What I'm finding somewhat interesting is that Cloudflare (1.1.1.1) appears to be sinkholing that DNS request for me (I'm currently inside Australia - 127.0.0.3 is being returned) whereas Google (8.8.8.8) does not (51.38.113.224 returned). Doesn't look like it's just me either - ViewDNS [1] is currently showing 'www.archive.is' returning 127.0.0.3 from Sydney.
Are you sure about that? From the paper (section 3.3):
> Note that the adversary cannot replay
an old message 3, because its EAPOL replay counter is no longer
fresh.
And a related update from the TLDR post you originally referenced (which I believe is causing confusion):
> Update: An early version of this post suggested that the attacker would replay the message. Actually, the paper describes forcing the AP to resend it by blocking it from being received at the client. Thanks to Nikita Borisov for the fix.
Pentesting itself can be quite a broad field, and although you’re right about a lot of it being network-related, it typically gets split into categories depending on the exact type of pentest (e.g. application penetration testing, wireless pentesting, embedded devices, SCADA/OT systems).
You could get into a debate on which areas are more demanding, but as you get deeper, they do require different skill sets/specialities/ways of thinking. Someone who’s great at web app pentesting may not necessarily be fantastic at RE or social engineering.
It looks like they just de-authenticated a client and then performed a dictionary attack:
"At the beginning, the area was scanned-sniffed with ‘Airodump’ and then a deauthentication attack was made with ‘Aireplay’," according to the paper. "Through that, an instance of the PSK was caught. Finally, ‘Aircrack’ was attempting to reveal the secret password by using the instance of the PSK and matching it with every record of the dictionary. For these experiments we used a very big dictionary that consisted of 666,696 standard printable ASCII character records of various lengths. ‘Airodump’ and ‘Aireplay’ are commands of the ‘Aircrack’ suite, responsible for sniffing and deauthentication respectively." [1]
https://www.cisa.gov/resources-tools/resources/CSRB-Review-S...