5.4 Wireless Security (802.11) & VoIP Assessment

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

5.4 Wireless Security (802.11) & VoIP Assessment

Key Takeaways Explain This Topic AI

IEEE 802.11 wireless frames are divided into Management, Control, and Data types; legacy management frames (Beacons, Probe Requests, Deauthentication) are transmitted unencrypted, allowing trivial spoofing and deauthentication denial-of-service attacks.

WEP utilizes RC4 with a 24-bit Initialization Vector (IV) and CRC-32 checksum, suffering from severe IV collisions and key recovery attacks within minutes, while WPA2-Personal relies on the 4-Way Handshake vulnerable to offline dictionary cracking following captured deauthentication reconnects.

WPA3 replaces the vulnerable pre-shared key exchange with Simultaneous Authentication of Equals (SAE / Dragonfly handshake) based on zero-knowledge proofs to eliminate offline dictionary attacks and mandates Protected Management Frames (PMF / 802.11w) to defeat deauthentication spoofing.

Voice over IP (VoIP) segregates signaling from voice media: Session Initiation Protocol (SIP, UDP/TCP 5060) handles call setup and enables user extension enumeration via SIPvicious, while Real-time Transport Protocol (RTP) carries audio in cleartext unless protected by Secure RTP (SRTP) using DTLS or ZRTP.

Last updated: September 2026

5.4 Wireless Security (802.11) & VoIP Assessment

Wireless Local Area Networks (WLANs) and Voice over IP (VoIP) telephony extend enterprise network perimeters beyond physical walls and structured cabling. Because radio frequency signals propagate freely across office boundaries, and telephony protocols frequently operate across shared converged infrastructures, these technologies introduce unique assessment challenges. For the CREST Practitioner Security Analyst (CPSA) examination, candidates must understand 802.11 frame architectures, the mathematical and operational flaws in legacy and modern wireless encryption standards, and the attack vectors targeting enterprise voice infrastructure.

1. IEEE 802.11 Wireless Architecture

The IEEE 802.11 standard defines the physical layer and medium access control (MAC) sublayer for wireless communications. +-----------------------------------------------------------------------------------+

• | 802.11 FRAME CLASSIFICATION |
• +-----------------------------------------------------------------------------------+
• | 1. MANAGEMENT FRAMES: Establish and maintain radio connectivity. |
• | - Beacon, Probe Request, Probe Response |
• | - Authentication, Deauthentication |
• | - Association Request, Association Response, Disassociation|
• +-----------------------------------------------------------------------------------+
• | 2. CONTROL FRAMES: Coordinate medium access, clear channels, and acknowledge. |
• | - Request to Send (RTS), Clear to Send (CTS) |
• | - Acknowledgment (ACK) |
• +-----------------------------------------------------------------------------------+
• | 3. DATA FRAMES: Encapsulate upper-layer payloads (IP datagrams, TLS, etc.) |
• +-----------------------------------------------------------------------------------+
• SSIDs, BSSIDs, and Hidden Network Fallacies

Service Set Identifier (SSID): A human-readable text string (up to 32 octets) identifying the logical wireless network.

Basic Service Set Identifier (BSSID): The 48-bit physical MAC address of the radio interface of the Access Point (AP) servicing the BSS.

Hidden SSIDs (Cloaked Networks): An administrator can configure an AP to suppress broadcasting its SSID by setting the SSID field in periodic Beacon frames to null (zero length or whitespace). Many administrators mistakenly believe this provides security.

The Security Fallacy: Hiding the SSID provides zero cryptographic protection and constitutes ineffective Security through Obscurity. The moment a legitimate client connects to the network, the SSID is broadcast in cleartext within the client's Probe Request or Association Request frames. A passive listener running airodump-ng will uncloak the hidden SSID immediately upon observing client traffic.

