802.11 Fuzzing Attacks GAWN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An auditor is fuzzing a wireless driver by taking valid beacon frames captured from the target network and randomly flipping bits in the frame body before retransmitting them. This approach is best described as which type of fuzzing?

   • AGeneration-based fuzzing
   • BProtocol-aware fuzzing
   • CReplay-based fuzzing
   • DMutation-based fuzzing
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A wireless security engineer is comparing fuzzing tools for a project that requires generating a high volume of malformed beacon frames with precise control over information element lengths. They also need to integrate the fuzzing into an automated test harness. Which tool and approach is most suitable?

   • AUse Kismet to generate and inject beacon frames
   • BUse Aircrack-ng's aireplay-ng to inject modified beacon frames
   • CUse Scapy in a Python script to generate and inject beacon frames with custom IE lengths
   • DUse Wifuzz with its built-in beacon templates and command-line interface
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An attacker successfully fuzzes a beacon frame and causes all clients to drop their associations and continuously scan for a new network. Which impact category does this attack primarily affect?

   • ANon-repudiation, because the attacker can deny sending the frame
   • BConfidentiality, because the attacker can capture the re-association traffic
   • CAvailability, because clients are unable to maintain a connection to the network
   • DIntegrity, because the beacon frame is modified
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A developer is writing a fuzzer for an 802.11 driver. They want to test how the driver handles unexpected combinations of frame types and subtypes. Which approach would best achieve this?

   • ASending frames with random values in the Type and Subtype fields of the Frame Control
   • BSending frames with all bits set to 1 in the Frame Body
   • CSending frames with correct FCS values only
   • DSending only valid data frames with random payloads
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A network administrator is choosing between two defensive strategies against 802.11 fuzzing: (1) deploying a WIDS that monitors for malformed frames, and (2) enforcing a strict firmware update policy for all APs and clients. Which strategy is more effective at preventing fuzzing attacks?

   • ABoth are equally effective because they address different aspects of the attack
   • BNeither is effective because fuzzing attacks cannot be prevented
   • CFirmware updates are more effective because they eliminate the vulnerabilities that fuzzing exploits
   • DWIDS is more effective because it can block malicious frames in real time
   Reveal Solution Discussion Select an answer first