Overview
Module 10 covers wireless attacks. It covers wireless standards and the encryption protocols WEP, WPA, WPA2 and WPA3 with their weaknesses, the wireless testing methodology, capturing and cracking the WPA2 handshake, deauthentication, evil twin and rogue access point attacks, WPS attacks, and wireless countermeasures such as WPA3, enterprise authentication and wireless intrusion prevention.
The CPENT range includes wireless targets, so the module rewards hands-on skill with a wireless adapter and tools such as Aircrack-ng. The core workflow is capturing a handshake, often forced with deauthentication, and cracking it offline, plus luring clients with an evil twin. Understanding the standards determines which attack is viable.
How it's tested
CPENT is performance-based, so this module shows up as hands-on wireless attacks: capturing and cracking handshakes, running evil twins, and recommending defenses, all documented. Because the exam is scored on what you achieve and document on live ranges, read each scenario for what it actually permits and reward methodical, evidence-backed work over guesswork.
-
Match attack to standard
You choose the viable attack based on whether the network uses WEP, WPA2 or WPA3.
-
Capture then crack
You capture the handshake, forcing it with deauthentication if needed, then crack it offline.
-
Lure the client
You use an evil twin and deauthentication to capture credentials or traffic.
A target uses WPA2-Personal with an unknown passphrase. Attacking WPA3 techniques is irrelevant here. The viable route is to capture the four-way handshake, forcing a client to reconnect with a deauthentication attack if necessary, then crack the captured handshake offline against a wordlist. If the passphrase is strong, an evil twin that lures a user into entering credentials becomes the better path.
Modules 1
Official modules from the EC-Council outline, in outline order.
10.1 Wireless Penetration TestingThis module covers attacking wireless networks: the encryption standards and their weaknesses, capturing and cracking ha
- What it means
- Wireless testing covers the encryption standards WEP, WPA, WPA2 and WPA3 and their weaknesses, the testing methodology, WPA2 handshake capture and offline cracking, deauthentication, evil twin and rogue access point attacks, WPS attacks, and countermeasures such as WPA3, enterprise authentication and wireless intrusion prevention.
- What to understand
- The standard decides the attack: WEP is broken, WPA2 personal allows offline handshake cracking, and WPA3's SAE resists offline guessing. Deauthentication forces a handshake to capture. An evil twin imitates a trusted network to capture credentials. Enterprise mode with per-user authentication is the stronger defense.
- How it shows up
- Applied hands-on with a wireless adapter and tools to capture, crack and lure on the range.
- Common confusion
- Assuming WPA2 handshake capture instantly reveals the key; the captured handshake still must be cracked offline, which a strong passphrase can defeat.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
WEP
The original, badly broken wireless standard.
- Remember
- Trivially cracked; obsolete.
- Tested as
- Standard comparison.
- Trap
- Treating it as usable.
-
WPA2 personal
A strong standard whose handshake can be captured and cracked offline.
- Remember
- Vulnerable to offline dictionary attacks.
- Tested as
- Standard comparison.
- Trap
- Treating it as uncrackable.
-
WPA3
The current standard using SAE in personal mode.
- Remember
- Resists offline password guessing.
- Tested as
- Standard comparison.
- Trap
- Choosing WPA2 as most secure.
-
Handshake capture and cracking
Capturing the WPA2 four-way handshake to crack it offline.
- Remember
- Capture does not reveal the key instantly.
- Tested as
- WPA2 attacks.
- Trap
- Assuming instant compromise.
-
Deauthentication
Forcing clients off a network with deauth frames.
- Remember
- Used to capture handshakes or push clients to an evil twin.
- Tested as
- Wireless attacks.
- Trap
- Overlooking its role in capture.
-
Evil twin
A rogue access point imitating a legitimate network.
- Remember
- It lures clients to capture credentials or traffic.
- Tested as
- Wireless attacks.
- Trap
- Confusing it with a generic rogue AP.
-
WPS attack
Exploiting the weak Wi-Fi Protected Setup PIN.
- Remember
- It can recover the passphrase.
- Tested as
- Wireless attacks.
- Trap
- Forgetting WPS as a vector.
-
Enterprise mode
802.1X per-user wireless authentication.
- Remember
- It gives individual accountability and revocation.
- Tested as
- Countermeasures.
- Trap
- Using a single shared key for an organization.
-
Wireless IPS
A system detecting rogue APs and wireless attacks.
- Remember
- It helps catch evil twins.
- Tested as
- Countermeasures.
