Wireless:
Enumeration
AP clients, auth types, PMKID capture, and remote sniffing
PMKID Capture with hcxdumptool and hcxtools
Capture PMKID hashes from WPA/WPA2 networks without de-authentication using hcxdumptool, then convert and crack with hcxtools and hashcat.
What this phase covers
Enumeration extracts detail that reconnaissance misses. The AUTH column in airodump-ng tells you PSK vs MGT, but not whether MFP is required, not whether the AP is running WPA3 in transition mode, and not whether a PMKID can be captured without a client. This phase answers those questions before committing to an attack path.
AP capabilities and client enumeration covers MFP status, supported rates, and unassociated clients probing for networks. Enterprise vs personal authentication identifies the EAP method in use on MGT networks — critical for choosing between a handshake attack and a rogue RADIUS approach. PMKID capture with hcxdumptool should be run against all WPA2 PSK targets before attempting deauth — it requires no client and completes in seconds. Remote capture over SSH is relevant when your adapter is physically closer to the target than your analysis machine.
Key decision points
If hcxdumptool captures a usable PMKID, skip the deauthentication handshake capture entirely and go straight to cracking. If the AP has MFP-required, deauthentication attacks will not work — the only handshake path is waiting for a natural client reconnection or using PMKID capture. If the EAP method on an enterprise network is PEAP/MSCHAPv2 and certificate validation is not enforced, the attack path is a rogue RADIUS AP with hostapd-mana. If the EAP method is EAP-TLS, credential harvesting is not possible without a valid client certificate.
Flows into
Vulnerability discovery confirms the specific weaknesses identified here. Exploitation is the next phase once a viable attack path is confirmed — the PMKID hash from hcxdumptool feeds directly into the WPA cracking page.