Wi-Fi Aircrack-ng Basic Wireless Pentest Checklist

• Interface needs to be in monitor mode
• Use airodump to scan for wifi networks
• Use aireplay to deauthenticate clients connected to the AP, the client will reconnect and airodump will capture the request with the SSID.

airodump-ng -c <channel> <interface>
aireplay-ng -0 10 -a <MAC of AP> -c <MAC of client> <interface>

Brute-Force attack

• Can brute-force the name of a hidden SSID
• Specify a wordlist or the length of SSID

mdk3 <interface> <test mode> [test_options]

• The -p test mode does basic probing and ESSID brute-forcing.

  • -e Specify the SSID for probing.
  • -f Read lines from a file for brute-forcing hidden SSIDs.
  • -t Set the MAC address of the target AP.
  • -s Set the speed (Default: unlimited, in Bruteforce mode: 300).
  • -b Use full brute-force mode (recommended for short SSIDs only). This switch is used to show its help screen

• The -b option has the following suboptions

  • u - upper case
  • n - digits
  • a - all printed
  • c - Lower and upper case
  • m - lower and upper plus numbers

mdk3 <interface> p -b u -c 1 -t <MAC of AP>

• To brute-force with a wordlist:

mdk3 <interface> p -f <wordlist> -t <MAC of AP>