Attacks and Exploits · Topic 8 of 10
Wireless Attacks
Recognise wireless attack categories such as evil twin, deauthentication, WPS PIN and captive portal attacks, with their indicators, tools and defences.
- 4 min
- Wardriving maps networks while moving, often paired with WiGLE.net.
- An evil twin uses a trusted network name, and a rogue captive portal harvests credentials.
- Deauthentication uses forged management frames, defeated by 802.11w protected management frames.
What it is
Wireless attacks target Wi-Fi and the way clients find and trust access points. Because the medium is shared air, an attacker within range can listen, impersonate a network or disrupt service without a physical connection.
The exam expects recognition of each attack, the indicator a defender would see, and the control that reduces it. Live wireless testing needs explicit permission because it can affect nearby third parties.
How it works
Attack categories
| Attack | Idea | Defence |
|---|---|---|
| Wardriving | Moving through an area to map Wi-Fi networks and their locations | Reduce signal leakage, avoid revealing names |
| Evil twin | A rogue access point using a trusted network name to lure clients | Certificate-based authentication, wireless intrusion detection |
| Rogue captive portal | A fake or bypassed sign-in page to harvest credentials or skip controls | Validate portals, user awareness |
| Deauthentication | Forged management frames that disconnect clients, often to force a reconnect | 802.11w protected management frames |
| Signal jamming | Flooding the frequency to deny service | Hard to prevent, usually excluded by the rules of engagement |
| Protocol fuzzing | Malformed frames sent to find driver or firmware faults | Patch adapters and access points |
| Packet crafting and injection | Building and sending custom wireless frames, which needs an injection-capable adapter | Protected management frames, monitoring |
| Wi-Fi Protected Setup (WPS) PIN attack | The setup personal identification number (PIN) is validated in two halves, which narrows the guesses needed | Disable WPS |
| Web Proxy Auto-Discovery (WPAD) abuse | A rogue host answers automatic proxy-discovery requests and becomes the client's proxy | Disable WPAD, serve a valid proxy configuration |
Deauthentication and jamming are denial-of-service techniques, so they are normally forbidden unless the rules of engagement allow them. The WPS PIN weakness is why the exam stresses disabling WPS on managed networks.
Why these work
Many wireless protections assume the client can trust the strongest or best-named signal. An evil twin exploits that by presenting a familiar name, and a captive portal attack exploits the habit of entering credentials into a sign-in page.
Protected management frames (part of newer Wi-Fi standards) authenticate the management traffic that deauthentication abuses, so clients ignore forged disconnect frames. Strong, mutually authenticated encryption such as WPA3 or enterprise authentication with certificates reduces evil-twin success because the client checks the network identity.
Tools
Know the one-line purpose of each named tool.
| Tool | Purpose |
|---|---|
| Aircrack-ng | Suite for wireless capture and analysis, used to assess encryption strength |
| Kismet | Passive wireless detector, sniffer and wireless intrusion detection system |
| inSSIDer | Wi-Fi scanner showing service set identifiers (SSIDs), channels and signal strength |
| WiGLE.net | Crowdsourced database mapping Wi-Fi SSIDs and basic service set identifiers (BSSIDs) to locations |
| WiFi-Pumpkin | Rogue access point framework used for evil twin testing |
Deauthentication, jamming and rogue access points can disrupt real users nearby, so they need explicit written approval and tight limits before any test.
What to remember for the exam
- Wardriving maps networks while moving, often paired with WiGLE.net.
- An evil twin uses a trusted network name, and a rogue captive portal harvests credentials.
- Deauthentication uses forged management frames, defeated by 802.11w protected management frames.
- The WPS PIN is checked in two halves, so the fix is to disable WPS.
- WPAD abuse lets a rogue host become the proxy, so disable WPAD where unused.
- Packet injection needs an adapter that supports it.
- Aircrack-ng assesses encryption, Kismet detects and monitors, inSSIDer shows channels and signal.
- Jamming and deauthentication are denial-of-service and usually excluded by the rules of engagement.
Common mistakes
Confusing an evil twin with a captive portal attack. An evil twin is a rogue access point, while a captive portal attack targets the sign-in page.
Assuming any encryption stops an evil twin. Only mutual authentication, such as certificates or WPA3, lets the client verify the network.
Treating WPS as harmless. The split PIN check makes it a well known weakness.
Forgetting third parties. Wireless signals reach neighbours, so scope and approval matter more than on a wired test.
Mixing up jamming and deauthentication. Jamming floods the frequency, while deauthentication sends forged frames to specific clients.
Check yourself
What defends against deauthentication attacks?
802.11w protected management frames, which let clients ignore forged disconnect frames.
Why is the WPS PIN weak?
It is validated in two halves, so far fewer guesses are needed, and the fix is to disable WPS.
What is an evil twin?
A rogue access point that uses a trusted network name to lure clients into connecting to it.
Topic 8 of 10 in Attacks and Exploits
Test yourself on Attacks and Exploits
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.