Wireless Network Hacking Flashcards
What vulnerability exists in WPS (Wi-Fi Protected Setup)?
Brute-force, with 11,000 tries or less by providing first 4 numbers instead of the 8.
What is Fragmentation Attack in Wireless Hacking?
Used to help crack the WEP password by obtaining the pseudorandom generation algorithm (PRGA) of captured packets.
What is a Karma Attack?
It is a variant of the evil twin attack. It exploits a device’s Wifi behaviour by connecting to a SSID that was used to connect to in the past. This attack replicates the SSID with a malicious AP instead.
What is a Downgrade Attack?
A downgrade attack is an attack that seeks to cause a connection, protocol, or cryptographic algorithm to drop to an older and less secure version, typically in SSL/TLS.
What is a Deauthentication attack?
Kicking the victim off from the current connected AP. This is done by spoofing the victim’s MAC address and sending the deauthentication frame to the AP. The victim will automatically try reconnecting. Deauthentication attack can be repeated to prevent the victim from establishing stable connection.
What does WEP Stand for?
Wired Equivalent Privacy
What is the bit size for the IV (Initialization Vector) in WEP?
24 bits
What are the 2 possible key lengths for WEP?
40/104 bits
What encryption does WEP use?
RC4
What redundancy check is used in WEP?
CRC-32
What does TKIP stand for?
Temporal Key Integrity Protocol
What does WPA stand for?
Wi-Fi Protected Access
What encryption does WPA use?
RC4 + TKIP
What is the IV bit size for WPA networks?
48 bits
What is the key length for WPA networks?
128 bits
How often does WPA key changes?
Every 10,000 packets
What encryption does WPA2 use?
AES
What type of authentication does WPA2 - Personal use?
Pre-Shared Key.
What type of authentication does WPA2 - Enterprise use?
Set of credentials (Either via EAP or RADIUS server)
What is the purpose of the 802.11 Series?
Defines the standard for wireless networks
What technology uses the following standard:
802.15.1
Bluetooth
What technology uses the following standard:
802.15.4
Zigbee - Low power, Low data rate, close proximity networks
What technology uses the following standard:
802.16
WiMAX - Broadband wireless metropolitan area networks (MAN)
What is Basic Service Set Identifier (BSSID)?
MAC address of the wireless access point
Wireless Attack: Data Frame Injection
What is it?
Constructing and sending forced network frames (Data).
Wireless Attack: Bit-Flipping
What is it?
Capturing frames and flipping bits within the data payload.
What is the purpose of warwalking, wardriving and warflying?
To discovery WiFi networks and access points, often looking for insecure ones to hack or gain access to.
What type of tool is Kismet?
Wireless packet analyser/sniffer. Also can be used for network discovery.
Wireless Attack: Rogue Access Point
What is it?
Placed Access Point controlled by an attacker.
Wireless Attack: Evil Twin
What is it?
Rogue AP with similar SSID to the target network. AKA Mis-association attack.
Wireless Attack: Honeyspot
What is it?
Faking a well-known hotspot with a Rogue AP
Wireless Attack: Ad-Hoc Connection Attack
What is it?
Connecting directly to another phone via wireless media. Victim has to accept the connection
Wireless Attack: Deauthentication
What is it?
Send a deauth packet to the AP with spoofed victim MAC address, disconnecting them from the network.
Wireless Attack: MAC Filtering
What is it?
Retrieving (Sniffing) authorised MAC addresses to connect to the network
Are the following tools used for?
SMAC and TMAC
MAC spoofing
List 2 main attacks against WPA/WPA2 networks
- Password Brute-force
- Key Reinstallation Attack (KRACK)
What does AAA stand for?
- Authentication
- Authorisation
- Accounting
Which network protocols has AAA functionality?
- TACACS+
- RADIUS
- Diameter
What is a Rogue Access Point?
A Wireless Access Point (WAP) added by a well-meaning employee or by a malicious attacker.
What is 802.1x protocol?
Provides authentication mechanism for both wireless and wired connections.
What is a Packet/Network sniffer?
Hardware or software tool to monitor data in a network
What is a Protocol Analyser?
Hardware or software tool to monitor and perform analysis on data in a network
What tool can be used for computer network protocol analysis and security auditing?
Ettercap
Wireless intrusion prevention system (WIPS) operates at what layer of the Open Systems Interconnection (OSI) model?
Layer 2 - Data Link
What is Tcptrace used for?
Analyze the files produced by packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek
What type of tool is NetStumbler?
Application is a Windows-based tool generally used to discover WLAN networks running on 802.11 a/b/g standards and used to collect wireless packet data
