EC-Council CEH Prep Online

Performing a deauthentication attack to capture the 4-way handshake is correct because it forces the network client to re-authenticate, allowing the attacker to capture the handshake necessary to brute-force the WPA2 passphrase. IMSI catchers are used to intercept mobile communications and are not relevant for capturing Wi-Fi handshakes. Sending rogue DHCP offers can disrupt network traffic but will not capture the WPA2 handshake. Beacon flood attacks can cause network disruption but do not assist in capturing handshakes necessary for a brute-force attack.

Error-oriented SQL injection works by crafting inputs that cause the database to throw informative errors. Those error messages can leak details such as table/column names, query structure, or other database information. Blind SQL injection avoids relying on error text and instead infers data from differences in the application’s responses. Time-based SQL injection is a type of blind approach that infers true/false conditions by measuring response delays. Union join SQL injection uses the UNION operator to combine results into the application’s output rather than primarily extracting information from error messages.

System hacking in an authorized assessment focuses on obtaining access and increasing privileges to validate exploitable weaknesses and demonstrate proof-of-access (and potential impact) within the agreed rules of engagement. The choice mentioning mapping the network infrastructure describes reconnaissance/enumeration activities that typically occur earlier in the workflow. The choices about deploying antivirus tools and enforcing strong passwords are defensive hardening measures, not objectives of the system-hacking phase.