Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Pentest+ PT0-002 > Wireless and RF Attacks > Flashcards

Wireless and RF Attacks Flashcards

1
Q

Which organization defines and limits the power ranges that can be applied to Wi-Fi-enabled devices?

A

The Federal Communications Commission (FCC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What two modes do wireless networks operate in, and what do they mean?

A

1) Ad hoc mode, connected in a peer-to-peer mode 2) Infrastructure mode, communicate with a central device instead of directly communicating with eachother

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which three frames associated with a wireless network does the 802.11 standard define?

A

Management, control, and data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the process of listening to a private conversation without the other party knowing you are doing so?

A

Eavesdropping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which wireless security protocol was designed to allow users to set up secure wireless networks and reduce the overall complexity of associating additional hosts to a network?

A

Wi-Fi Protected Setup (WPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which wireless security protocol requires user interaction to initiate communication and uses WPA/WPA2 security and an 8-digit PIN to connect?

A

Wi-Fi Protected Setup (WPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some common tools used to attack WPS?

A

Reaver, wash, and wifite for offline pixie dust attacks, or online brute-force PIN attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What form of wireless encryption relies on a secret key that is shared between the access point and the clients on the network using the RC4 stream cipher?

A

Wired Equivalent Privacy (WEP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

WEP was the standard before WPA. Key reuse in the encryption stream makes it vulnerable to cracking, as well as to fragmentation and replay attacks. What tools can be used to attack WEP?

A

Aireplay-ng can generate IV samples and aircrack-ng can decipher the secret key. You can also use wifite to conduct attacks against WEP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which protocol is symmetric encryption that still uses the same WEP programming and RC4 encryption algorithm, but also encrypts each data packet with stronger and unique encryption keys?

A

Temporal Key Integrity Protocol (TKIP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

WPA uses a four-way handshake and a shared passphrase. What are some of its weaknesses?

A

Dictionary attacks, deauthentication attacks which can force a new handshake to capture information. Some tools used are aricrack-ng, aireplay-ng, airodump-ng, wifite, cowpatty, genpmk, and hashcat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

WPA3 hides the passphrase behind additional security with Dragonfly key exchange. What attacks is it susceptible to?

A

Downgrade attacks and timing attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What Kali Linux commands can be used to show compatible channels, frequencies, encryption capabilities, and further manipulate the interface by enabling or disabling it or by manually configuring it on a wireless network?

A

iw, iwlist, iwconfig

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a surveillance technique for discovering SSIDs, router vendor information and signal strength, MAC addresses, channels, access control protections (encryption) and more?

A

Stumbling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a tactical surveillance process for surveying an area for access points while in a moving vehicle?

A

Wardriving

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an open-source software that provides a suite for conducting RF communication monitoring and security testing of Wi-Fi networks?

A

aircrack-ng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a popular wireless sniffing tool included in the aircrack-ng toolset that can be used during a pentest to discover and validate wireless targets?

A

airodump-ng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What tool can do 802.11 sniffing and perform wireless intrusion detection, with better GPS support than airodump-ng?

A

Kismet

19
Q

Which Kali tool can identify WPS networks and supports active probing of detected wireless networks to identify whether they support WPS?

A

wash

20
Q

After you have discovered a WPS PIN-controlled target with a tool like wash, what command can you use in Kali to brute-force attack the PIN?

A

reaver

21
Q

Which Kali tool attacks a WPS implementation weakness in the registrar functionality where it only takes 11,000 attempts to guess the correct WPS PIN?

A

reaver

22
Q

What kind of attack will speed up the WEP cracking process by injecting arbitrary packets into the wireless access point, but does not actually crack the key?

A

Fragmentation attack

23
Q

Which two tools, when used together, can crack WPA/WPA2 by building a PMK rainbow table by precomputing the hashes and saving them in a hash file and then combining them with a four-way handshake from a PCAP file to crack the key.

A

genpmk and cowpatty

24
Q

Which tool within the aircrack-ng suite of wireless attack tools can you use to launch of a denial of service attack?

