Ethical Hacking Wireless Network Hacking Syllabus

How can an attacker force a WPA2 4-way handshake capture without waiting?

By sending deauthentication frames (aireplay-ng --deauth) to a connected client, forcing it to disconnect and reauthenticate, which lets the attacker capture the resulting handshake.

What is a PMKID attack against WPA2?

A clientless attack (Hashcat mode 16800) that captures the PMKID field from the AP's first EAPOL message during association; the PMKID is $\text{HMAC-SHA1}(PMK, \text{"PMK Name"} \| \text{AP MAC} \| \text{STA MAC})$, then brute-forced offline without needing a full handshake.

What is WPS and why is it a security risk?

Wi-Fi Protected Setup simplifies connection via an 8-digit PIN. The PIN is validated in two halves (4+3 digits, last is checksum), reducing brute-force space to ~11,000 attempts, exploitable by tools like Reaver/Bully.

Define a Rogue Access Point.

An unauthorized AP connected to the trusted wired network, installed by an insider or attacker, that bypasses perimeter security and provides an unmonitored entry point into the LAN.

How does a Rogue AP differ from an Evil Twin?

A Rogue AP is physically plugged into the target's internal wired network (backdoor). An Evil Twin is an external impostor AP mimicking a legitimate SSID/BSSID to lure clients, not necessarily wired to the target network.

Describe the Evil Twin attack process.

The attacker clones a legitimate AP's SSID (and often MAC), broadcasts a stronger signal, deauthenticates victims from the real AP, and captures traffic or credentials when clients auto-reconnect to the twin.

What is a Karma/MANA attack in the context of Evil Twins?

An attacker responds to clients' probe requests for known/saved networks, impersonating any SSID the device seeks, tricking devices into auto-connecting to the rogue AP based on their preferred network list.

What is a captive portal phishing attack via Evil Twin?

After luring victims to a fake AP, a spoofed login/portal page prompts them to re-enter the Wi-Fi password or credentials, harvesting the WPA passphrase or account details through social engineering.

What is a deauthentication attack and which frame type enables it?

It is a denial-of-service that spoofs 802.11 deauthentication management frames (unauthenticated in pre-PMF Wi-Fi), forcing clients to disconnect. It underpins handshake capture and Evil Twin redirection.

How does 802.11w (Protected Management Frames) mitigate deauth attacks?

PMF cryptographically protects management frames (deauth/disassoc), so spoofed unauthenticated deauth frames are rejected, preventing forced disconnections and many Evil Twin/handshake-forcing attacks.

What is MAC address filtering and why is it weak?

An access control list permitting only whitelisted MAC addresses. It is weak because MACs are broadcast in cleartext and easily spoofed (macchanger), so an attacker copies an allowed MAC to bypass it.

Differentiate a WIDS from a WIPS.

A WIDS (Wireless Intrusion Detection System) detects and alerts on wireless threats. A WIPS (Wireless Intrusion Prevention System) additionally takes active countermeasures such as containing/deauthenticating rogue APs.

Name three anomalies a WIDS typically detects.

Rogue/unauthorized APs, Evil Twin/SSID spoofing, and flooding/DoS such as deauthentication or association floods; also MAC spoofing and abnormal signal strength/location.

What are the two main WIDS detection methodologies?

Signature-based detection (matches known attack patterns, low false positives but misses novel attacks) and anomaly/behavior-based detection (flags deviations from baseline, catches new attacks but more false positives).

How do WIPS systems typically contain a rogue AP over the air?

By transmitting spoofed deauthentication frames to clients associated with the rogue AP, preventing them from staying connected, effectively quarantining the rogue device until removed.

What is RSSI and how is it used in wireless attack detection?

RSSI (Received Signal Strength Indicator) measures received signal power. Sudden RSSI changes or the same MAC appearing at anomalous strengths help detect Evil Twins, spoofed APs, or rogue device location via triangulation.

Convert power ratio to decibels: what formula relates dB to a power ratio?

$dB = 10 \log_{10}\left(\frac{P_{out}}{P_{in}}\right)$, so every 10 dB gain multiplies power by 10 and every 3 dB roughly doubles it.

What does EIRP mean and how is it calculated?

EIRP (Effective Isotropic Radiated Power) is the total effective transmitted power: $EIRP_{dBm} = P_{tx} + G_{antenna} - L_{cable}$, where terms are transmit power, antenna gain, and cable loss in dB.

State the free-space path loss formula used to estimate Wi-Fi signal attenuation.

$FSPL_{dB} = 20\log_{10}(d) + 20\log_{10}(f) + 32.44$, where $d$ is distance in km and $f$ is frequency in MHz; loss increases with both distance and frequency.

Why is 5 GHz Wi-Fi generally harder to intercept from a distance than 2.4 GHz?

Higher frequency means greater free-space path loss and poorer wall penetration, so 5 GHz signals attenuate faster and cover less range, reducing an external attacker's capture footprint.

What is channel bonding and its security-relevant side effect?

Channel bonding combines adjacent 20 MHz channels (into 40/80/160 MHz) for higher throughput. It increases spectrum footprint and can raise interference/DoS exposure and complicate monitoring coverage.

What is monitor mode and why is it required for wireless attacks?

Monitor mode configures a wireless NIC to passively capture all 802.11 frames on a channel without associating to any AP, enabling sniffing of management/control frames and handshake/IV capture.

Distinguish monitor mode from promiscuous mode.

Promiscuous mode captures all frames on a network the card is associated with (mostly wired-style). Monitor mode captures raw 802.11 frames from all nearby APs/clients without any association.

What is the difference between a passive and an active wireless attack?

Passive attacks only eavesdrop/sniff traffic without transmitting (hard to detect), e.g. IV collection. Active attacks inject frames (deauth, ARP replay, Evil Twin) and are detectable but faster/more powerful.

Why should WPA2-Enterprise clients validate the RADIUS server certificate?

Without server certificate validation, an Evil Twin running a fake RADIUS (e.g. hostapd-wpe) can capture EAP-MSCHAPv2 challenge/response hashes and crack user credentials offline; validation prevents connecting to the rogue authenticator.

List at least four best practices for securing an enterprise wireless network.

Use WPA3 or WPA2-AES (never WEP/TKIP), disable WPS, deploy 802.1X/EAP-TLS with cert validation, enable 802.11w PMF, segment guest/IoT VLANs, use strong unique SSIDs+passphrases, and run a WIPS.

Why is a long random passphrase the primary defense for WPA2-Personal?

Because WPA2-PSK's only offline attack is dictionary/brute-force on the captured handshake; a long high-entropy passphrase makes the keyspace $2^{n}$ computationally infeasible to exhaust regardless of tooling.

What is the recommended action regarding default AP credentials and firmware?

Change default admin username/password immediately, disable remote management, and keep firmware patched to close known vulnerabilities and prevent management-plane takeover of the AP.

How does network segmentation limit the impact of a compromised wireless client?

Placing wireless/guest/IoT traffic on isolated VLANs with firewall rules prevents a compromised Wi-Fi device from directly reaching sensitive internal servers, containing lateral movement.

What is a KRACK attack and which mechanism does it exploit?

KRACK (Key Reinstallation Attack) exploits the WPA2 4-way handshake by replaying handshake message 3, forcing the client to reinstall an already-in-use key and reset the nonce/counter, enabling decryption/replay of packets. It is fixed by patching, not by changing the passphrase.