Wi-Fi Reconnaissance

The first phase of any wireless engagement. Build a complete picture of the airspace before you deauth, evil-twin, or capture handshakes — every later attack depends on knowing the right BSSID, channel, encryption, and client population.

任何 wireless engagement 的第一阶段。在执行 deauth、evil-twin 或捕获 handshake 之前，先完整掌握 airspace；之后每一次攻击都依赖于准确获知 BSSID、channel、encryption 和 client population。

Quick Workflow

快速工作流

Pick the right adapter for the target's band(s) and PHY
Verify monitor mode + injection actually work
Set the regulatory domain (legal channels and TX power)
Sweep all bands passively
Drill down on each in-scope BSSID for client population and PMF status
Record everything in a structured target list before any active attack

为目标频段和 PHY 选择合适的 adapter
验证 monitor mode + injection 是否确实可用
设置 regulatory domain（合法 channel 和 TX power）
被动扫描所有频段
对范围内每个 BSSID 深入分析 client population 和 PMF 状态
在任何主动攻击前，将所有信息记录到结构化 target list 中

Adapter Selection

Adapter 选择

Chipset	Strengths	Notes
Atheros AR9271 (Alfa AWUS036NHA)	Solid 2.4 GHz monitor + injection	802.11n only
Realtek RTL8812AU (AWUS036ACH)	Dual-band, injection	Driver: aircrack-ng/rtl8812au
MediaTek MT7612U (AWUS036ACM)	Stable dual-band	In-tree driver on modern kernels
MediaTek MT7921AU	Wi-Fi 6 monitor (limited)	Patched drivers required
AWUS036AXML / AXM	Wi-Fi 6E (6 GHz)	Bleeding edge — verify per release

bash

undefined

芯片组	优势	备注
Atheros AR9271 (Alfa AWUS036NHA)	稳定的 2.4 GHz monitor + injection	仅支持 802.11n
Realtek RTL8812AU (AWUS036ACH)	双频段，支持 injection	Driver：aircrack-ng/rtl8812au
MediaTek MT7612U (AWUS036ACM)	稳定的双频段支持	现代 kernel 已内置 driver
MediaTek MT7921AU	Wi-Fi 6 monitor（有限）	需要 patched driver
AWUS036AXML / AXM	Wi-Fi 6E（6 GHz）	前沿技术——需按版本验证

bash

undefined

Identify your radio

undefined

undefined

Monitor Mode Setup

Monitor Mode 配置

bash

undefined

bash

undefined

Kill conflicting services

sudo airmon-ng check kill

Enable monitor mode

sudo airmon-ng start wlan0

Or manually

sudo ip link set wlan0 down sudo iw wlan0 set monitor control sudo ip link set wlan0 up

Verify monitor mode + injection

sudo aireplay-ng --test wlan0mon


The injection test should report 30/30 ack rates against nearby APs. Lower scores indicate driver, antenna, or position issues.

sudo aireplay-ng --test wlan0mon


注入测试针对附近 AP 应报告 30/30 的 ack rate。较低分数表明可能存在 driver、antenna 或位置问题。

Regulatory Domain

bash

undefined

bash

undefined

Check current

iw reg get

Set explicitly (us = United States, jp = Japan extended, etc.)

sudo iw reg set US


Setting the right regdomain unlocks legitimate channels (US: 1–11 on 2.4, 36–165 on 5; JP adds 12–13 + 184+ DFS) and TX power. **Operate within the regdomain you're authorized to use.**

sudo iw reg set US


设置正确的 regdomain 会开放合法 channel（US：2.4 GHz 上为 1–11；5 GHz 上为 36–165；JP 额外增加 12–13 + 184+ DFS）以及 TX power。**仅在获授权使用的 regdomain 范围内操作。**

Passive Multi-Band Sweep

被动多频段扫描

bash

undefined

bash

undefined

All bands

sudo airodump-ng wlan0mon --band abg

5 GHz only (helps see UNII bands)

sudo airodump-ng wlan0mon --band a

6 GHz (requires 6E-capable adapter and updated airodump-ng)

sudo airodump-ng wlan0mon --band ax

Hop only specific channels

sudo airodump-ng wlan0mon -c 1,6,11,36,40,44,48


Capture to file for later analysis:

```bash
sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv

sudo airodump-ng wlan0mon -c 1,6,11,36,40,44,48


采集到文件供后续分析：

```bash
sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv

Targeted Capture

定向采集

Once you've identified an in-scope BSSID:

bash

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon

Pin to the channel — channel-hopping during a focused capture loses frames.

