CWNP-Certified Wireless Security Professional (CWSP) Set 1

Authenticator nonce Supplicant nonce Authenticator address (BSSID) GTKSA Authentication Server nonce

Token cards must be used for authentication. ✘ Dynamic WEP-104 encryption must be enabled. ✘ WEP may not be used for encryption. ✘ WPA-Personal must be supported for authentication and encryption. ✔ WLAN controllers and APs must not support SSHv1. ✔

Wireless adapter failure analysis. ✘ Interference source location. ✘ Fast secure roaming problems. ✘ Narrowband DoS attack detection. ✔

Rogue APs DoS Eavesdropping Social engineering

All integrated 802.11ac adapters will work with most protocol analyzers for frame capture, including the Radio Tap Header. ✘ Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptops. It is often best to use a USB adapter or carefully select alaptop with an integrated adapter that will work. ✘ Laptops cannot be used to capture 802.11ac frames because they do not support MU-MIMO. ✘ Only Wireshark can be used to capture 802.11ac frames as no other protocol analyzer has implemented the proper frame decodes. ✔ The only method available to capture 802.11ac frames is to perform a remote capture with a compatible access point. ✔

Social engineering and/or eavesdropping ✘ RF DoS and/or physical theft ✘ MAC denial of service and/or physical theft ✘ Authentication cracking and/or RF DoS ✔ Code injection and/or XSS ✔

Man-in-the-Middle Wi-Fi phishing Management interface exploits UDP port redirection IGMP snooping

The username is needed for Personal Access Credential (PAC) and X.509 certificate validation. ✘ The username is an input to the LEAP challenge/response hash that is exploited, so the username must be known to conduct authentication cracking. ✘ 4-Way Handshake nonces are based on the username in WPA and WPA2 authentication. ✘ The username can be looked up in a dictionary file that lists common username/password combinations. ✔

Intruders may obtain the passphrase with an offline dictionary attack and gain network access, but will be unable to decrypt the data traffic of other users. ✘ A successful attack against all unicast traffic on the network would require a weak passphrase dictionary attack and the capture of the latest 4-Way Handshakefor each client. ✘ An unauthorized wireless client device cannot associate, but can eavesdrop on some data because WPA2-Personal does not encrypt multicast or broadcasttraffic. ✘ An unauthorized WLAN user with a protocol analyzer can decode data frames of authorized users if he captures the BSSID, client MAC address, and a user's 4-Way Handshake. ✔ Because WPA2-Personal uses Open System authentication followed by a 4-Way Handshake, hijacking attacks are easily performed. ✔

Transmitting a deauthentication frame to disconnect a user from the AP. Auditing the configuration and functionality of a WIPS by simulating common attack sequences Probing the RADIUS server and authenticator to expose the RADIUS shared secret Cracking the authentication or encryption processes implemented poorly in some WLANs