Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Ethical Hacker v11 > Hacking Wireless Networks > Flashcards

Hacking Wireless Networks Flashcards

1
Q

Which of the following technologies is an air interface for 4G and 5G broadband wireless communications?

MIMO-OFDM
FHSS
OFDM
DSSS

A

MIMO-OFDM - Multiple-in Multiple-out orthogonal frequency-division multiplexing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following wireless standards uses modulation schemes such as GFSK, π/4-DPSK, and 8DPSK and a frequency of 2.4 GHz with data transfer rates in the range of 25–50 Mbps?

  1. 16 (WiMAX)
  2. 11a
  3. 11g
  4. 15.1 (Bluetooth)
A

802.15.1 (bluetooth)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which modulations do 802.11a and 802.11g use?

A

OFDM - orthogonal frequency-division multiplexing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In which of the following is the original data signal multiplied with a pseudo random noise spreading code?

Orthogonal Frequency-division Multiplexing (OFDM)
Frequency-hopping Spread Spectrum (FHSS)
Direct-sequence Spread Spectrum (DSSS)
Multiple input, multiple output-orthogonal frequency-division multiplexing (MIMO-OFDM)

A

Direct-sequence Spread Spectrum (DSSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following is a standard for Wireless Local Area Networks (WLANs) that provides improved encryption for networks that use 802.11a, 802.11b, and 802.11g standards?

  1. 11e
  2. 11i
  3. 11d
  4. 11n
A

802.11i

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is 802.11e used for?

A

802.11e is used for real-time applications such as voice, VoIP, and video. To ensure that these time-sensitive applications have the network resources they need, 802.11e defines mechanisms to ensure Quality of Service (QoS) to Layer 2 of the reference model, the medium-access layer, or MAC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is WiMAX?

A

WiMAX (Worldwide Interoperability for Microwave Access), is a family of wireless broadband communication standards based on the IEEE 802.16 set of standards, which provide multiple physical layer (PHY) and Media Access Control (MAC) options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which of the following Wi-Fi security protocols uses GCMP-256 for encryption and HMAC-SHA-384 for authentication?

PEAP
WPA3
WEP
CCMP

A

WPA3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How can WPA2 be attacked?

A

WPA2 has a significant vulnerability to an exploit known as key reinstallation attack (KRACK). This exploit may allow attackers to sniff packets, hijack connections, inject malware, and decrypt packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can WPA be attacked?

A

In WPA, vulnerabilities in TKIP allow attackers to guess the IP address of the subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How can WEP be attacked?

A

In WEP, the IV (initialization vector) is a part of the RC4 encryption key, which leads to an analytical attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How can EAP be attacked?

A

Vulnerabilities of EAP-TTLS/PAP make it vulnerable to Man-in-the-Middle attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

WPA2 uses AES for wireless data encryption at which of the following encryption levels?

64 bit and CCMP
128 bit and CRC
128 bit and CCMP
128 bit and TKIP

A

128-bit key length and CCMP encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following cryptographic algorithms is used by CCMP?

TKIP
DES
AES
RC4

A

AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of the following Encryption technique is used in WPA?

RSA
AES
TKIP
DES

A

TKIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following protocol encapsulates the EAP within an encrypted and authenticated Transport Layer Security (TLS) tunnel?

RADIUS
LEAP
PEAP
CCMP

A

PEAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is LEAP?

A

LEAP is a proprietary version of EAP developed by Cisco.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is CCMP?

A

CCMP is an encryption protocol used in WPA2 for stronger encryption and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of the following consists of 40/104 bit Encryption Key Length?

WEP
WPA
WPA2
RSA

A

WEP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is ad-hoc asssociation?

A

An attacker may perform this kind of attack using any Universal Serial Bus (USB) adapter or wireless card. The attacker connects the host to an unsecured client to attack a specific client or to avoid AP security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a promiscuous client?

A

Promiscuous clients allow an attacker to transmit target network traffic through a fake AP. It is very similar to the evil-twin threat on wireless networks, in which an attacker launches an AP that poses as an authorized AP by beaconing the WLAN’s SSID.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is client misassociation?

A

The client may intentionally or accidentally connect or associate with an AP outside the legitimate network because the WLAN signals travel through the air, walls, and other obstructions.

23
Q

What is a wormhole attack?