确定目标范围内的 BSSID 后：

bash

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon

锁定 channel——专注采集期间进行 channel-hopping 会丢失 frame。

Hidden SSIDs

Hidden SSID

Hidden APs broadcast beacons with empty ESSID. The name leaks during client probes (active scan) or association requests:

bash

undefined

Hidden AP 会以空 ESSID 广播 beacon。名称会在 client probe（active scan）或 association request 期间泄露：

bash

undefined

Wait for legitimate client to associate, ESSID appears in airodump output

Or, if a client is already associated, deauth them once to force reassociation:

sudo aireplay-ng --deauth 1 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon


(Only deauth with explicit authorization — see `offensive-deauth-disassoc`.)

sudo aireplay-ng --deauth 1 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon


（仅在获得明确授权时执行 deauth——参见 `offensive-deauth-disassoc`。）

Kismet for War-Driving

用于 War-Driving 的 Kismet

bash

sudo kismet -c wlan0mon

bash

sudo kismet -c wlan0mon

Open https://localhost:2501 for the dashboard


Kismet handles GPS integration, plots APs to a map, fingerprints by IE order, identifies probable IoT vendors from OUI prefixes, and tags known-vulnerable models.

For long-running captures, drop `--no-ncurses` and run headless under `tmux`.


Kismet 支持 GPS integration、将 AP 绘制到地图、按 IE order 进行 fingerprinting、基于 OUI prefix 识别可能的 IoT vendor，并标记已知存在漏洞的型号。

对于长时间运行的采集，使用 `--no-ncurses` 并在 `tmux` 下以 headless 模式运行。

Wigle Submission

Wigle 提交

If the engagement permits:

bash

undefined

如果 engagement 规则允许：

bash

undefined

Export Kismet's .kismet → CSV → Wigle import format

kismetdb_dump_devices --in capture.kismet --out devices.csv


(Wigle aggregates wireless network observations geographically — useful for mapping but check ROE.)

kismetdb_dump_devices --in capture.kismet --out devices.csv


（Wigle 会按地理位置聚合 wireless network observation——这有助于 mapping，但请检查 ROE。）

Vendor / OUI Identification

Vendor / OUI 识别

bash

undefined

bash

undefined

Quick OUI lookup

echo "AA:BB:CC" | wireshark-tools/manuf-lookup

Or check the airodump CSV's BSSID prefix against /usr/share/wireshark/manuf


Vendor identification informs:
- Likely default credentials (router brand → known defaults)
- Known firmware bugs (CVE per chipset)
- Whether WPS is likely vulnerable (Pixie Dust per chipset)
- Whether KRACK / FragAttacks patches are likely applied (vendor patch cadence)


Vendor 识别有助于判断：
- 可能的 default credential（router brand → known defaults）
- 已知 firmware bug（按 chipset 对应的 CVE）
- WPS 是否可能存在漏洞（按 chipset 判断 Pixie Dust）
- 是否可能已应用 KRACK / FragAttacks 补丁（依据 vendor 的 patch cadence）

Data to Record per Target

每个目标需记录的数据

Field	Why
BSSID	Required for every active attack
ESSID	Match against PNL probes; client probe correlation
Channel + width	Pin radio for capture
Band	Adapter selection
Encryption	WPA2-PSK / WPA2-Enterprise / WPA3-SAE / Open / WEP
PMF (Protected Management Frames)	Whether deauth works
RSSI	Position planning
Beacon interval / TIM	Anomaly detection vs. evil-twin defenders
Vendor (OUI)	Likely default creds, known bugs
Client list (MACs + RSSI)	Targets for deauth/relay
WPS enabled?	Pixie Dust candidate

字段	原因
BSSID	每次主动攻击都必需
ESSID	与 PNL probes 匹配；关联 client probe
Channel + width	为采集锁定 radio
Band	Adapter 选择
Encryption	WPA2-PSK / WPA2-Enterprise / WPA3-SAE / Open / WEP
PMF (Protected Management Frames)	deauth 是否有效
RSSI	位置规划
Beacon interval / TIM	针对 evil-twin defender 的 anomaly detection
Vendor (OUI)	可能的 default credential、已知 bug
Client list (MACs + RSSI)	deauth/relay 的目标
WPS enabled?	Pixie Dust 候选目标

Detection Considerations

检测注意事项

A defender's WIDS sees:

New device entering the airspace (probe requests reveal even before association)
Channel hopping patterns of monitor-mode interfaces
Non-standard probe behavior (KARMA-style universal responses, see
```
offensive-evil-twin
```
)

Pure passive recon (no probes from your radio) is invisible to most WIDS deployments. Stay passive until you're committed to the active phase.

