Cyber Quix Day 39

Last Updated :
Discuss
Comments

Question 1

You want to capture a WPA/WPA2 4-way handshake and then attempt an offline password guess. Which minimal sequence of actions is correct?

  • airmon-ng start wlan0 → run airodump-ng on channel → force deauth with aireplay-ng → aircrack-ng -w wordlist capture.cap

  • iwconfig wlan0 mode monitor → use tcpdump to capture→ runjohn on the pcap

  • ifconfig wlan0 down → airbase-ng to create fake AP→reaver to crack handshake

  • airmon-ng start wlan0 → airdecap-ng to decrypt traffic→aireplay-ng --fakeauth to crack key

Question 2

Which statement best describes what happens during a Wi-Fi deauthentication (deauth) attack?

  • The attacker floods the AP with valid association requests until it crashes.

  • The attacker sends forged deauth frames causing clients to drop association, enabling handshake capture or captive-portal attacks.

  • The attacker replays encrypted data frames to force the AP to reveal its PSK.

  • The attacker modifies DNS responses at the access point to redirect traffic.

Question 3

You find an AP advertising WPS and want to test if it’s vulnerable to a fast offline WPS PIN exploit (pixie-dust). Which tool is specifically suited to that and why?

  • reaver because it performs an online brute force of WPS PINs only.

  • aircrack-ng because it recovers WPS PINs from WPA handshakes.

  • mdk3 because it provides a GUI for WPS exploits.

  • pixiewps because it exploits low entropy in some WPS implementations to recover the PIN offline.

Question 4

Which tool is best when you want passive, non-intrusive mapping of visible Wi-Fi networks (SSID/BSSID/channel/clients) without transmitting frames?

  • aireplay-ng

  • mdk3

  • kismet or airodump-ng in passive mode

  • reaver

Question 5

A vendor asks how to reduce risk from key-reinstallation style attacks (KRACK). Which immediate practical step helps most?

  • Rotate the Wi-Fi SSID daily.

  • Disable WPA2 and revert to WEP for compatibility.

  • Apply vendor firmware and OS patches for both APs and clients; enforce TLS for app traffic as defense-in-depth.

  • Increase beacon interval on the AP.

Question 6

You capture and replay an authentication frame later to impersonate a client. Which category does this attack fall into and what immediate effect can it achieve?

  • Replay attack can bypass authentication or cause duplicated actions if protocol lacks freshness checks.

  • Jamming attack permanently prevents the client from communicating.

  • Packet sniffing only passive observation, no impersonation.

  • Rainbow attack recovers the password hash.


Question 7

A coffee shop operator wants to stop attackers creating fake APs with a similar SSID to steal logins. Which combination is the most practical defense?

  • Use WPA-PSK with a simple shared password; disable HTTPS.

  • Broadcast SSID on all channels and reduce transmit power.

  • Use WEP with MAC filtering.

  • Enable client isolation, use WPA2/WPA3 with strong passwords, and publish the true SSID via captive-portal fingerprinting (and educate users to verify TLS).

Question 8

Which command is the correct use of airodump-ng to capture handshakes on channel 6 for BSSID 00:11:22:33:44:55, writing output prefix dump?

  • airodump-ng --channel 6 --bssid 00:11:22:33:44:55 -w dump wlan0mon

  • airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w dump wlan0mon

  • airodump-ng -w dump wlan0mon --filter bssid 00:11:22:33:44:55

  • airodump-ng -b 00:11:22:33:44:55 -ch 6 -o dump wlan0mon

Question 9

A site reports intermittent Wi-Fi outages that affect all APs on 2.4 GHz. Which observed symptom most strongly suggests an RF jamming attack (malicious interference) rather than ordinary congestion?

  • High client count on channel 6 during daytime.

  • Slow download speeds but stable associations.

  • Sudden wideband noise across many channels with simultaneous client disconnects and very low SNR.

  • Only one AP reporting low throughput while others are fine.


Question 10

You’re asked to test a client’s office Wi-Fi for vulnerabilities. What is the correct professional approach before running active attacks (deauth, WPS brute force, handshake capture)?

  • Just run tools quickly it’s faster and usually fine.

  • Only perform passive scans active tests are illegal everywhere.

  • Run intrusive attacks only after notifying staff verbally.

  • Get written authorization (scope & date/time), test on non-production where possible, and inform stakeholders of expected impacts.

There are 10 questions to complete.

Take a part in the ongoing discussion