A

Wormhole attack exploits dynamic routing protocols, such as DSR (dynamic source routing) and AODV (Ad-hoc On-demand Distance Vector). An attacker locates himself strategically in the target network to sniff and record the ongoing wireless transmission

24
Q

What is a sinkhole attack?

A

In a sinkhole attack, an attacker places the malicious node near the base station to attract all the neighboring nodes with fake routing information and further performs data forging attacks

25
Q

What is a evil twin AP attack?

A

Normally, when a wireless client is switched on, it probes a nearby wireless network for a specific SSID. In a honeypot AP attack, an attacker takes advantage of this behavior of wireless clients by setting up an unauthorized wireless network using a rogue AP

26
Q

What are confidentiality attacks?

A

Confidentiality attacks attempt to intercept confidential information sent over wireless associations, regardless of whether they were sent in clear text or encrypted by Wi-Fi protocols.

27
Q

What are availability attacks?

A

Availability attacks aim at obstructing the delivery of wireless services to legitimate users, either by crippling those resources or by denying them access to WLAN resources

28
Q

What are authentication attacks?

A

The objective of authentication attacks is to steal the identity of Wi-Fi clients, their personal information, login credentials, etc. to gain unauthorized access to network resources

29
Q

What are integrity attacks?

A

In integrity attacks, attackers send forged control, management, or data frames over a wireless network to misdirect the wireless devices to perform another type of attacks (e.g., DoS)

30
Q

Kenneth, a professional penetration tester, was hired by the XYZ Company to conduct wireless network penetration testing. Kenneth proceeds with the standard steps of wireless penetration testing. He tries to collect lots of initialization vectors (IVs) using the injection method to crack the WEP key. He uses the aircrack-ng tool to capture the IVs from a specific AP. Which of the following aircrack-ng commands will help Kenneth to do this?

airmon-ng start wifi0 9
airodump-ng -c 9 –bssid 00:14:6C:7E:40:80 -w output ath0
aireplay-ng -1 0 -e teddy -a 00:14:6C:7E:40:80 -h 00:0F:B5:88:AC:82 ath0
aireplay-ng -9 -e teddy -a 00:14:6C:7E:40:80 ath0

A

airodump-ng -c 9 –bssid 00:14:6C:7E:40:80 -w output ath0

31
Q

Andrew, a professional penetration tester, was hired by ABC Security, Inc., a small IT-based firm in the United States to conduct a test of the company’s wireless network. During the information-gathering process, Andrew discovers that the company is using the 802.11 g wireless standard. Using the NetSurveyor Wi-Fi network discovery tool, Andrew starts gathering information about wireless APs. After trying several times, he is not able to detect a single AP. What do you think is the reason behind this?

MAC address filtering feature must be disabled on APs or router.
Andrew must be doing something wrong, as there is no reason for him to not detect access points.
NetSurveyor does not work against 802.11g.
SSID broadcast feature must be disabled, so APs cannot be detected.

A

SSID broadcast feature must be disabled, so APs cannot be detected.

32
Q

What is WiFiFoFum?

A

WiFiFoFum is a wardriving app to locate, display and map found WiFi networks. WiFiFoFum scans for 802.11 Wi-Fi networks and displays information about each including: SSID, MAC, RSSI, channel, and security. WiFiFoFum also allows you to connect to networks you find and log the location using the GPS. KML logs can be emailed.

33
Q

What is Skyhook?

A

Skyhook is a GPS mapping tool

34
Q

What is MANA Toolkit?

A

MANA Toolkit comprises a set of tools that are used by the attackers for creating rogue APs and perform sniffing attacks and MITM attack

35
Q

Which of the following security standards contains the Dragonblood vulnerabilities that help attackers recover keys, downgrade security mechanisms, and launch various information-theft attacks?

WPA
WPA3
WEP
WPA2

A

WPA3 (Dragonblood is an attack on the Dragonfly handshake method of WPA3)

36
Q

Which tool would be used to collect wireless packet data?

NetStumbler
Netcat
Nessus
John the Ripper

A

NetStumbler

37
Q

During a wireless penetration test, a tester detects an AP using the WPA2 encryption. Which of the following attacks should be used to obtain the key?

The tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
The tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key.
The tester must use the tool inSSIDer to crack it using the ESSID of the network.
The tester must capture the WPA2 authentication handshake and then crack it.

A

The tester must capture the WPA2 authentication handshake and then crack it.

38
Q

What is CommView for WiFi?

