Study guide
7.3 Wireless Threats and Attack Concepts
EC-Council Certified Ethical Hacker CEH
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map
2 Reconnaissance, Footprinting, Scanning & Enumeration
2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures
3 Vulnerability Analysis & System Hacking Phases
3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection
4 Malware Threats, Sniffing & Social Engineering
4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses
5 Network & Perimeter Hacking
5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders
6 Web Server & Web Application Hacking
6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts
7 Wireless Network Hacking
7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures
8 Mobile Platform, IoT & OT Hacking
8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security
9 Cloud Computing & Cryptography
9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices
7.3 Wireless Threats and Attack Concepts
Key Takeaways Explain This Topic AI
A rogue access point is any unauthorized AP attached to the network; an evil twin is a rogue AP that impersonates a trusted SSID (often with a stronger signal) to lure clients
Deauthentication frames are unprotected management frames in pre-WPA3 networks, enabling denial of service and forcing reconnections that let an attacker capture the WPA2 handshake
The Aircrack-ng suite drives the WPA2 capture workflow: airmon-ng enables monitor mode, airodump-ng captures frames, aireplay-ng injects deauth, and aircrack-ng runs the offline dictionary attack
The WPS PIN attack exploits an 8-digit PIN validated in two halves (4 + 3 digits, with a checksum), reducing the search space to at most ~11,000 attempts; Pixie-Dust can recover it offline in seconds
Bluetooth faces bluejacking (unsolicited messages) and bluesnarfing (unauthorized data theft); defenders use non-discoverable mode, strong pairing, and disabling unused radios
Last updated: June 2026
How Wireless Attacks Are Categorized
For the CEH exam, group wireless threats by the security property they break. This framing beats memorizing tool names alone. The content below is conceptual and defensive — it explains what each attack does, the tool that performs it, and how a defender detects it, on networks you are authorized to test.
Rogue Access Point
A rogue AP is any wireless access point connected to the network without authorization — for example, an employee plugging in a personal AP for convenience. It creates an uncontrolled entry point that bypasses perimeter controls. Detection: a wireless intrusion prevention system (WIPS) compares observed BSSIDs against an authorized inventory; wired-side switch-port and MAC monitoring locates the device.
Evil Twin
An evil twin is a specialized rogue AP that copies a trusted SSID (and often a similar BSSID and stronger signal) so clients or auto-connect profiles join it instead of the real network. It enables on-path interception and credential capture via fake captive portals or a spoofed RADIUS endpoint. Detection: WIPS flags a duplicate SSID with an unexpected BSSID, a signal-strength anomaly, or an AP appearing where none is authorized.
Deauthentication and Disassociation
In networks without Protected Management Frames (802.11w) , management frames are unauthenticated. Forged deauthentication/disassociation frames knock clients off the AP, causing denial of service and forcing reconnections — which an attacker uses to capture a fresh 4-way handshake. Detection: an abnormal burst of deauth frames or repeated client disconnects in WIPS logs.
RF Jamming
Jamming floods a frequency band with RF energy or noise so legitimate frames cannot be decoded. It is a pure availability attack at the physical layer. Detection: a spectrum analyzer or WIPS shows a sustained noise-floor rise and elevated retransmissions — packet capture alone reveals nothing because no valid frames exist.
The WPA2 Handshake Capture Workflow (Aircrack-ng)
The canonical WPA2-PSK attack chains the Aircrack-ng suite . CEH expects you to map each tool to its role:
Step Tool Role
1. Enable monitor mode airmon-ng Puts the adapter into monitor mode so it captures all 802.11 frames in range, not just its own
2. Discover targets airodump-ng Scans channels and lists APs (BSSID, channel, encryption) and associated clients
3. Capture on one channel airodump-ng Locks to the target's channel/BSSID and writes frames (including any handshake) to a .cap file
4. Force a handshake aireplay-ng Injects deauthentication frames ( -0 ) at a connected client; on reconnect it performs the 4-way handshake, which airodump-ng captures
5. Crack offline aircrack-ng Runs a dictionary/wordlist (e.g., rockyou.txt ) against the captured handshake to recover the passphrase
Other wireless tools CEH references:
Wifite — an automation wrapper that orchestrates the whole Aircrack-ng/WPS/PMKID flow against multiple targets with one command; useful for fast, repeatable authorized audits.
Kismet — a passive 802.11 (and Bluetooth/RF) detector, sniffer, and wireless IDS . It never injects; it identifies networks, can decloak hidden SSIDs in use, logs to PCAP, and supports GPS mapping (wardriving). Because it is passive, it is also a defensive monitoring tool.
Hashcat / John the Ripper — general password crackers that can accelerate WPA2 handshake/PMKID cracking with GPUs.
- Cryptographic and Protocol Attacks
- KRACK (Key Reinstallation Attack)
KRACK (2017) is a protocol-level weakness in the WPA2 4-way handshake . By replaying handshake message 3, an attacker forces the client to reinstall an already-in-use key , resetting nonces and packet counters and enabling decryption or replay of frames. KRACK is a flaw in the handshake state machine , not in AES. Mitigation: vendor patches on clients and APs; WPA3's SAE handshake removes this class of issue.
WPS PIN Attack (Reaver / Pixie-Dust)
Wi-Fi Protected Setup (WPS) lets users join with an 8-digit PIN . The protocol validates the PIN in two halves — the first 4 digits, then the next 3 — and the 8th digit is a checksum . That design collapses the brute-force space from 10^8 to 10^4 + 10^3 = at most ~11,000 attempts . Reaver performs the online brute force; the Pixie-Dust attack ( reaver -K ) exploits weak nonce generation in some chipsets to recover the PIN offline in seconds . Once the PIN is known, the WPA passphrase is revealed regardless of its strength. Mitigation: disable WPS entirely.
Bluetooth, RFID, and NFC Threats
Wireless is broader than Wi-Fi. CEH tests short-range radio threats and their named attacks.
Technology Range Representative threats Defender focus
Bluetooth ~10 m (BR/EDR); more with BLE Bluejacking (push unsolicited messages), bluesnarfing (steal contacts/data without consent), bluebugging (take control of the device), device discovery/tracking Non-discoverable mode, Secure Connections pairing, disable when unused, patch stacks
RFID cm to several m Skimming/eavesdropping, tag cloning, replay Shielding, mutual authentication, encrypted tags, minimal data on tag
NFC < ~4 cm Eavesdropping, data corruption, relay attacks Short range as a control, transaction confirmation, encryption, disable when unused
Bluejacking vs bluesnarfing is a classic exam trap: bluejacking is harmless unsolicited messaging (annoyance, no data access), whereas bluesnarfing is the theft of data (contacts, calendars, messages) from a vulnerable device. Bluebugging goes further, hijacking call/messaging functions. Tools like Bluetooth scanners (e.g., btscanner) and Kismet discover nearby Bluetooth devices.