2. Wireless Encryption Standards & Vulnerabilities +---------------------------------------------------------------------------------------------------+

• | 802.11 ENCRYPTION EVOLUTION SUMMARY |
• +---------------------------------------------------------------------------------------------------+
• | Standard | Cipher Algorithm | Integrity Mechanism | IV / Nonce Length | Security Status |
• +------------+--------------------------+---------------------+-------------------+-----------------+
• | WEP | RC4 (Stream) | CRC-32 (ICV) | 24 bits | Completely broken
• | WPA | TKIP (RC4 Stream) | Michael MIC (64-bit)| 48 bits | Deprecated/Broken
• | WPA2 | CCMP (AES-128 Block) | CBC-MAC | 48 bits (PN) | Vulnerable to PSK
• | WPA3 | SAE (Dragonfly) + AES-GCM| PMF (BIP / GMAC) | 96 / 128 bits | Secure (Current)
• +---------------------------------------------------------------------------------------------------+
• 1. Wired Equivalent Privacy (WEP)

Adopted in the original 1997 standard, WEP attempted to provide wireless networks with security equivalent to a physical Ethernet cable:

Cryptographic Engine: Uses the RC4 stream cipher with a static pre-shared key (40-bit or 104-bit) concatenated with a 24-bit Initialization Vector (IV) to form the RC4 key seed.

Integrity: Appends a 32-bit CRC-32 checksum known as the Integrity Check Value (ICV) .

Fatal Vulnerabilities:

Short IV Space: A 24-bit IV provides only 2 24 ≈ 16.7 × 10 6 2^{24} \approx 16.7 \times 10^6 2 24 ≈ 16.7 × 1 0 6 unique values. On an active network, IVs repeat within hours, leading to keystream reuse ( C 1 ⊕ C 2 = P 1 ⊕ P 2 C_1 \oplus C_2 = P_1 \oplus P_2 C 1 ​ ⊕ C 2 ​ = P 1 ​ ⊕ P 2 ​ ).

Weak Key Scheduling (FMS / KoreK / PTW Attacks): In early bytes of the RC4 keystream, the first bytes strongly correlate with key bytes. The Fluhrer, Mantin, and Shamir (FMS) attack, refined by the PTW (Pyshkin, Tews, Weinmann) algorithm, recovers the secret WEP key by capturing approximately 20,000 to 50,000 packets containing weak IVs.

ARP Replay Amplification: Attackers do not wait for organic traffic; using aireplay-ng -3 , they capture a single broadcast ARP request and replay it back to the AP thousands of times per second, forcing the AP to emit fresh IVs and allowing key cracking in under two minutes via aircrack-ng .

2. Wi-Fi Protected Access (WPA)

Introduced as a transitional standard to replace WEP without requiring new hardware:

TKIP (Temporal Key Integrity Protocol): Wraps RC4 in a per-packet key-mixing algorithm, increases the IV to 48 bits (preventing IV exhaustion), and introduces the Michael 64-bit Message Integrity Check (MIC).

Weaknesses: Vulnerable to Beck-Tews and Ohigashi-Morii keystream recovery attacks. Furthermore, if an AP detects two invalid Michael MIC calculations within 60 seconds, it shuts down all radio operations for 60 seconds (Michael Countermeasure), creating a denial-of-service vector.

3. WPA2 & The 4-Way Handshake Attack

WPA2 (IEEE 802.11i) mandates the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP) , which utilizes AES-128 for confidentiality and CBC-MAC for integrity. +-----------------------------------------------------------------------------------+

• | WPA/WPA2 4-WAY HANDSHAKE (EAPOL) |
• +-----------------------------------------------------------------------------------+
• | |
• | Wireless Client (Station) Access Point (AP) |
• | | | |
• | | <--- Message 1: ANonce (AP Nonce) ------------------ | |
• | | | |
• | [ Computes PTK from PMK, ] | |
• | [ ANonce, SNonce, MACs ] | |
• | | | |
• | | ---- Message 2: SNonce (Station Nonce) + MIC ------> | |
• | | | |
• | | [ Computes PTK, ] |
• | | [ Verifies MIC ] |
• | | | |
• | | <--- Message 3: GTK (Group Key) + Install PTK + MIC- | |
• | | | |
• | | ---- Message 4: Acknowledgment (ACK) + MIC --------> | |
• +-----------------------------------------------------------------------------------+

