WiFi Reconnaissance

# Full scan — all channels, all bands
sudo airodump-ng wlan0mon

# Target a specific channel and BSSID (stops channel hopping)
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# 5 GHz only scan (UNII-1..3, channels 36-177)
sudo airodump-ng --band a wlan0mon

# Dual-band scan (2.4 + 5 GHz simultaneously)
sudo airodump-ng --band abg wlan0mon

# Deauth a connected client — they'll re-probe with the SSID
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon

# Watch airodump — ESSID appears on reassociation
sudo airodump-ng -c 11 --bssid AA:BB:CC:DD:EE:FF wlan0mon

# Capture and filter for probe requests containing the target BSSID
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.ssid -e wlan.sa | sort -u

# Wireshark display filter for probe requests
wlan.fc.type_subtype == 0x04 && wlan.ssid != ""

# Brute force hidden SSID using MDK4 probe mode
# mdk4 reads the candidate SSIDs from a file (-f), not from a pipe
sudo mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF -f /usr/share/wordlists/ssid-list.txt

# Generate an SSID candidate list from common patterns, then feed it with -f
crunch 8 8 abcdefghijklmnopqrstuvwxyz0123456789 -o ssid-candidates.txt
sudo mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF -f ssid-candidates.txt

# -s sets the probe-request rate in packets per second (optional throttle)
sudo mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF -f ssid-candidates.txt -s 50

# Install Kismet (Kali/Debian)
sudo apt install kismet

# Add your user to the kismet group (avoids running as root)
sudo usermod -aG kismet $USER

# Start Kismet with a Wi-Fi source
kismet -c wlan0mon

# Start with multiple sources (dual-band + Bluetooth)
kismet -c wlan0mon:name=WiFi_2G -c wlan1mon:name=WiFi_5G -c hci0:name=BTLE

# /etc/kismet/kismet.conf — key settings

# Override default source (or add via CLI)
source=wlan0mon:name=MainWiFi,channel_hop=true,channel_hoprate=5/sec

# Channel lock for targeted recon
source=wlan0mon:name=TargetCH,channel=6

# Enable PCAP logging for offline analysis
log_types=kismet,pcapng

# Wardriving — enable GPS
gps=gpsd:host=localhost,port=2947

# Alert on rogue APs — compare against known BSSID list
# (edit /etc/kismet/kismet_alerts.conf)
apspoof=CorpWiFi:ssidregex="CorpWiFi",validmacs=AA:BB:CC:DD:EE:FF

# List all discovered SSIDs with encryption types
sqlite3 Kismet-*.kismet "SELECT devmac, type, CAST(device AS TEXT) FROM devices WHERE type='Wi-Fi AP';" | head -20

# REST API — query device list (while Kismet is running)
curl -s http://localhost:2501/devices/summary/devices.json \
  -H 'KISMET: admin:changeme' | python3 -m json.tool | head -30

# Export to Wigle CSV for wardriving upload
kismetdb_to_wiglecsv --in Kismet-*.kismet --out wardriving-results.csv

# Convert to pcapng for Wireshark analysis
kismetdb_to_pcap --in Kismet-*.kismet --out capture.pcapng

# Search the global database by BSSID (HTTP Basic with API Name + API Token)
curl -s -u "$WIGLE_API_NAME:$WIGLE_API_TOKEN" \
  "https://api.wigle.net/api/v2/network/search?netid=AA:BB:CC:DD:EE:FF"

# Search by SSID instead
curl -s -u "$WIGLE_API_NAME:$WIGLE_API_TOKEN" \
  "https://api.wigle.net/api/v2/network/search?ssid=CorpWiFi"

# Quick 2.4 GHz sweep — channels 1, 6, 11 only (covers ~90% of APs)
sudo airodump-ng --channel 1,6,11 wlan0mon -w quick-scan --output-format csv

# Full 5 GHz sweep (if adapter supports it)
sudo airodump-ng --band a wlan0mon -w 5ghz-scan --output-format csv

# Lock to target channel for handshake capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon

# Tip: -f sets the channel-hop dwell time in milliseconds
# Shorter dwell = wider scan, fewer packets per channel
# Longer dwell = narrower scan, more packets, better for remote APs
sudo airodump-ng -f 500 wlan0mon

# OUI vendor lookup from BSSID (first 3 octets)
# AA:BB:CC:DD:EE:FF → look up AA:BB:CC at https://maclookup.app
# This reveals the AP manufacturer (Ubiquiti, Cisco, TP-Link, etc.)

# Extract supported rates and capabilities from beacons
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.bssid -e wlan.ssid -e wlan.fixed.capabilities \
  -e wlan_radio.channel -e wlan.rsn.pcs.type | sort -u

# Identify WPS-enabled APs (Wash)
sudo wash -i wlan0mon -C
# Look for "Lck" column = WPS lock status
# Version 1.0 = vulnerable to Pixie Dust and brute force

# Probe for 802.11w Management Frame Protection (MFP) support
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08 && wlan.rsn.capabilities.mfpc == 1" \
  -T fields -e wlan.bssid -e wlan.ssid -e wlan.rsn.capabilities.mfpr

# List all client probes visible in the area
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.sa -e wlan.ssid 2>/dev/null | sort | uniq -c | sort -rn

# Example output:
#   47 CC:DD:EE:FF:00:11  CorpWiFi          ← employee phone, searching for work SSID
#   23 CC:DD:EE:FF:00:11  Hilton_WiFi       ← recently stayed at Hilton
#   12 AA:BB:CC:DD:EE:22  ATT-WIFI-1234     ← home network name
#    8 AA:BB:CC:DD:EE:33  <Broadcast>       ← modern device, doesn't leak SSIDs

# Correlate clients to APs (airodump lower pane)
# The "Probes" column shows SSIDs each client has searched for
# The "BSSID" column shows which AP they're currently associated to

# Probe requests always use the broadcast DA (ff:ff:ff:ff:ff:ff), so a DA
# filter alone cannot separate associated from unassociated clients.
# List every client that emits probe requests:
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.sa -e wlan.ssid | sort -u

# Then drop any MAC that also appears in data frames to isolate clients that
# are only probing (i.e. not currently associated to an AP).

# Save in all useful formats simultaneously
sudo airodump-ng -w recon --output-format pcap,csv,kismet,netxml wlan0mon

# Output files created:
# recon-01.cap     — full packet capture (Wireshark, hashcat, hcxpcapngtool)
# recon-01.csv     — parseable spreadsheet (Excel, grep, awk)
# recon-01.kismet.csv  — Kismet-compatible CSV
# recon-01.kismet.netxml — XML format for scripting

# Quick CSV analysis — top APs by client count
awk -F',' 'NR>2 && $1!="" {print $14, $1}' recon-01.csv | sort | uniq -c | sort -rn | head -20

# Parse with Python for reporting
python3 -c "
import csv
with open('recon-01.csv') as f:
    reader = csv.reader(f)
    for row in reader:
        if len(row) > 13 and row[5].strip():
            print(f'{row[0].strip():20s} CH:{row[3].strip():3s} ENC:{row[5].strip():6s} {row[13].strip()}')"