Certified Ethical Hacker (CEH) Practice Question

Once a WPA2 four-way handshake has been captured, all further cracking is performed offline. If an initial dictionary fails, the methodology calls for more exhaustive client-side attacks such as GPU-accelerated mask or hybrid brute-force attacks with tools like hashcat or pyrit. These attacks can test billions of key candidates per second and let you define character sets and key lengths that fit likely patterns, making them the most effective next step. Reinjecting ARP requests or collecting IVs applies to WEP, not WPA2. KRACK is a replay-based key reinstallation flaw that lets an attacker decrypt or modify traffic but does not reveal the pre-shared key. Flooding deauth frames will not cause an access point to drop WPA2-PSK protection, so it does nothing to recover the passphrase.