A

CommView for Wi-Fi is a wireless network monitor and analyzer for 802.11 a/b/g/n networks. It captures packets to display important information such as the list of APs and stations, per-node and per-channel statistics, signal strength, a list of packets and network connections, protocol distribution charts, etc. By providing this information, CommView for Wi-Fi can view and examine packets, pinpoint network problems, and troubleshoot software and hardware

39
Q

What is BlueScan?

A

BlueScan is a bash script that implements a scanner to detect Bluetooth devices that are within the range of our system. BlueScan works in a non-intrusive way, that is, without establishing a connection with the devices found and without being detected. Superuser privileges are not necessary to execute.

40
Q

What is WiFish Finder?

A

WiFish Finder is a tool for assessing whether WiFi devices active in the air are vulnerable to ‘Wi-Fishing’ attacks. Assessment is performed through a combination of passive traffic sniffing and active probing techniques. Most WiFi clients keep a memory of networks (SSIDs) they have connected to in the past. Wi-Fish Finder first builds a list of probed networks and then using a set of clever techniques also determines security setting of each probed network. A client is a fishing target if it is actively seeking to connect to an OPEN or a WEP network.

41
Q

In which of the following Bluetooth threats does an attacker trick Bluetooth users into lowering security or disabling authentication for Bluetooth connections to pair with them and steal information?

Bugging devices
Protocol exploitation
Social engineering
Malicious code

A

Social engineering

42
Q

Which of the following btlejack commands allows an attacker to sniff new Bluetooth low-energy connections?

btlejack -s
btlejack -d /dev/ttyACM0 -d /dev/ttyACM2 -s
btlejack -f 0x129f3244 -j
btlejack -c any

A

btlejack -c any

43
Q

How do you perform a jamming operation with btlejack?

A

btlejack -f 0x129f3244 -j

44
Q

How do you sniff an existing connection with btlejack?

A

btlejack -s

45
Q

How do you select target devices with btlejack?

A

btlejack -d /dev/ttyACM0 -d /dev/ttyACM2 -s

46
Q

Which of the following terms is used to describe an attack in which an attacker gains remote access to a target Bluetooth-enabled device without the victim being aware of it?

Bluesnarfing
Bluebugging
Bluesmacking
Bluejacking

A

Bluebugging

47
Q

What is bluesmacking?

A

A Bluesmacking attack occurs when an attacker sends an oversized ping packet to a victim’s device, causing a buffer overflow. This type of attack is similar to an ICMP ping of death

48
Q

What is bluesnarfing?

A

Bluesnarfing is a method of gaining access to sensitive data in a Bluetooth-enabled device. An attacker who is within range of a target can use special software to obtain the data stored on the victim’s device.

49
Q

What is bluejacking?

A

Bluejacking is the use of Bluetooth to send messages to users without the recipient’s consent, similar to email spamming. Prior to any Bluetooth communication, the device initiating connection must provide a name that is displayed on the recipient’s screen. As this name is user-defined, it can be set to be an annoying message or advertisement. Strictly speaking, Bluejacking does not cause any damage to the receiving device. However, it may be irritating and disruptive to the victims

50
Q

What is blueprinting?

A

BluePrinting is a footprinting technique performed by an attacker in order to determine the make and model of the target Bluetooth-enabled device. Attackers collect this information to identify model, manufacturer, etc. and analyze them in an attempt to find out whether the devices are in the range of vulnerability to exploit

51
Q

Which of the following protocols is used by BlueJacking to send anonymous messages to other Bluetooth-equipped devices?

L2CAP
SDP
OBEX
LMP

A

OBEX (object exchange).

52
Q

What are Wired Side Inputs?

A

Network management software uses this technique to detect rogue APs. This software detects devices connected in the LAN, including Telnet, SNMP, CDP (Cisco discovery protocol) using multiple protocols

53
Q

Which of the following is a wireless security layer where per frame/packet authentication provides protection against MITM attacks and prevents an attacker from sniffing data when two genuine users communicate with each other?

Device security
Connection security
End-user protection
Wireless signal security

A

Connection security

54
Q

Which of the following components of Cisco’s WIPS deployment forwards attack information from wireless IPS monitor-mode APs to the MSE and distributes configuration parameters to APs?

Wireless control system
Wireless LAN controller
Local mode AP
Mobility services engine

A

Wireless LAN controller

Certified Ethical Hacker v11 (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions