Discovery
We will begin by gathering information about our target.
We need to kill any process that might interfere with our wireless card.
Once that is done, we’ll place our wireless interface in monitor mode.
Next, we can use our monitor mode interface with airodump-ng,
to capture information about the clients and APs around us.
We will be targeting “MegaCorp One Lab”,
which is a WPA-PSK network on channel 11 with three clients.
It doesn’t matter if the encryption is WPA1 or WPA2, since we will be using
an open network on the same channel to trick clients into connecting to us.
We will need to intercept a handshake from one of the clients.
First we will restart the capture similar to what we did when cracking WPA-PSK.
We’ll use -w to set the dump file prefix,
and --output-format, to set the output format to be a pcap,
and listen on the same channel as the AP.
The output is sent to the terminal,
but it is also saved in our specified capture file.
We can either wait for a client to connect or reconnect,
or we can use aireplay-ng to deauthenticate clients.
This will force them to reconnect and should allow us to capture the handshake.
Shortly after this, airodump-ng captures a “MegaCorp One Lab” handshake,
which is now saved in our capture file.
This will be important to use later on in our attack.
We will disable monitor mode before we continue.