OffSec Wireless Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

BSSID

The MAC address of a specific access point radio identifying one basic service set. It appears in beacon and probe response frames and is the target value used by airodump-ng and aireplay-ng.

ESS

An extended service set is a group of basic service sets sharing one SSID and connected through a distribution system, allowing client roaming between access points on the same logical network.

IBSS mode

An independent basic service set is an ad-hoc 802.11 network with no access point; stations communicate directly and one station assumes beaconing duties for the group.

Beacon frame

A management frame transmitted periodically by an access point advertising the SSID, supported rates, channel, and security information elements. It is subtype 0x08 and the primary input for passive discovery.

RSN information element

The field in beacon and probe response frames describing the security configuration: group cipher, pairwise ciphers, authentication suites, and capabilities such as preauthentication and PMF.

WPA3-SAE

Simultaneous Authentication of Equals replaces the PSK handshake with a password-authenticated key exchange resistant to offline dictionary attacks, and it mandates protected management frames.

Monitor mode

A wireless interface mode that captures all 802.11 frames on the tuned channel, including frames not addressed to the station, without associating to any network.

Airmon-ng check kill

A command that terminates NetworkManager, wpa_supplicant, and similar services that can interfere with or reset a monitor-mode interface before packet capture begins.

Airodump-ng WPA handshake marker

The header line 'WPA handshake: <BSSID>' confirms that a complete four-way handshake was captured and saved to the current capture file for offline cracking.

Kismet

A passive wireless detector and intrusion detection system that logs observed frames, discovers hidden SSIDs, and flags rogue access points across multiple capture sources.

Wireshark EAPOL filter

The display filter 'eapol' isolates the four EAPOL key messages of the WPA/WPA2 handshake, allowing extraction and verification of captured authentication material.

Airdecap-ng

An Aircrack-ng utility that decrypts WEP and WPA capture files when the correct key or passphrase is supplied, producing readable decrypted packet output.

Probe request subtype

A management frame (subtype 0x04) sent by a client seeking networks, often containing a previously used SSID. It reveals client history and enables KARMA-style attacks.

WEP IV weakness

WEP uses a 24-bit initialization vector that repeats quickly, producing keystream reuse. Statistical attacks recover the key after collecting enough unique initialization vectors.

PTW attack

An attack against WEP that recovers the key from roughly twenty to forty thousand packets using Klein and PTW statistical techniques, far fewer than older FMS methods.

Four-way handshake

The WPA/WPA2 exchange deriving the pairwise transient key from the pre-shared key and nonces. Captured EAPOL messages allow offline passphrase testing.

PMKID attack

A technique that extracts the PMKID from the first EAPOL message of a roaming-capable access point, enabling offline cracking without capturing a full four-way handshake.

WPS PIN split

The eight-digit WPS PIN is validated in two halves, so the last four digits are checked only after the first four succeed, reducing the search space to about eleven thousand attempts.

Reaver

A WPS exploitation tool that brute-forces the PIN against an access point, optionally using no-nacks mode and MAC changes to evade lockout behavior.

Hashcat mode 22000

The hashcat mode for WPA-PBKDF2-PMKID+EAPOL hashes produced by hcxtools, covering both PMKID and handshake material in a single cracking format.

KRACK

A key reinstallation attack against the WPA2 four-way handshake that forces nonce reuse. It does not reveal the pre-shared key and requires vulnerable client supplicants.

Deauthentication frame

An unprotected 802.11 management frame (subtype 0x0c) that terminates a station association. Spoofed copies force reconnection and enable handshake capture.

Aireplay-ng deauth

The command aireplay-ng --deauth <count> -a <BSSID> -c <client> <iface> transmits spoofed deauthentication frames to disconnect a client from its access point.

Protected management frames

The 802.11w amendment that authenticates deauthentication and disassociation frames, preventing spoofed deauth attacks. WPA3 requires it.

Evil twin

A rogue access point cloning a legitimate SSID and often BSSID, luring clients into associating so credentials, traffic, or captive-portal input can be captured.

KARMA attack

A technique where a rogue access point answers client probe requests with the requested SSID, causing devices to associate automatically to remembered networks.

Hostapd

A user-space daemon that configures a wireless interface as an access point via nl80211, commonly used to build rogue access points with WPA or open security.

Atheros AR9271

A USB chipset driven by ath9k_htc that supports 2.4 GHz monitor mode and packet injection in Linux, widely used for Aircrack-ng workflows.

RTL8812AU

A Realtek USB chipset supporting dual-band 2.4 and 5 GHz monitor mode and injection using an out-of-tree driver, common for modern 802.11ac captures.

mac80211

The Linux kernel subsystem implementing the 802.11 station and access point state machines, used by softmac drivers and configured through cfg80211 and nl80211.

cfg80211

The Linux kernel configuration layer for wireless devices that exposes regulatory, channel, and interface settings to user space through the nl80211 netlink interface.

iw list

A command querying the wireless phy capabilities, including supported interface modes such as monitor, supported bands, channels, and cipher suites.