Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH > Hacking Wireless Networks > Flashcards

Hacking Wireless Networks Flashcards

1
Q

A 32 bit identification string of the Access Point

A

Service Set Identifier (SSID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SSID inserted into the ? of every ? packet

A

Header, data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

MAC address of the Access Point

A

Basic Service Set Identifier (BSSID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A frequency band dedicated to the Industrial, Scientific and Medical purpose

A

ISM Band

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does GSM stand for?

A

Global System for Mobile Communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name the generations of GSM

A

Generations: 2G (GSM), 3G (UMTS), 4G (LTE), 5G

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Wi-Fi Wi-Fi is a local area networking technology based on what standard?

A

IEEE 802.11

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Name the types of Wi-Fi authentication

A

Open authentication & Shared Key authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the purpose of the probe request?

A

The Probe Request is to discover the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the probe response contain?

A

The Probe Response contains the parameters (SSID, data rate, encryption, …)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Name the request types associated with Wi-Fi Open System authentication

A

1 - Probe Request
2 - Open System Authentication Request
3 - Association Request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Name the 3 types of Wireless authentication

A

1 - Open Authentication - no auth
2 - Shared key - auth via shared key(password)
3 - Centralized - central auth ex. RADIUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Name the 4 stages of Wi-Fi shared key authentication

A

Authentication Request
Authentication Response with Challenge Text
Encrypted Challenge Response
Successful / Unsuccessful response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe the shared key process and weakness

A

The client sends Authentication Request

The client encrypt the challenge test with his shared key

The AP decrypt the encrypted challenge test with his shared key, if the decrypted text matches, the successful authentication response frame is sent to the client

This challenge test can be captured by a hacker as a clear text, so the hacker can get the shared key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does RC4 stand for?

A

RC4 - Rivest Cipher 4 Stream Cipher Algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does DSSS stand for?

A

Direct-Sequence Spread Spectrum (DSSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What kind of standard is IEEE 802.1X?

A

IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Does IEEE 802.1X provide for authentication?

A

Yes, It provides an authentication and access controls across wired and wireless networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Direct-Sequence Spread Spectrum (DSSS)?

A

Combines all available waveforms into a single purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does EAP stand for?

A

Extensible Authentication Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What kind of framework is EAP?

A

an authentication framework frequently used in wireless networks and point-to-point connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SSID and BSSID stand for what?

A

Service Set Identifier, Base Service Set Identifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Name two types of Wireless Antennas

A

Directional & Omnidirectional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Name 3 types of Directional Antennas

A

Parabolic, Yagi-Uda, & Horn

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does FHSS mean?

A

Frequency-hopping spread spectrum (FHSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Name 3 types of Omnidirectional antennas

A

Whip, Rubber Ducky, & Monopole

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Name 3 use cases for Omnidirectional antennas

A

radio broadcasting, cell phones, & GPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does WEP stand for?

A

Wired Equivalent Privacy (WEP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Name the first wireless encryption standard

A

Wired Equivalent Privacy (WEP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What type of attack was WEP designed to prevent?

A

Man-in-the-Middle attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Describe Frequency-hopping spread spectrum (FHSS)

A

A method of transmitting radio signals by rapidly changing the carrier frequency among many distinct frequencies occupying a large spectral band.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What OSI layers is WEP used in?

A

Physical layer and Data Link layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does IV in WEP stand for?

A

Initialization Vector (IV)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How many bits long is the IV in WEP?

A

24-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How long is the WEP shared-secret key?

A

40-bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How long is the WEP key after combining the IV and shared-secret key?

A

64 bits = 24 bit (IV) and 40 bits (shared-secret key)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What encryption algorithm does WEP use?

A

RCA RC4 PRNG algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What does WPA stand for?

A

Wi-Fi Protected Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How does TKIP make WPA better than WEP?

A

Temporal Key Integrity Protocol (TKIP) implements a key mixing function that combines the secret key with the initialization vector before passing it to the RC4 cipher. WEP, in comparison, merely concatenated the initialization vector to the root key, and passed this value to the RC4 routine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

WPA’s TKIP increased WEP’s 64 bit key to what bit-length?

