Question

During an authorized wireless assessment of a corporate office, you observe that the guest SSID 'Corp-Guest' uses no encryption and redirects clients to a captive portal for authentication. You want to capture guest credentials by tricking users into connecting to a rogue access point that mimics the legitimate network. Which technique BEST accomplishes this goal?

Accepted Answer

Deploy an evil twin AP broadcasting the same SSID with a cloned captive portal to harvest submitted credentials

Answer

Perform a WPA2 handshake capture with a deauthentication attack and crack the pre-shared key offline

Answer

Use MAC address spoofing to bypass the captive portal's client isolation

Answer

Launch a KRACK attack to force nonce reuse during the four-way handshake