Reconnaissance

What this phase covers

Reconnaissance is passive. Nothing is transmitted except what is strictly necessary to listen. The goal is to build a complete picture of every access point in range, their encryption types, their clients, and which ones have WPS enabled before deciding where to focus.

Start with airodump-ng for a quick overview of all visible APs. Use Kismet for longer surveys or when you need to run two adapters on different bands simultaneously without hopping gaps. Run wash against everything to flag WPS-enabled APs before moving to vulnerability discovery. Use Wireshark and tshark to inspect individual frames when the high-level view from airodump-ng is not enough detail.

What to note before moving on

Before leaving reconnaissance you should have: a list of all in-scope BSSIDs with their SSID, channel, encryption type, and AUTH column value; a list of WPS-enabled APs with lock status; and at least one client MAC per AP you intend to target. Any AP showing OPN in the ENC column is an immediate exploitation target — no further phases needed before capturing traffic. Any AP showing WEP is a priority target. Any AP showing MGT in AUTH is an enterprise network requiring a different attack path than PSK cracking.

Flows into

Enumeration drills deeper into individual APs — MFP status, exact authentication suites, and PMKID capture. Vulnerability discovery confirms which findings are exploitable. If you already have enough information to identify a clear target, you can move directly from reconnaissance to vulnerability discovery without a full enumeration pass.