within the mobile app.

18. List the OWASP Mobile Top 10 (2024) risk categories.

    M1 Improper Credential Usage, M2 Inadequate Supply Chain Security, M3 Insecure Authentication/Authorization, M4 Insufficient Input/Output Validation, M5 Insecure Communication, M6 Inadequate Privacy Controls, M7 Insufficient Binary Protections, M8 Security Misconfiguration, M9 Insecure Data Storage, M10 Insufficient Cryptography.

19. What are the main mobile attack vectors?

    Malicious/repackaged apps, insecure data storage, weak/insecure communication, OS vulnerabilities, jailbreaking/rooting, phishing/smishing, malicious Wi-Fi, SMS/USSD attacks, and supply-chain/third-party SDK compromise.

20. What is app sandboxing on mobile platforms?

    A security mechanism that isolates each app's processes and data in a restricted environment so it cannot access other apps' data or critical system resources without explicit permissions.

21. Define rooting (Android) versus jailbreaking (iOS).

    Both remove vendor-imposed restrictions to gain privileged/root access. Rooting gains superuser on Android; jailbreaking removes Apple's restrictions on iOS to allow unsigned apps and system modification. Both weaken the security model.

22. What are the techniques (types) of iOS jailbreaking by boot persistence?

    Tethered (needs a computer to reboot), Semi-tethered (boots without computer but jailbreak features need a computer), Semi-untethered (re-jailbreak via on-device app after reboot), and Untethered (persists across reboots with no computer).

23. What is the Android Debug Bridge (ADB) and how is it abused?

    ADB is a command-line tool for communicating with Android devices. If ADB is enabled over network/USB without authorization, attackers can install apps, pull data, run shell commands, and bypass restrictions on the device.

See more Wireless, Mobile, IoT, and OT Hacking flashcards →

Planning Wireless, Mobile, IoT, and OT Hacking for Certified Ethical Hacker (CEH)

Wireless, Mobile, IoT, and OT Hacking (Certified Ethical Hacker (CEH)) FAQ