A

mdk4

25
Q

Rogue AP attacks may be used for targeting Enterprise implementations that rely on RADIUS. What tools can you use to launch attacks that will help target those networks?

A

HostAP, EAPhammer, airbase-ng and aireplay-ng

26
Q

What is a popular access point software that can be run from a computer operating system like Kali Linux and allows the host to perform all the functions of a typical wireless router?

A

HostAP

27
Q

What kind of attack is an AP method used to listen for any network probe request from a client to join a given network, not just one specifically targeted network, like the evil twin attack? This attack will then rebroadcast the ESSID from the victim in order to entice the victim to connect to the evil network

A

Karma attack

28
Q

What group of standards defines specifications for various categories of wireless private area networks (WPANs) including Bluetooth and ZigBee?

A

802.15

29
Q

When hacking Bluetooth-enabled devices, what is the process of information gathering called?

A

Blueprinting

30
Q

What is the default protocol stack for Bluetooth in most Linux distributions, including Kali?

A

BlueZ

31
Q

Which attack is the process of exploiting vulnerabilities found in certain Bluetooth firmware in order to steal information from a wireless device?

A

Bluesnarfing

32
Q

Which tool in Kali Linux is capable of carrying out a Bluesnarfing attack?

A

Bluesnarfer

33
Q

What is a method of sending unsolicited messages to mobile users using Bluetooth?

A

Bluejacking

34
Q

What device is so small that it can be installed to intercept traffic between an RFID tag and reader without arousing suspicion?

A

ESPKey

35
Q

What is the process of reading a series of bits from one RFID card or key fob and writing the same series of bits to another compatible card?

A

RFID cloning

36
Q

List the 5 layers of Bluetooth

A

SDP, LMP, L2CAP, RFCOMM, and TCS

37
Q

WEP uses an encryption algorithm called RC4, which was developed by Ronald Rivest. RC4 is a ______________ cipher, which is a symmetric key cypher used to expand a short key into an infinite pseudo-random keystream.

A

Stream. RC4 is an older encryption algorithm that helps encrypt WEP networks.

38
Q

CRC-32 is an algorithm used to verify the integrity of network packets for WEP and is also found in different applications to detect changes in hardware. CRC-32 is based on the original cyclic redundancy check and is not recommended for verifying the integrity of modern-day technology due to the fact that ___________.

A

CRC-32 is a variant of CRC, which is based on a noncryptographic algorithm that offers very little assurance with regard to data manipulation.

39
Q

In order to crack WEP, you need to capture enough initialization vectors in the network packets to recover the secret key. WEP secret keys can be one of two different lengths. Ten-digit keys are 64 bits in length. How many digits are in a key length of 128 bits?

A

26

40
Q

With WPA, the wireless client and the access point both know the preshared key in order to join the network. During the authorization process, each device will use the PSK to generate a pairwise master key (PMK) in order to derive a _______________ , which is used to encrypt packets sent to the receiving host. What is this type of key called?

A

Pairwise transient key

41
Q

During a pentest, your team identifies an access point that is broadcasting the SSID value and is protected with only WEP encryption. Your team attempts to use airplay-ng to replay an injected ARP packet over the network; however, the tool has not captured any ARP replies over the network. This is likely due to the fact that no clients are talking over the network. In order to speed up the cracking process, what could you recommend your team do?

A

Use the ping command and ping nonexistent hosts on the network. The repeated use of ping against nonexistent hosts would generate multiple initialization vectors with the AP as the host, but will never be identified and the request will continue to propagate throughout the network.

42
Q

What kind of wireless attack forces a new handshake with a device to capture information needed to generate guesses.

A

Deauthentication attacks

43
Q

What is PBKDF2?

A

Password-Based Key Derivation Function 2 is a key derivation function with a sliding computational cost, used to reduce vulnerability to brute-force attacks.

44
Q

In order to crack the WPA or WPA2 PSK, you will need to capture the four-way handshake. During a pentest, your team identifies multiple clients on the target network. What is the best way to capture the handshake?

A

Deauthenticate one of the clients.

Pentest+ PT0-002 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions