# Enumeration

> AP clients, auth types, PMKID capture, and remote sniffing

- **URL:** https://hackindex.io/platforms/wireless/enumeration
- **Platform:** [Wireless](https://hackindex.io/platforms/wireless.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-29

## What this phase covers

Enumeration extracts detail that reconnaissance misses. The AUTH column in airodump-ng tells you PSK vs MGT, but not whether MFP is required, not whether the AP is running WPA3 in transition mode, and not whether a PMKID can be captured without a client. This phase answers those questions before committing to an attack path.

[AP capabilities and client enumeration](https://hackindex.io/platforms/wireless/enumeration/enumerating-ap-capabilities-and-clients) covers MFP status, supported rates, and unassociated clients probing for networks. [Enterprise vs personal authentication](https://hackindex.io/platforms/wireless/enumeration/identifying-enterprise-vs-personal-authentication) identifies the EAP method in use on MGT networks ,  critical for choosing between a handshake attack and a rogue RADIUS approach. [PMKID capture with hcxdumptool](https://hackindex.io/platforms/wireless/enumeration/pmkid-capture-with-hcxdumptool) should be run against all WPA2 PSK targets before attempting deauth ,  it requires no client and completes in seconds. [Remote capture over SSH](https://hackindex.io/platforms/wireless/enumeration/remote-packet-capture-over-ssh) is relevant when your adapter is physically closer to the target than your analysis machine.

## Key decision points

If hcxdumptool captures a usable PMKID, skip the deauthentication handshake capture entirely and go straight to cracking. If the AP has MFP-required, deauthentication attacks will not work ,  the only handshake path is waiting for a natural client reconnection or using PMKID capture. If the EAP method on an enterprise network is PEAP/MSCHAPv2 and certificate validation is not enforced, the attack path is a rogue RADIUS AP with hostapd-mana. If the EAP method is EAP-TLS, credential harvesting is not possible without a valid client certificate.

## Flows into

[Vulnerability discovery](https://hackindex.io/platforms/wireless/vulnerability-discovery) confirms the specific weaknesses identified here. [Exploitation](https://hackindex.io/platforms/wireless/exploitation) is the next phase once a viable attack path is confirmed ,  the PMKID hash from hcxdumptool feeds directly into the [WPA cracking page](https://hackindex.io/platforms/wireless/exploitation/wpa-cracking).

## Guides

- [Enumerating AP Capabilities and Clients](https://hackindex.io/platforms/wireless/enumeration/enumerating-ap-capabilities-and-clients.md): Discover AP capabilities, supported standards, encryption types, and connected clients using passive/active wireless enumeration techniques.
- [Identifying Enterprise vs Personal Authentication](https://hackindex.io/platforms/wireless/enumeration/identifying-enterprise-vs-personal-authentication.md): Differentiates enterprise (802.1X/EAP) from personal (PSK) wireless auth methods to guide credential attacks and lateral movement strategies.
- [PMKID Capture with hcxdumptool and hcxtools](https://hackindex.io/platforms/wireless/enumeration/pmkid-capture-with-hcxdumptool.md): Capture PMKID hashes from WPA/WPA2 networks without de-authentication using hcxdumptool, then convert and crack with hcxtools and hashcat.
- [Remote Wireless Packet Capture over SSH](https://hackindex.io/platforms/wireless/enumeration/remote-packet-capture-over-ssh.md): Capture wireless packets remotely via SSH tunnel using tcpdump and Wireshark, enabling real-time 802.11 traffic analysis without direct physical access.