While the AES cipher itself is unbreakable via direct cryptanalysis, WPA2-Personal (Pre-Shared Key / PSK) is vulnerable to offline dictionary attacks targeting the 4-Way Handshake :

The Pre-Shared Key is converted into a 256-bit Pairwise Master Key (PMK) using PBKDF2: PMK = PBKDF2 ( Passphrase , SSID , 4096 , 256 ) \text{PMK} = \text{PBKDF2}(\text{Passphrase}, \text{SSID}, 4096, 256) PMK = PBKDF2 ( Passphrase , SSID , 4096 , 256 ) .

During authentication, the AP and client exchange four EAPOL frames to derive the Pairwise Transient Key (PTK) from the PMK, client/AP MACs, and random nonces (ANonce and SNonce).

The Deauthentication Attack: Because 802.11 management frames are unencrypted in legacy networks, an attacker spoofs the AP's MAC address and transmits forged deauthentication frames ( aireplay-ng -0 5 -a <BSSID> -c <Client_MAC> wlan0mon ) to disconnect the victim.

When the victim reconnects, the attacker captures the 4-Way Handshake in Wireshark or airodump-ng .

The attacker takes the capture offline and executes a dictionary or brute-force attack against the PMK using tools like Hashcat ( hashcat -m 22000 capture.hc22000 wordlist.txt ) without interacting with the live network.

4. WPA3: Simultaneous Authentication of Equals (SAE)

WPA3 resolves the vulnerabilities of WPA2:

SAE (Dragonfly Handshake): Replaces the static PSK 4-way exchange with a password-authenticated key exchange based on zero-knowledge proofs (RFC 7664). Attackers observing the handshake gain no mathematical ability to perform offline dictionary cracking ; an adversary must interact online with the AP for every single guess.

Forward Secrecy: Even if a password is compromised in the future, past captured traffic cannot be decrypted.

Protected Management Frames (PMF / IEEE 802.11w): WPA3 mandates PMF, which cryptographically signs and encrypts unicast and broadcast management frames (such as Deauthentication and Disassociation), rendering deauthentication attacks entirely ineffective.

5. Enterprise Wireless (IEEE 802.1X / EAP)

WPA/WPA2/WPA3-Enterprise replaces pre-shared keys with individualized user authentication backed by a centralized RADIUS server.

EAP Method Inner Authentication Certificate Requirements Security / Attack Profile

EAP-TLS Digital Certificates (Mutual) Both Server AND Client require X.509 certs Gold standard; immune to credential harvesting.

PEAPv0 / EAP-MSCHAPv2 MSCHAPv2 Credentials inside TLS Server requires certificate; client does not High risk: Vulnerable to Evil Twin credential theft.

EAP-TTLS MSCHAPv2, PAP, or CHAP inside TLS Server requires certificate; client optional High risk if clients do not validate server CA cert.

Rogue AP / Evil Twin Attacks Against PEAP

In environments deploying PEAPv0 with EAP-MSCHAPv2:

An attacker sets up a rogue Access Point broadcasting the corporate SSID using tools like hostapd-wpe or EAP-Hammer .

If corporate endpoint devices are misconfigured (e.g., "Validate server certificate" is disabled in Windows/macOS network profiles), the endpoint connects to the rogue AP.

The rogue AP presents an untrusted TLS certificate. The victim machine automatically accepts it and sends its MSCHAPv2 challenge-response hash inside the tunnel.

The attacker captures the hash ( username:$NETNTLM$... ) and cracks it offline using Hashcat ( hashcat -m 5500 ) to recover the user's plaintext Active Directory password.

3. Voice over IP (VoIP) Assessment

Voice over IP architectures split telephone communications into two distinct protocols:

Call Signaling (Setup & Teardown): Governed by the Session Initiation Protocol (SIP) .

