Overview
Domain 6 covers attacking and securing wireless networks in one module. It covers wireless concepts and standards, the encryption protocols WEP, WPA, WPA2 and WPA3 and their weaknesses, the wireless hacking methodology (discover, map, analyze traffic, crack and compromise), specific attacks such as the evil twin, rogue access points, deauthentication, WPS attacks and handshake capture, Bluetooth attacks, wireless hacking tools such as Aircrack-ng, and countermeasures including strong encryption, enterprise authentication and wireless intrusion prevention.
Although only 5% of the exam, this domain is dangerous to skim. The questions go deep for their weight, testing the differences between encryption standards and the mechanics of specific attacks. A candidate who scores poorly here loses points that are hard to recover elsewhere, so the domain deserves attention out of proportion to its size.
How it's tested
Expect questions comparing wireless encryption standards, identifying a wireless attack from its description, or choosing the right countermeasure. The questions are concise but require precise knowledge of standards and attack mechanics. Read the full scenario and every option carefully before deciding.
-
Compare the standard
A wireless encryption requirement or weakness is described, and you must identify or choose among WEP, WPA, WPA2 and WPA3.
-
Identify the attack
A wireless attack is described, and you must name it, such as an evil twin or deauthentication attack.
-
Right countermeasure
A wireless security need is described, and you must choose the control, such as WPA3 enterprise or a wireless IPS.
An attacker sets up an access point broadcasting the same network name as a legitimate corporate Wi-Fi, then sends deauthentication frames to knock clients off the real network so they reconnect to the attacker's. The rogue access point imitating a trusted network identifies this as an evil twin, and the deauthentication is the technique used to push clients onto it.
Domains 1
Official domains from the EC-Council outline, in outline order.
6.1 Hacking Wireless NetworksEncryption standards, wireless attacks, Bluetooth, tools and countermeasures.
- What it means
- This module covers wireless concepts and standards, the encryption protocols WEP, WPA, WPA2 and WPA3 and their relative strengths and weaknesses, the wireless hacking methodology, attacks such as evil twin, rogue access points, deauthentication, WPS PIN attacks and handshake capture and cracking, Bluetooth attacks such as bluejacking and bluesnarfing, wireless hacking tools such as Aircrack-ng and Kismet, and countermeasures including WPA3, enterprise authentication with 802.1X, and wireless intrusion prevention systems.
- What to understand
- The encryption standards form a progression: WEP is broken, WPA is weak, WPA2 is strong but its pre-shared key handshake can be captured and cracked offline, and WPA3 improves this with Simultaneous Authentication of Equals, which resists offline guessing. Enterprise mode with 802.1X gives per-user authentication. An evil twin imitates a trusted network to capture credentials or traffic.
- How it shows up
- A standard, attack or countermeasure is described, and you must identify it or choose the most secure option.
- Common confusion
- Treating WPA2 with a pre-shared key as the most secure option. WPA3 is stronger, and enterprise mode with 802.1X adds per-user authentication.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
WEP
The original, badly broken wireless encryption standard.
- Remember
- It is obsolete and trivially cracked.
- Tested as
- Standard comparison questions.
- Trap
- Treating it as acceptable in any modern scenario.
-
WPA2
A strong standard whose pre-shared key handshake can be captured and cracked offline.
- Remember
- Personal mode is vulnerable to offline dictionary attacks on a captured handshake.
- Tested as
- Standard comparison questions.
- Trap
- Treating WPA2-PSK as the most secure option.
-
WPA3
The current standard, using Simultaneous Authentication of Equals in personal mode.
- Remember
- SAE resists offline password guessing.
- Tested as
- Standard comparison questions.
- Trap
- Choosing WPA2 over WPA3 as most secure.
-
Enterprise vs. personal mode
Enterprise uses 802.1X for per-user authentication; personal uses a shared key.
- Remember
- Enterprise mode gives individual accountability and easy revocation.
- Tested as
- Countermeasure questions.
- Trap
- Using a single shared key for a large organization.
-
Evil twin
A rogue access point imitating a legitimate network.
- Remember
- Often paired with deauthentication to lure clients.
- Tested as
- Wireless attack questions.
- Trap
- Confusing it with a generic rogue AP.
-
Deauthentication attack
Forcing clients off a network with deauth frames.
- Remember
- Used to capture handshakes or push clients to an evil twin.
- Tested as
- Wireless attack questions.
- Trap
- Overlooking its role in handshake capture.
-
WPS PIN attack
Exploiting the weak Wi-Fi Protected Setup PIN to recover the passphrase.
- Remember
- WPS should be disabled.
- Tested as
- Wireless attack questions.
- Trap
- Forgetting WPS as an attack vector.
-
Handshake capture and cracking
Capturing the WPA2 four-way handshake to crack the key offline.
- Remember
- A strong passphrase and WPA3 mitigate it.
- Tested as
- Wireless attack questions.
- Trap
- Thinking capture alone compromises a strong passphrase instantly.
-
Bluetooth attacks
Bluejacking sends unsolicited messages; bluesnarfing steals data.
- Remember
- Bluesnarfing is the data-theft attack.
- Tested as
- Wireless attack questions.
- Trap
- Confusing bluejacking with bluesnarfing.
-
Wireless IPS
A system that detects and prevents rogue access points and wireless attacks.
- Remember
- It helps detect evil twins and rogue APs.
- Tested as
- Countermeasure questions.