防御方的 WIDS 可以看到：

新设备进入 airspace（probe request 甚至会在 association 前暴露设备）
Monitor-mode interface 的 channel-hopping pattern
非标准 probe 行为（KARMA-style universal response，参见
```
offensive-evil-twin
```
）

纯被动 recon（radio 不发送 probe）对大多数 WIDS 部署而言不可见。在确定进入主动阶段之前，请保持被动。

Engagement Cheatsheet

Engagement 速查表

bash

undefined

bash

undefined

1. Setup

sudo airmon-ng check kill && sudo airmon-ng start wlan0 sudo iw reg set US sudo aireplay-ng --test wlan0mon # confirm injection (skip if pure passive)

2. Sweep all bands, write to file

sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv

3. Kismet for sustained map (optional)

sudo kismet -c wlan0mon --no-ncurses --daemonize

4. Per BSSID drill-down

sudo airodump-ng -c <ch> --bssid <BSSID> -w <name> wlan0mon

5. Build target list with all fields above

---

---

Key References

主要参考资料

IEEE 802.11-2020 (combined spec)
aircrack-ng documentation: aircrack-ng.org
Kismet documentation: kismetwireless.net
WIGLE: wigle.net (read the API ToS before automated submissions)
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

IEEE 802.11-2020（合并版规范）
aircrack-ng 文档：aircrack-ng.org
Kismet 文档：kismetwireless.net
WIGLE：wigle.net（自动提交前请阅读 API ToS）
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

offensive-wifi-recon

Original

Translation

Wi-Fi Reconnaissance

Wi-Fi Reconnaissance

Quick Workflow

快速工作流

Adapter Selection

Adapter 选择

Identify your radio

Identify your radio

Monitor Mode Setup

Monitor Mode 配置

Kill conflicting services

Kill conflicting services

Enable monitor mode

Enable monitor mode

Or manually

Or manually

Verify monitor mode + injection

Verify monitor mode + injection

Regulatory Domain

Regulatory Domain

Check current

Check current

Set explicitly (us = United States, jp = Japan extended, etc.)

Set explicitly (us = United States, jp = Japan extended, etc.)

Passive Multi-Band Sweep

被动多频段扫描

All bands

All bands

5 GHz only (helps see UNII bands)

5 GHz only (helps see UNII bands)

6 GHz (requires 6E-capable adapter and updated airodump-ng)

6 GHz (requires 6E-capable adapter and updated airodump-ng)

Hop only specific channels

Hop only specific channels

Targeted Capture

定向采集

Hidden SSIDs

Hidden SSID

Wait for legitimate client to associate, ESSID appears in airodump output

Wait for legitimate client to associate, ESSID appears in airodump output

Or, if a client is already associated, deauth them once to force reassociation:

Or, if a client is already associated, deauth them once to force reassociation:

Kismet for War-Driving

用于 War-Driving 的 Kismet

Open https://localhost:2501 for the dashboard

Open https://localhost:2501 for the dashboard

Wigle Submission

Wigle 提交

Export Kismet's .kismet → CSV → Wigle import format

Export Kismet's .kismet → CSV → Wigle import format

Vendor / OUI Identification

Vendor / OUI 识别

Quick OUI lookup

Quick OUI lookup

Or check the airodump CSV's BSSID prefix against /usr/share/wireshark/manuf

Or check the airodump CSV's BSSID prefix against /usr/share/wireshark/manuf

Data to Record per Target

每个目标需记录的数据

Detection Considerations

检测注意事项

Engagement Cheatsheet

Engagement 速查表

1. Setup

1. Setup

2. Sweep all bands, write to file

2. Sweep all bands, write to file

3. Kismet for sustained map (optional)

3. Kismet for sustained map (optional)

4. Per BSSID drill-down

4. Per BSSID drill-down

5. Build target list with all fields above

5. Build target list with all fields above

Key References

主要参考资料