- Trap
- Overlooking it as a defense.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
WEP vs. WPA2 vs. WPA3
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| WEP | Original encryption | Badly broken and obsolete | Treating it as usable |
| WPA2 personal | Strong but handshake crackable offline | Vulnerable to dictionary attacks | Treating it as uncrackable |
| WPA3 | Current, uses SAE | Resists offline guessing | Choosing WPA2 over it |
Evil twin vs. rogue AP vs. deauthentication
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Evil twin | Rogue AP imitating a trusted network | Impersonates a known SSID | Confusing it with any rogue AP |
| Rogue AP | Any unauthorized access point | Not necessarily impersonating | Assuming it mimics a real network |
| Deauthentication | Forcing clients off a network | A technique, not an AP | Treating it as a standalone goal |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Capture equals crack
- What candidates pick
- Assume capturing a WPA2 handshake immediately reveals the passphrase.
- Why it looks right
- Capture is the key step.
- Why it's wrong
- The handshake still must be cracked offline, which a strong passphrase can defeat.
Clue to watch for The passphrase strength is mentioned.
-
WPA3 techniques on WPA2
- What candidates pick
- Apply WPA3-specific attacks to a WPA2 network.
- Why it looks right
- They are both modern standards.
- Why it's wrong
- The standard determines the viable attack; WPA2 handshakes are captured and cracked.
Clue to watch for The network is identified as WPA2.
-
Evil twin is any rogue AP
- What candidates pick
- Call any unauthorized access point an evil twin.
- Why it looks right
- Both are rogue APs.
- Why it's wrong
- An evil twin specifically imitates a legitimate network to deceive users.
Clue to watch for The rogue AP copies a known network name.
-
Ignore deauth
- What candidates pick
- Wait passively for a handshake instead of forcing one.
- Why it looks right
- Passive capture avoids interaction.
- Why it's wrong
- Deauthentication forces a client to reconnect, producing a capturable handshake.
Clue to watch for No handshake appears during passive capture.
-
Shared key enterprise
- What candidates pick
- Recommend a single shared key for a large organization's Wi-Fi.
- Why it looks right
- It is simple to deploy.
- Why it's wrong
- Enterprise mode with 802.1X gives per-user authentication and revocation.
Clue to watch for The network serves many users or has turnover.
Answer framework
For any CPENT Wireless Penetration Testing scenario, use these steps.
- Identify the wireless standard, since it determines which attacks are viable, working methodically and documenting the outcome before moving on.
- For WPA2, capture the four-way handshake, forcing it with deauthentication if needed, working methodically and documenting the outcome before moving on.
- Crack the captured handshake offline, and if the passphrase is strong, pivot to an evil twin.
- Use an evil twin and deauthentication to lure clients and capture credentials or traffic.
- Recommend defenses such as WPA3, enterprise authentication and wireless intrusion prevention, and document findings, and record evidence and the reasoning for each decision as you go, since the engagement is judged partly on the professional report you submit at the end.
Practice question
Want more like this? The CPENT practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Wireless needs hands-on practice with a compatible adapter. Set up a test network and run the core workflow until it is routine: identify the standard, capture the handshake (forcing it with deauthentication), and crack it offline. Understand clearly which attacks each standard allows, since WPA3 and WPA2 differ fundamentally.
Practice the evil twin workflow too, because when a passphrase is strong, luring a user is the better path than cracking. Learn the WPS attack and when it applies. Finally, know the defenses, WPA3, enterprise authentication and wireless intrusion prevention, so your report recommends fixes. Afterwards, move to Module 11, Linux exploitation and privilege escalation. Throughout, keep a disciplined note-taking and evidence workflow, because the CPENT report and its evidence carry much of the score, and details are easily lost across a long, intense exam. Rehearse this in a lab until it is routine, and capture evidence as you work so the final report is complete and defensible.
FAQ
Does capturing a WPA2 handshake reveal the password?
No. The captured handshake must be cracked offline, usually against a wordlist, and a strong passphrase can make this impractical.
Why use a deauthentication attack?
It forces a connected client to reconnect, generating the four-way handshake you need to capture for offline cracking.
What is an evil twin?
A rogue access point that imitates a legitimate network's name to lure users into connecting, often paired with deauthentication.
Which Wi-Fi standard is most secure?
WPA3, whose SAE resists offline guessing. WPA2-Personal is vulnerable to offline handshake cracking, and WEP is obsolete.
When does a WPS attack work?
Only when Wi-Fi Protected Setup is enabled, where the weak PIN can be exploited to recover the passphrase.
What defense should I recommend for an organization?
WPA3 with enterprise mode using 802.1X for per-user authentication, supported by wireless intrusion prevention.
How does this module connect to the rest of CPENT?
Wireless can provide an initial foothold into the network that the network, Windows and AD modules then exploit.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Practice Module 10 skills
You have covered wireless standards, handshake cracking and evil twin attacks. Practice the capture-and-crack and evil twin workflows hands-on.