WiFi Reconnaissance

# Full scan — all channels, all bands
sudo airodump-ng wlan0mon

# Target a specific channel and BSSID (stops channel hopping)
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# 5 GHz only scan (channels 36-165)
sudo airodump-ng --band a wlan0mon

# Dual-band scan (2.4 + 5 GHz simultaneously)
sudo airodump-ng --band abg wlan0mon

# Lock to hidden AP's channel and wait for client probe
sudo airodump-ng -c 11 --bssid AA:BB:CC:DD:EE:FF wlan0mon
# ESSID will populate when a client sends a probe request

# Deauth a connected client — they'll re-probe with the SSID
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon

# Watch airodump — ESSID appears on reassociation
sudo airodump-ng -c 11 --bssid AA:BB:CC:DD:EE:FF wlan0mon

# Capture and filter for probe requests containing the target BSSID
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.ssid -e wlan.sa | sort -u

# Wireshark display filter for probe requests
wlan.fc.type_subtype == 0x04 && wlan.ssid != ""

# Brute force hidden SSID using MDK4 probe mode
sudo mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF -f /usr/share/wordlists/ssid-list.txt

# Generate SSID wordlist from common patterns
crunch 8 8 abcdefghijklmnopqrstuvwxyz0123456789 | \
  sudo mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF -s

# Install Kismet (Kali/Debian)
sudo apt install kismet

# Add your user to the kismet group (avoids running as root)
sudo usermod -aG kismet $USER

# Start Kismet with a Wi-Fi source
kismet -c wlan0mon

# Start with multiple sources (dual-band + Bluetooth)
kismet -c wlan0mon:name=WiFi_2G -c wlan1mon:name=WiFi_5G -c hci0:name=BTLE

# /etc/kismet/kismet.conf — key settings

# Override default source (or add via CLI)
source=wlan0mon:name=MainWiFi,hop=true,hop_rate=5/sec

# Channel lock for targeted recon
source=wlan0mon:name=TargetCH,channel=6

# Enable PCAP logging for offline analysis
log_types=kismet,pcapng

# Wardriving — enable GPS
gps=gpsd:host=localhost,port=2947

# Alert on rogue APs — compare against known BSSID list
# (edit /etc/kismet/kismet_alerts.conf)
apspoof=CorpWiFi:ssidregex="CorpWiFi",validmacs=AA:BB:CC:DD:EE:FF

# List all discovered SSIDs with encryption types
sqlite3 Kismet-*.kismet "SELECT devmac, type, CAST(device AS TEXT) FROM devices WHERE type='Wi-Fi AP';" | head -20

# REST API — query device list (while Kismet is running)
curl -s http://localhost:2501/devices/summary/devices.json \
  -H 'KISMET: admin:changeme' | python3 -m json.tool | head -30

# Export to Wigle CSV for wardriving upload
kismetdb_to_wiglecsv --in Kismet-*.kismet --out wardriving-results.csv

# Convert to pcapng for Wireshark analysis
kismetdb_to_pcap --in Kismet-*.kismet --out capture.pcapng

# Step 1: Quick 2.4 GHz sweep — channels 1, 6, 11 only (covers ~90% of APs)
sudo airodump-ng --channel 1,6,11 wlan0mon -w quick-scan --output-format csv

# Step 2: Full 5 GHz sweep (if adapter supports it)
sudo airodump-ng --band a wlan0mon -w 5ghz-scan --output-format csv

# Step 3: Lock to target channel for handshake capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon

# Tip: Use '--channel-hop-dwell-time' flag to control hop speed
# Shorter dwell = wider scan, fewer packets per channel
# Longer dwell = narrower scan, more packets, better for remote APs
sudo airodump-ng --channel-hop-dwell-time 500ms wlan0mon

# OUI vendor lookup from BSSID (first 3 octets)
# AA:BB:CC:DD:EE:FF → look up AA:BB:CC at https://maclookup.app
# This reveals the AP manufacturer (Ubiquiti, Cisco, TP-Link, etc.)

# Extract supported rates and capabilities from beacons
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.bssid -e wlan.ssid -e wlan.fixed.capabilities \
  -e wlan_radio.channel -e wlan.rsn.pcs.type | sort -u

# Identify WPS-enabled APs (Wash)
sudo wash -i wlan0mon -C
# Look for "Lck" column = WPS lock status
# Version 1.0 = vulnerable to Pixie Dust and brute force

# Probe for 802.11w (MFP) support
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08 && wlan.rsn.capabilities.mfpc == 1" \
  -T fields -e wlan.bssid -e wlan.ssid -e wlan.rsn.capabilities.mfpr

# List all client probes visible in the area
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.sa -e wlan.ssid 2>/dev/null | sort | uniq -c | sort -rn

# Example output:
#   47 CC:DD:EE:FF:00:11  CorpWiFi          ← employee phone, searching for work SSID
#   23 CC:DD:EE:FF:00:11  Hilton_WiFi       ← recently stayed at Hilton
#   12 AA:BB:CC:DD:EE:22  ATT-WIFI-1234     ← home network name
#    8 AA:BB:CC:DD:EE:33  <Broadcast>       ← modern device, doesn't leak SSIDs

# Correlate clients to APs (airodump lower pane)
# The "Probes" column shows SSIDs each client has searched for
# The "BSSID" column shows which AP they're currently associated to

# Filter for clients NOT associated to any AP (searching/roaming)
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x04 && wlan.da == ff:ff:ff:ff:ff:ff" \
  -T fields -e wlan.sa -e wlan.ssid | sort -u

# Save in all useful formats simultaneously
sudo airodump-ng -w recon --output-format pcap,csv,kismet,netxml wlan0mon

# Output files created:
# recon-01.cap     — full packet capture (Wireshark, hashcat, hcxpcapngtool)
# recon-01.csv     — parseable spreadsheet (Excel, grep, awk)
# recon-01.kismet.csv  — Kismet-compatible CSV
# recon-01.kismet.netxml — XML format for scripting

# Quick CSV analysis — top APs by client count
awk -F',' 'NR>2 && $1!="" {print $14, $1}' recon-01.csv | sort | uniq -c | sort -rn | head -20

# Parse with Python for reporting
python3 -c "
import csv
with open('recon-01.csv') as f:
    reader = csv.reader(f)
    for row in reader:
        if len(row) > 13 and row[5].strip():
            print(f'{row[0].strip():20s} CH:{row[3].strip():3s} ENC:{row[5].strip():6s} {row[13].strip()}')"