Wireless Network Hacking · Topic 1 of 3
Wireless Concepts and Encryption
Learn Wi-Fi terms, 802.11 standards, antennas and the WEP, WPA, WPA2 and WPA3 encryption ladder, with the weakness and fix at each step for CEH v13.
- 5 min
- WEP uses RC4 with a 24 bit IV and is broken. WPA uses TKIP. WPA2 uses AES-CCMP. WPA3 uses SAE.
- A BSSID is the AP MAC address, and an SSID is the network name.
- WPA2-Personal depends on the strength of the pre-shared key.
What it is
A wireless network carries data over radio instead of cables. In a Wi-Fi network, client devices (stations) connect to an access point (AP), which bridges them to the wired network.
This page covers the vocabulary and standards (Wireless Concepts) and the encryption methods that protect the traffic (Wireless Encryption). The exam wants you to recognize terms, match standards to features, and know why each encryption method was replaced.
How it works
Core terms
| Term | Meaning |
|---|---|
| SSID | The network name that clients see. Up to 32 characters. |
| BSSID | The MAC address of the access point radio. It identifies one AP. |
| BSS | One access point and its associated clients. |
| ESS | Several APs sharing one SSID so users can roam between them. |
| Association | The step in which a client joins an AP. |
| Hotspot | A public access point, often with a captive portal. |
| Channel | A slice of the radio band. In 2.4 GHz, channels 1, 6 and 11 do not overlap. |
An AP can broadcast its SSID in beacon frames. Hiding the SSID only removes it from beacons, and the name still appears in other frames, so it is not real protection.
802.11 standards
| Standard | Band | Notes |
|---|---|---|
| 802.11a | 5 GHz | Up to 54 Mbps |
| 802.11b | 2.4 GHz | Up to 11 Mbps |
| 802.11g | 2.4 GHz | Up to 54 Mbps |
| 802.11n (Wi-Fi 4) | 2.4 and 5 GHz | Multiple antennas (MIMO) |
| 802.11ac (Wi-Fi 5) | 5 GHz | Higher throughput |
| 802.11ax (Wi-Fi 6) | 2.4 and 5 GHz, and 6 GHz in Wi-Fi 6E | Efficiency in crowded areas |
Antennas
An omnidirectional antenna radiates in all horizontal directions and suits a central AP. A directional antenna, such as a Yagi or a parabolic grid, focuses the signal in one direction and reaches much farther. Attackers like directional antennas for long distance sniffing.
Authentication modes
- Open system: any client may associate. There is no key.
- Shared key (WEP): the client proves it knows the WEP key through a challenge. This was weak and leaked keystream.
- Centralized (802.1X): a RADIUS server authenticates each user, used in enterprise mode.
The encryption ladder
| Method | Cipher and integrity | Key weakness | Fix in the next step |
|---|---|---|---|
| WEP | RC4 stream cipher, 24 bit initialization vector (IV), CRC-32 check | The short IV repeats, and enough captured frames let an attacker recover the key | WPA added per packet keys |
| WPA | RC4 with TKIP and a message integrity check called Michael | TKIP is a stopgap built for old hardware | WPA2 uses AES |
| WPA2 | AES with CCMP | A weak pre-shared key (PSK) can be guessed offline from a captured four way handshake. The KRACK flaw reinstalls keys in the handshake. | WPA3 |
| WPA3 | AES, with SAE replacing the PSK exchange. Enterprise mode offers a 192 bit security suite. | Early implementation flaws (Dragonblood) in SAE | Patches and updates |
Key points about each method:
- WEP is considered broken. It should never be used.
- WPA2-Personal uses a pre-shared key. WPA2-Enterprise uses 802.1X with a RADIUS server and an Extensible Authentication Protocol (EAP) type.
- WPA3-Personal uses Simultaneous Authentication of Equals (SAE), a password authenticated key exchange based on the Dragonfly handshake. It resists offline dictionary attacks and gives forward secrecy.
- Opportunistic Wireless Encryption (OWE), sold as Wi-Fi Enhanced Open, encrypts open networks without a password.
- Wi-Fi Protected Setup (WPS) lets users join by an eight digit PIN or a button. The PIN design can be brute forced, so WPS should be off.
A worked example
A company runs WPA2-Personal with the passphrase "Summer2020". An attacker near the building captures the four way handshake when an employee reconnects. The handshake does not contain the password, but it contains enough to test guesses offline.
The attacker runs a wordlist against the capture and finds the passphrase. The network is now open to anyone who has it. The root problem is a guessable PSK, not the AES cipher. The fix is a long random passphrase, WPA3 with SAE, or WPA2-Enterprise with 802.1X.
How the exam asks about this
- "Which wireless encryption uses RC4 with a 24 bit IV?" → WEP.
- "Which protocol replaces the PSK exchange with SAE?" → WPA3.
- "What does BSSID identify?" → The MAC address of a specific access point.
What to remember for the exam
- WEP uses RC4 with a 24 bit IV and is broken. WPA uses TKIP. WPA2 uses AES-CCMP. WPA3 uses SAE.
- A BSSID is the AP MAC address, and an SSID is the network name.
- WPA2-Personal depends on the strength of the pre-shared key.
- WPA2-Enterprise and WPA3-Enterprise use 802.1X with RADIUS.
- Channels 1, 6 and 11 are the non overlapping 2.4 GHz channels.
Hiding the SSID does not secure a network. A hidden name is revealed by normal client traffic, so never choose it as the correct answer for real protection.
Common mistakes
Mixing up TKIP and CCMP. TKIP belongs to WPA and still uses RC4. CCMP belongs to WPA2 and uses AES.
Believing WPA2 is unbreakable. The cipher is strong, but a weak PSK is attacked offline from a captured handshake.
Treating WPS as a convenience feature only. Its PIN method is a known weakness, so it should be disabled.
Check yourself
What is the difference between SSID and BSSID?
The SSID is the network name, and the BSSID is the MAC address of one access point.
Why was WEP replaced?
Its short 24 bit IV repeats, so attackers can recover the RC4 key from enough captured frames.
What does WPA3 change about the key exchange?
It uses SAE, which resists offline dictionary attacks against a captured handshake.
Topic 1 of 3 in Wireless Network Hacking
Test yourself on Wireless Network Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.