A consultant proposes “wireless OSINT” for the library that consists of capturing handshakes and running aircrack-class attacks against guest and staff networks. How should the PORP candidate classify that work?
Select an answer to reveal the explanation.
Short Explanation
If the pitch is “capture a handshake and crack the library,” that is a pentest sibling, not PORP. Public building or guest SSID does not change the method. Deauthing patrons is not a kinder version of research either.
Full Explanation
PORP wireless OSINT is observation of public artifacts and datasets, not handshake cracking. When a consultant proposes 'wireless OSINT' for the library that consists of capturing handshakes and running aircrack-class attacks against guest and staff networks, the candidate should classify that work as offensive wireless technique outside PORP scope—even though libraries are public buildings and guest SSIDs feel approachable.
Accepting the pitch as PORP because libraries are public buildings confuses facility access with method authorization. Running the attack only on the guest SSID and still calling the result OSINT does not convert key recovery into open-source research. Substituting a deauthentication flood as a gentler form of OSINT is still an active attack against patrons.
Exam caveat: authorized wireless assessments may exist under separate rules of engagement and different certifications; those are not PORP OSINT products and should not be relabeled as such on an exam or in a city engagement.
Operational check: refuse handshake/aircrack methods in writing, offer public SSID/BSSID/map observation instead, and refer any authorized wireless pentest-style work to the appropriate engagement type and approvals.