Media Streaming (Audio & Video Payload): Governed by the Real-time Transport Protocol (RTP) . +-----------------------------------------------------------------------------------+

• | VOIP CALL ARCHITECTURE |
• +-----------------------------------------------------------------------------------+
• | |
• | Caller Phone (IP: 10.1.1.50) Callee Phone (IP: 10.1.1.60)
• | | | |
• | | --- 1. SIP INVITE (UDP 5060) ----> [ SIP PBX Server ] | |
• | | | | |
• | | | --- INVITE ---> | |
• | | <--- 2. SIP 200 OK (SDP Negotiated) <---- | <--- 200 OK --- | |
• | | | |
• | | =========================================================== | |
• | | 3. RTP AUDIO STREAM (Direct UDP: Ports 16384-32767) | |
• | | (Two-way G.711 / G.729 Cleartext Audio) | |
• | | =========================================================== | |
• | | | |
• | | --- 4. SIP BYE (Call Teardown) --> [ SIP PBX Server ] | |
• +-----------------------------------------------------------------------------------+
• Session Initiation Protocol (SIP)

SIP , defined in RFC 3261, is an ASCII, text-based signaling protocol modeled directly after HTTP:

Ports: Operates unencrypted over UDP or TCP port 5060 , or encrypted via TLS over TCP port 5061 (SIPS).

Core Methods: INVITE (initiates call), ACK (confirms response), BYE (terminates call), CANCEL (aborts pending call), REGISTER (registers client location with SIP registrar), OPTIONS (queries server capabilities).

User Enumeration Attacks: Attackers use tools from the SIPvicious suite ( svmap , svwar , svcrack ) to enumerate valid user extensions:

svwar sends a barrage of REGISTER or INVITE messages targeting numeric extensions (e.g., 100 to 999).

The PBX responds with distinct status codes: 200 OK or 401 Unauthorized for valid extensions versus 404 Not Found for non-existent extensions, leaking valid employee extension numbers.

svcrack then performs password dictionary attacks against identified extensions to hijack phone lines for Toll Fraud (placing unauthorized international or premium-rate calls billed to the target company). # Mapping SIP PBX endpoints using svmap

svmap 192.168.1.0/24

• # Enumerating active SIP extensions between 100 and 500 using svwar
• svwar -e 100-500 192.168.1.15
• Real-time Transport Protocol (RTP) & Eavesdropping

Once SIP establishes a call via the Session Description Protocol (SDP) , the audio stream is transmitted directly between endpoints using Real-time Transport Protocol (RTP, RFC 3550) :

Ports: Runs over dynamic, negotiated UDP ports (typically within the range 16384 to 32767 ).

Eavesdropping Risk: Standard RTP packets are completely unencrypted. Voice payloads are encoded using standard audio codecs such as G.711 μ \mu μ -law (PCMU) , G.711 A-law (PCMA) , or G.729 .

If an attacker gains access to the voice VLAN (or executes an ARP spoofing attack between an IP phone and the gateway), they can capture network traffic using Wireshark.

Using Wireshark's built-in analysis tool ( Telephony → \rightarrow → VoIP Calls → \rightarrow → Play Streams ), the attacker can reconstruct the voice conversation in real time and listen to the audio with crystal-clear fidelity.

Secure RTP (SRTP) & Key Exchange Pitfalls

To protect call confidentiality and integrity, organizations deploy Secure RTP (SRTP, RFC 3711) :

Cryptographic Engine: Uses AES-128 in Counter Mode (CTR) to encrypt audio payloads and HMAC-SHA1 to provide message authentication.

The SDES Vulnerability: In legacy implementations, SRTP keys are negotiated using SDES (Session Description Protocol Security Descriptions, RFC 4568) .

SDES transmits the SRTP master cryptographic key as a base64 string directly inside the body of the SIP signaling message .

If SIP signaling is transmitted over unencrypted UDP port 5060, the attacker sniffs the cleartext SIP INVITE packet, extracts the base64 SRTP key, and uses it to decrypt the SRTP voice stream.

Remediation: Enforce TLS for SIP signaling (TCP port 5061), or deploy DTLS-SRTP (RFC 5763) or ZRTP (RFC 6189) , which perform authenticated Diffie-Hellman key exchanges directly across the media channel.