- Trap
- Overlooking it as a wireless defense.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
WEP vs. WPA vs. WPA2 vs. WPA3
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| WEP | Original wireless encryption | Badly broken, obsolete | Treating it as usable |
| WPA | Interim improvement over WEP | Weak by modern standards | Confusing it with WPA2 |
| WPA2 | Strong, but PSK handshake is crackable offline | Vulnerable to offline dictionary attacks in personal mode | Treating WPA2-PSK as most secure |
| WPA3 | Current standard using SAE | Resists offline guessing | Choosing WPA2 over it |
Enterprise vs. personal wireless mode
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Enterprise | 802.1X per-user authentication | Individual accountability and revocation | Thinking it is only for large firms |
| Personal | Shared pre-shared key | Simple but no individual accountability | Using one key across a big organization |
Evil twin vs. rogue AP vs. deauthentication
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Evil twin | Rogue AP imitating a trusted network | Impersonates a known SSID | Confusing it with any rogue AP |
| Rogue AP | Any unauthorized access point | Not necessarily impersonating | Assuming it always mimics a real network |
| Deauthentication | Forcing clients off a network | A technique, not an AP | Treating it as a standalone goal |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
WPA2 is most secure
- What candidates pick
- Choose WPA2-PSK as the most secure wireless configuration.
- Why it looks right
- WPA2 is widely used and strong.
- Why it's wrong
- WPA3 is stronger, and enterprise mode with 802.1X adds per-user authentication. WPA2-PSK is crackable offline from a captured handshake.
Clue to watch for The question asks for the most secure option.
-
Evil twin is any rogue AP
- What candidates pick
- Call any unauthorized access point an evil twin.
- Why it looks right
- Both are rogue APs.
- Why it's wrong
- An evil twin specifically imitates a legitimate network to deceive users.
Clue to watch for The rogue AP copies a known network name.
-
Bluejack to steal data
- What candidates pick
- Use bluejacking to extract data from a device.
- Why it looks right
- Both are Bluetooth attacks.
- Why it's wrong
- Bluejacking sends unsolicited messages; bluesnarfing steals data.
Clue to watch for The goal is data theft versus sending messages.
-
Shared key for everyone
- What candidates pick
- Use a single pre-shared key for a large corporate network.
- Why it looks right
- It is simple to deploy.
- Why it's wrong
- One shared key gives no individual accountability and is hard to revoke. Enterprise mode with 802.1X is better.
Clue to watch for Many users or staff turnover is mentioned.
-
Capture equals instant crack
- What candidates pick
- Assume capturing a WPA2 handshake immediately reveals the key.
- Why it looks right
- Capture is the key step.
- Why it's wrong
- The captured handshake still must be cracked offline, which a strong passphrase makes impractical.
Clue to watch for The passphrase strength is mentioned.
-
Skip the small domain
- What candidates pick
- Spend no study time on wireless because it is only 5%.
- Why it looks right
- Larger domains seem more important.
- Why it's wrong
- The six wireless questions go deep, and losing most of them can fail an otherwise passing candidate.
Clue to watch for Not a question trap but a study-strategy warning.
Answer framework
For any Domain 6 wireless scenario, use these steps before choosing an answer.
- Place the wireless encryption standards in order of strength, from broken WEP through WPA and WPA2 to current WPA3.
- For the most secure option, prefer WPA3, and enterprise mode with 802.1X where per-user authentication is needed.
- Identify the specific attack, distinguishing an evil twin from a generic rogue access point and naming the technique such as deauthentication.
- For Bluetooth, separate message-sending attacks such as bluejacking from data-theft attacks such as bluesnarfing.
- Choose countermeasures that match the threat, such as disabling WPS, using strong passphrases, and deploying a wireless intrusion prevention system, and prefer WPA3 and enterprise authentication where security is the goal.
Practice question
Want more like this? The CEH practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Do not skim this domain despite its small weight, because its six questions go deep and are easy to lose. Start with the encryption standards and learn them as a progression: WEP broken, WPA weak, WPA2 strong but with a crackable PSK handshake, WPA3 resisting offline guessing through SAE. Be ready to pick the most secure option, which is WPA3, and enterprise mode with 802.1X where individual accountability matters.
Next, learn the specific attacks and their distinctions: evil twin versus rogue AP, the role of deauthentication, WPS PIN attacks, and handshake capture. Add the Bluetooth attacks, keeping bluejacking and bluesnarfing separate.
Finally, learn the countermeasures, including WPA3, strong passphrases, disabling WPS and wireless intrusion prevention. A short lab session with a wireless adapter and Aircrack-ng against a test network makes the handshake-capture concept concrete. Afterwards, move to Domain 7, mobile, IoT and OT hacking. Review each missed question by naming the standard or attack you confused.
FAQ
How much of CEH v13 is Domain 6?
Wireless Network Hacking is about 5% of the exam, roughly six questions, but they go deep for the weight.
What is the most secure Wi-Fi standard?
WPA3, with enterprise mode using 802.1X for per-user authentication in organizations. WPA2 is weaker, and WEP is obsolete.
Why is WPA2-PSK considered vulnerable?
Its four-way handshake can be captured and the pre-shared key cracked offline, especially if the passphrase is weak.
What is an evil twin?
A rogue access point that imitates a legitimate network's name to trick users into connecting, often combined with deauthentication to push clients onto it.
What is the difference between bluejacking and bluesnarfing?
Bluejacking sends unsolicited messages to a device. Bluesnarfing steals data from it.
Should I skip this domain because it is small?
No. The six questions are deep, and losing most of them can fail an otherwise passing exam. Study it in proportion to its difficulty, not its weight.
How does Domain 6 connect to the rest of the exam?
Wireless is another network entry point, linking to the network attacks in Domain 4 and the mobile and IoT devices in Domain 7.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 6 knowledge
You have covered wireless encryption standards, wireless and Bluetooth attacks, and countermeasures. Test whether you can pick the most secure option and identify attacks under exam conditions.