Offensive Wifi Recon

Wi-Fi Reconnaissance

The first phase of any wireless engagement. Build a complete picture of the airspace before you deauth, evil-twin, or capture handshakes — every later attack depends on knowing the right BSSID, channel, encryption, and client population.

Quick Workflow

• Pick the right adapter for the target's band(s) and PHY
• Verify monitor mode + injection actually work
• Set the regulatory domain (legal channels and TX power)
• Sweep all bands passively
• Drill down on each in-scope BSSID for client population and PMF status
• Record everything in a structured target list before any active attack

Adapter Selection

| Chipset | Strengths | Notes |

|---------|-----------|-------|

| Atheros AR9271 (Alfa AWUS036NHA) | Solid 2.4 GHz monitor + injection | 802.11n only |

| Realtek RTL8812AU (AWUS036ACH) | Dual-band, injection | Driver: aircrack-ng/rtl8812au |

| MediaTek MT7612U (AWUS036ACM) | Stable dual-band | In-tree driver on modern kernels |

| MediaTek MT7921AU | Wi-Fi 6 monitor (limited) | Patched drivers required |

| AWUS036AXML / AXM | Wi-Fi 6E (6 GHz) | Bleeding edge — verify per release |

# Identify your radio
lsusb | grep -iE "(atheros|realtek|mediatek|alfa)"
iw dev
iw list | grep -A 8 "Supported interface modes"
iw list | grep -E "Frequencies:" -A 30

Monitor Mode Setup

# Kill conflicting services
sudo airmon-ng check kill

# Enable monitor mode
sudo airmon-ng start wlan0
# Or manually
sudo ip link set wlan0 down
sudo iw wlan0 set monitor control
sudo ip link set wlan0 up

# Verify monitor mode + injection
sudo aireplay-ng --test wlan0mon

The injection test should report 30/30 ack rates against nearby APs. Lower scores indicate driver, antenna, or position issues.

Regulatory Domain

# Check current
iw reg get

# Set explicitly (us = United States, jp = Japan extended, etc.)
sudo iw reg set US

Setting the right regdomain unlocks legitimate channels (US: 1–11 on 2.4, 36–165 on 5; JP adds 12–13 + 184+ DFS) and TX power. Operate within the regdomain you're authorized to use.

Passive Multi-Band Sweep

# All bands
sudo airodump-ng wlan0mon --band abg

# 5 GHz only (helps see UNII bands)
sudo airodump-ng wlan0mon --band a

# 6 GHz (requires 6E-capable adapter and updated airodump-ng)
sudo airodump-ng wlan0mon --band ax

# Hop only specific channels
sudo airodump-ng wlan0mon -c 1,6,11,36,40,44,48

Capture to file for later analysis:

sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv

Targeted Capture

Once you've identified an in-scope BSSID:

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon

Pin to the channel — channel-hopping during a focused capture loses frames.

Hidden SSIDs

Hidden APs broadcast beacons with empty ESSID. The name leaks during client probes (active scan) or association requests:

# Wait for legitimate client to associate, ESSID appears in airodump output
# Or, if a client is already associated, deauth them once to force reassociation:
sudo aireplay-ng --deauth 1 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

(Only deauth with explicit authorization — see offensive-deauth-disassoc.)

Kismet for War-Driving

sudo kismet -c wlan0mon
# Open https://localhost:2501 for the dashboard

Kismet handles GPS integration, plots APs to a map, fingerprints by IE order, identifies probable IoT vendors from OUI prefixes, and tags known-vulnerable models.

For long-running captures, drop --no-ncurses and run headless under tmux.

Wigle Submission

If the engagement permits:

# Export Kismet's .kismet → CSV → Wigle import format
kismetdb_dump_devices --in capture.kismet --out devices.csv

(Wigle aggregates wireless network observations geographically — useful for mapping but check ROE.)

Vendor / OUI Identification

# Quick OUI lookup
echo "AA:BB:CC" | wireshark-tools/manuf-lookup
# Or check the airodump CSV's BSSID prefix against /usr/share/wireshark/manuf

Vendor identification informs:

• Likely default credentials (router brand → known defaults)
• Known firmware bugs (CVE per chipset)
• Whether WPS is likely vulnerable (Pixie Dust per chipset)
• Whether KRACK / FragAttacks patches are likely applied (vendor patch cadence)

Data to Record per Target

| Field | Why |

|-------|-----|

| BSSID | Required for every active attack |

| ESSID | Match against PNL probes; client probe correlation |

| Channel + width | Pin radio for capture |

| Band | Adapter selection |

| Encryption | WPA2-PSK / WPA2-Enterprise / WPA3-SAE / Open / WEP |

| PMF (Protected Management Frames) | Whether deauth works |

| RSSI | Position planning |

| Beacon interval / TIM | Anomaly detection vs. evil-twin defenders |

| Vendor (OUI) | Likely default creds, known bugs |

| Client list (MACs + RSSI) | Targets for deauth/relay |

| WPS enabled? | Pixie Dust candidate |

Detection Considerations

A defender's WIDS sees:

• New device entering the airspace (probe requests reveal even before association)
• Channel hopping patterns of monitor-mode interfaces
• Non-standard probe behavior (KARMA-style universal responses, see offensive-evil-twin)

Pure passive recon (no probes from your radio) is invisible to most WIDS deployments. Stay passive until you're committed to the active phase.

Engagement Cheatsheet

# 1. Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US
sudo aireplay-ng --test wlan0mon          # confirm injection (skip if pure passive)

# 2. Sweep all bands, write to file
sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv

# 3. Kismet for sustained map (optional)
sudo kismet -c wlan0mon --no-ncurses --daemonize

# 4. Per BSSID drill-down
sudo airodump-ng -c <ch> --bssid <BSSID> -w <name> wlan0mon

# 5. Build target list with all fields above

Key References

• IEEE 802.11-2020 (combined spec)
• aircrack-ng documentation: aircrack-ng.org
• Kismet documentation: kismetwireless.net
• WIGLE: wigle.net (read the API ToS before automated submissions)
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md