Ethical Hacking Wireless Network Hacking Syllabus

Wireless Network Hacking syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Wireless Network Hacking in Ethical Hacking, not a summary of it.

1. 1

   Wireless Network Concepts

   3 topics

   • Wireless Standards and Protocols
   • Wireless Encryption
   • Wireless Authentication
2. 2

   Wireless Attacks

   4 topics

   • WEP Cracking
   • WPA/WPA2 Cracking
   • Rogue Access Points
   • Evil Twin Attacks
3. 3

   Wireless Security

   3 topics

   • Securing Wireless Networks
   • Wireless Intrusion Detection Systems
   • Best Practices for Wireless Security

Wireless Network Hacking flashcards for Ethical Hacking

18 of 50 cards from the Wireless Network Hacking deck — real questions with worked answers.

1. What frequency bands do the 802.11b/g/n and 802.11a/n/ac Wi-Fi standards operate on?

   802.11b/g operate on 2.4 GHz; 802.11a on 5 GHz; 802.11n on both 2.4 and 5 GHz; 802.11ac on 5 GHz; 802.11ax (Wi-Fi 6) on 2.4 and 5 GHz (6E adds 6 GHz).

2. Match each 802.11 standard to its maximum theoretical data rate: 802.11b, 802.11a/g, 802.11n, 802.11ac.

   802.11b = 11 Mbps; 802.11a/g = 54 Mbps; 802.11n = 600 Mbps; 802.11ac = ~6.9 Gbps (multi-station).

3. What is an SSID and how does hiding it affect security?

   The SSID (Service Set Identifier) is the network name broadcast in beacon frames. Hiding it (disabling broadcast) is not real security because the SSID still appears in probe/association frames and is trivially captured by sniffing.

4. Define BSSID and ESSID in Wi-Fi terminology.

   BSSID is the MAC address of the access point identifying a single basic service set. ESSID is the human-readable network name shared across multiple APs forming an extended service set (roaming domain).

5. What encryption cipher and key size does WEP use, and what is its critical weakness?

   WEP uses the RC4 stream cipher with a 40-bit or 104-bit key plus a 24-bit Initialization Vector (IV). Its weakness is the short, reused IV that leaks keystream, allowing statistical key recovery.

6. In WEP, how are the total key sizes commonly marketed versus the actual secret key length?

   Marketed as 64-bit and 128-bit, but the actual secret key is only 40-bit and 104-bit respectively; the remaining 24 bits are the non-secret IV.

7. What encryption does WPA (TKIP) introduce over WEP, and does it still use RC4?

   WPA uses TKIP (Temporal Key Integrity Protocol), which still uses RC4 but adds per-packet key mixing, a 48-bit IV/sequence counter to prevent replay, and the MIC (Michael) integrity check.

8. What cipher and integrity mechanism does WPA2 use?

   WPA2 uses AES in CCMP mode (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol), providing AES-based confidentiality and integrity, replacing RC4/TKIP.

9. What key improvements does WPA3 introduce over WPA2?

   WPA3 replaces the PSK handshake with SAE (Simultaneous Authentication of Equals / Dragonfly), giving forward secrecy and resistance to offline dictionary attacks, plus mandatory Protected Management Frames (PMF).

10. Contrast WPA2-Personal and WPA2-Enterprise authentication.

    Personal (WPA2-PSK) uses a single shared passphrase for all users. Enterprise uses 802.1X/EAP with a RADIUS server, giving each user unique credentials and centralized authentication.

11. What is the role of 802.1X in wireless authentication?

    802.1X is a port-based network access control framework. It uses a supplicant (client), authenticator (AP), and authentication server (RADIUS), carrying EAP messages to authenticate users before granting network access.

12. Name three common EAP methods used in WPA2-Enterprise and one distinguishing trait of each.

    EAP-TLS: mutual certificate authentication (most secure). PEAP: server cert + protected inner password auth (MSCHAPv2). EAP-TTLS: server cert tunneling legacy auth methods.

13. What are Open System and Shared Key authentication in the original 802.11 standard?

    Open System: no credentials, any client associates (encryption may still apply). Shared Key: a WEP-based challenge-response; ironically weaker because the plaintext/ciphertext challenge pair leaks keystream.

14. In WEP cracking, why does capturing many IVs enable key recovery?

    Weak/repeated IVs correlate with the secret key in RC4's key schedule (FMS/PTW attacks). Collecting enough unique IVs (typically tens of thousands) lets statistical analysis solve for the key bytes.

15. What is the purpose of an ARP replay attack in WEP cracking?

    It captures a legitimate ARP packet and re-injects it repeatedly, forcing the AP to generate many responses with fresh IVs, dramatically accelerating IV collection for key recovery.

16. List the typical aircrack-ng workflow steps to crack WEP.

    1) airmon-ng to enable monitor mode; 2) airodump-ng to capture IVs on target BSSID/channel; 3) aireplay-ng for ARP replay/injection to speed IVs; 4) aircrack-ng on the .cap file to recover the key.

17. What is the fundamental difference in attack approach between cracking WEP and cracking WPA2-PSK?

    WEP is broken by statistical IV analysis regardless of key strength. WPA2-PSK cannot be broken statistically; it requires capturing the 4-way handshake and performing an offline dictionary/brute-force attack against the passphrase.

18. Describe the WPA/WPA2 4-way handshake purpose.

    It derives and confirms the Pairwise Transient Key (PTK) from the PMK, exchanging ANonce and SNonce and verifying the MIC, so both client and AP prove they know the passphrase without transmitting it.

See more Wireless Network Hacking flashcards →

Planning Wireless Network Hacking for Ethical Hacking

Wireless Network Hacking (Ethical Hacking) FAQ