A

128-bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

WPA’s sequence counter mechanism prevents against what type of attack?

A

Replay attack

42
Q

How long in bits is WPAs IV?

A

WPA IV is 48-bit long

43
Q

What does CCMP in WPA2 stand for?

A

Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP)

44
Q

WPA2 uses what symmetric algorithm?

A

AES

45
Q

What are the two types of WPA versions?

A

WPA-Personal & WPA-Enterprise

46
Q

WPA-Personal uses what cipher for authentication?

A

TKIP + PSK (password) = 64/128 bit RC4 MIC

47
Q

WPA-Enterprise uses what cipher for authentication?

A

TKIP + RADIUS = 64/128 bit RC4 MIC

48
Q

Name two Wireless attacks on access control

A

MAC spoofing & Rogue Access point

49
Q

Name two Wireless attacks on data integrity

A

Data frame injection & replay attacks

50
Q

Name two Wireless attacks on confidentiality

A

traffic analysis, session hijacking, MITM

51
Q

WPA2 replaced WPAs TKIP with what?

A

CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) replaced TKIP

52
Q

Name two Wireless attacks on availability

A

flooding, ARP poisoning, De-Authentication attacks

53
Q

WPA2-Personal uses what for authentication?

A

CCMP + PSK (Pre Shared Key)
128 bit AES MIC Encryption

54
Q

WPA2-Enterprise uses what for authentication?

A

CCMP + RADIUS
128 bit AES MIC Encryption

55
Q

What does WPA2’s CCMP provide?

A

CCMP provides Data confidentiality (AES), authentication, and access control

56
Q

Name two Wireless attacks on Authentication

A

password cracking, identity theft, password guessing

57
Q

What is BlueSmacking?

A

An attack that uses the L2CAP protocol to transfer an oversized ECHO packet to the Bluetooth enabled devices resulting in Denial Of Service.

58
Q

What is BlueBugging?

A

exploiting bugs in Bluetooth devices to gain remote access

59
Q

What is BlueJacking?

A

send unsolicited data to Bluetooth devices

60
Q

What is BluePrinting?

A

extract information about the device

61
Q

What is BlueSnarfing?

A

steal data from target device

62
Q

What does WPA use for encryption?

A

RC4 with TKIP (Temporal Key Integrity Protocol

Initialization Vector (IV) is larger and an encrypted hash

63
Q

Name 5 WiFi countermeasures

A

Check paired devices
Turn off visibility / turn off Bluetooth if not used
Use strong PIN
Use encryption
Don’t accept unknown requests

64
Q

Bluetooth Class 1 is what power and range?

A

100mW (20 dBm) & 100 m

65
Q

Bluetooth Class 2 is what power and range?

A

2.5 mW (4 dBm) & 10 meters

66
Q

Bluetooth Class 3 is what power and range?

A

1 mW (0 dBm) & 1 meter

67
Q

What is the size of the IV and key length in WEP?

A

24 bits & 40/140 bits

68
Q

What is the size of the IV and key length in WPA and WPA2?

A

48-bits & 128 bits

69
Q

What is the size of the IV and key length in WPA3?

A

48-bits & 128/256 bits

70
Q

Name 5 Wi-Fi security auditing tools

A
71
Q

What is the purpose of confidentiality attacks?

A

The role of attacks targeting the confidentiality of the information, is simply to break the encryption model

72
Q

Which encryption is better, TKIP or CCMP? Why?

A

CCMP because it uses AES versus TKIP which uses weaker RC4

73
Q

What is the goal of integrity attacks?

A

To tamper with the data

74
Q

What are the 2 countermeasures against integrity attacks?

A

encryption (so that attacker would not be able to read the message at all) and Message Integrity Codes (MICs) that are basically hashing function like MD5 or SHA1 that take a footprint of the whole message and create a hash of 128 bits (MD5) or 160 bits (SHA1)

75
Q

What is the purpose of access control attacks?

