An assessor evaluating a municipal WPA2-Personal capture considers adding John the Ripper to the toolchain. What purpose class does John the Ripper fill here?
Select an answer to reveal the explanation.
Short Explanation
John the Ripper is another offline guesser sitting next to the capture—like trying keys on a lock you already photographed, not kicking doors on the live AP. Feed it a supported WPA hash format and it works the passphrase candidates locally. It is not the monitor-mode or deauth tool.
Full Explanation
John the Ripper belongs to the offline credential-recovery tool class used against WPA-PSK material that has been converted into a supported hash representation. It does not place interfaces into monitor mode, inject management frames, or configure access-point security. In PEN-210-style workflows it sits alongside aircrack-ng and hashcat as an option for dictionary or rule-based passphrase testing after capture. Correct format preparation remains a prerequisite for any of those crackers.