Wireless Client Attacks GAWN Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security auditor is testing the wireless network of a hotel that offers a free, open Wi-Fi SSID named 'HotelGuest'. The auditor wants to demonstrate how an attacker could capture a guest's email credentials when the guest attempts to log into the hotel's web portal. The auditor has a laptop with two wireless adapters and a fake authentication server. Which approach would most effectively achieve this demonstration?

   • AUse a single adapter in monitor mode to capture all traffic on the 'HotelGuest' channel, then crack the WPA2 handshake offline to recover the guest's credentials.
   • BCreate a new access point with a similar SSID like 'HotelGuest2' and wait for guests to manually connect to it.
   • CDeploy a rogue AP with the same SSID but disable encryption, hoping guests will choose it because it appears more open.
   • DSet up an access point with the same SSID 'HotelGuest' on a different channel, then send deauthentication frames to connected clients to force them onto the rogue AP.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security consultant is performing a wireless assessment for a client. The consultant wants to identify which employees have previously connected to the corporate Wi-Fi network, even when they are not currently associated. The consultant has a laptop with a wireless adapter that supports monitor mode. Which technique would be most effective for this purpose?

   • ASend deauthentication frames to all clients on the corporate network to force them to reconnect and reveal their MAC addresses.
   • BUse a tool to send directed probe requests to the corporate SSID and listen for responses from clients.
   • CPassively capture probe requests from client devices in the area to identify the SSIDs they are searching for.
   • DSet up a rogue AP with the same SSID as the corporate network and wait for clients to connect.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of a fake captive portal in a wireless attack?

   • ATo provide free internet access to users
   • BTo block all internet traffic
   • CTo improve the security of the wireless network
   • DTo trick users into entering credentials or other sensitive information
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is investigating a report that a user's laptop was compromised after connecting to a public Wi-Fi network. The analyst suspects a man-in-the-middle attack was used to inject malicious content into the user's web traffic. Which combination of techniques would an attacker most likely have used to achieve this?

   • ASet up an evil twin AP and use SSL stripping to downgrade HTTPS connections to HTTP.
   • BPerform a denial-of-service attack on the legitimate AP to make the user connect to a wired network.
   • CUse a packet sniffer to capture the user's traffic on the legitimate network without any active interference.
   • DUse a deauthentication attack to force the user to reconnect to a rogue AP with a different SSID.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is assessing a hotel's wireless network. The hotel offers a free Wi-Fi service that uses a captive portal for authentication. The tester wants to demonstrate how an attacker could steal guests' credit card information when they enter it on the portal. Which attack would be most effective?

   • AUse a tool to capture the guests' traffic on the legitimate network and extract credit card numbers from the encrypted traffic.
   • BCreate a honeypot AP with a similar SSID like 'HotelWiFi_Free' and hope guests connect to it.
   • CSet up a rogue AP with the same SSID and a fake captive portal that mimics the hotel's login page.
   • DSend deauthentication frames to the guests to disconnect them, then passively capture their traffic as they reconnect to the legitimate AP.
   Reveal Solution Discussion Select an answer first