A

The concept of access control is all about controlling, who and what devices have access to the network, and who does not. It prevents malicious 3rd parties (unauthorized) from associating to the wireless network

76
Q

What 4 enhancements does TKIP provide over WEP?

A

It uses temporal, dynamically created keys instead of static ones used by WEP.

It uses sequencing to defend against replay and injection attacks.

It uses an advanced key mixing algorithm in order to defeat IV collisions and weak-key attacks in WEP.

It introduces Enhanced Data Integrity (EDI) to defeat bit-flipping attack possible in WEP.

77
Q

What is an attack that aims to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls?

A

Access control attack

78
Q

What is an attack where an attacker sends forged control, management, or data frames over a wireless network to misdirect the wireless devices to perform another type of attack?

A

Integrity attack

79
Q

What is an attack that attempts to intercept confidential information sent over wireless associations, regardless of whether they were sent in clear text or encrypted by Wi-Fi protocols?

A

Confidentiality attack

80
Q

What is an attack that aims at obstructing the delivery of wireless services to legitimate users, either by crippling those resources or by denying them access to WLAN resources?

A

Availability attack

81
Q

What is an attack that attempts to steal the identify of Wi-Fi clients to gain unauthorized access to the network?

A

Authentication attack

82
Q

What are the 6 phases of the wireless hacking methodology?

A
  1. Wi-Fi discovery
  2. GPS mapping
  3. Wireless traffic analysis
  4. Launch of wireless attacks
  5. Wi-Fi encryption cracking
  6. Compromise the Wi-Fi network
83
Q

What tool does the material recommend for detecting WPS-enabled APs?

A

Wash

84
Q

What 3 Wi-Fi discovery tools does the material recommend?

A
  1. inSSIDer Plus
  2. NetSurveyor
  3. Wi-Fi Scanner
85
Q

What mobile Wi-Fi discovery tool does the material recommend?

A

WiFi Analyzer

86
Q

What 2 GPS mapping tools does the material recommend?

A
  1. WiGLE
  2. Maptitude Mapping Software
87
Q

What Wi-Fi hotspot finder tool does the material recommend?

A

Wi-Fi Finder

88
Q

What war driving tool does the material recommend?

A

WiGLE

89
Q

What must be enabled on your Wi-Fi card to sniff wireless traffic?

A

Monitor mode

90
Q

What tool does the material recommend for performing spectrum analysis?

A

RF Explorer

91
Q

What is an attack that can obtain 1500 bytes of the pseudo random generation algorithm, which can be used with packetforge-ng to perform various injection attacks?

A

Wireless fragmentation attack

92
Q

Name the following attack.

  1. A client is authenticated and associated with an AP
  2. An attacker sends a disassociate request packet to take the client offline
A

Disassociation denial of service attack

93
Q

Name the following attack.

  1. A client is authenticated and associated with an AP
  2. An attacker sends a de-authenticate request packet to take a single client offline
A

De-authentication denial-of-service attack

94
Q

What are the 4 steps of launching a MITM attack using aircrack-ng?

A
  1. Run airmon-ng in monitor mode
  2. Start airodump to discover SSIDs on interface
  3. De-authenticate the client using aireplay-ng
  4. Associate your wireless card with the AP you are accessing with aireplay-ng
95
Q

What tool can be used for wireless ARP poisoning?

A

Ettercap

96
Q

Provide 3 benefits of DSSS

A

more bandwidth
data encoding
low power density
noise like signals
hard to detect and jam

97
Q

What is DSSS?

A

Direct Sequence Spread Spectrum

98
Q

What are two ways for an endpoint to discover a WiFi network?

A

Either by passively waiting and listening for announcements (beacon frames) from access points or by sending prove requests which actively ask every WiFi device around if they are a network

99
Q

A type of denial-of-service(availability) attack that disconnect devices from a network. The motive is either capturing reconnection handshakes or diminishing the network’s quality of service

A

Deauthentication attack

100
Q

Sequencing helps defend against what kind of attacks?

A

replay and injection attacks.

CEH (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions