An analyst has a valid municipal WPA2 handshake, yet a huge wordlist returns no passphrase. What limit should be considered first?
Select an answer to reveal the explanation.
Short Explanation
A solid handshake plus silence from rockyou-size lists usually means the secret is not in the haystack—not that WPA2 invented unbreakable magic. Offline attacks only test what you feed them. Widen rules, retarget identity, or accept a strong PSK and pivot.
Full Explanation
Offline dictionary and rule attacks succeed only when the candidate space includes the true passphrase. Exhausting a large list without a hit commonly indicates insufficient coverage, not a broken capture by itself and not a universal claim that WPA2 cannot be attacked offline. Assessors should reassess wordlist quality, mutations, target identity, and whether the secret’s entropy makes timed recovery impractical. Recon indicators of PSK versus Enterprise should be verified separately rather than inferred from a failed crack alone.