Question

During a wireless assessment, you identify a WPA2-PSK network in scope. You have positioned a monitor-mode adapter within range and confirmed the target BSSID and connected clients. Your goal is to recover the pre-shared key offline. Which sequence of actions correctly achieves this?

Accepted Answer

Capture the 4-way handshake by sending targeted deauthentication frames to a connected client to force reassociation, then run a dictionary attack against the captured handshake with a tool like hashcat or aircrack-ng.

Answer

Send an EAPOL start flood to the access point to disclose the PSK in cleartext, then decode it from the capture with Wireshark.

Answer

Associate to the network with a null password to trigger the AP to return the PSK hash, then submit that hash to an online rainbow-table service.

Answer

Perform an ARP replay attack to generate IVs, then statistically recover the PSK once enough unique IVs are collected.