Network and Wireless Exploitation
This domain covers exploitation of network infrastructure and wireless protocols: interception, spoofing, segmentation bypass, and wireless credential attacks. The exam expects you to know which attacks are disruptive and which require special hardware or proximity.
Core rules and concepts
- Layer 2 attacks include ARP spoofing, DHCP starvation, rogue DHCP, VLAN hopping, and MAC flooding. Many cause outages or are easily detected.
- MITM positioning enables credential capture, session hijacking, and traffic manipulation; TLS validation and HSTS limit impact.
- Wireless attacks include handshake capture, PMKID capture, WPS attacks, evil twin, deauthentication, and rogue access points. WEP is obsolete and trivially broken; WPA2/WPA3 require different approaches.
- Deauthentication and jamming are disruptive and often regulated; obtain explicit approval and use the minimum necessary.
- Check channel, regulatory domain, and hardware support before planning a wireless test.
Worked example
A client asks whether its WPA2-PSK Wi-Fi can be cracked. You capture a handshake with authorized hardware, then test it offline against a wordlist derived from the client's password policy. If the password is not in the list, you report that the passphrase was not recovered and recommend a longer unique passphrase, WPA3, and 802.1X. The reasoning: a failed crack is not a clean bill of health, and the recommendation must address the real risk.
Traps
Do not deauth a production network to force a handshake unless approved; it can disconnect clinical or industrial devices. Do not confuse WPS PIN bypass with a WPA2 weakness. Avoid claiming a network is secure because one wordlist failed. VLAN hopping tests can cross into out-of-scope segments.