Purpose Capture WPA/WPA2 handshakes, force re-auth, and crack PSKs Subtopics • Monitor mode: airmon-ng start/stop • Discovery & capture: airodump-ng, targeted BSSID/channel capture • Deauthentication: aireplay-ng --deauth to force handshake • Crack: aircrack-ng (wordlist) and hcxpcaptool → hashcat -m 22000 (PMKID/hccapx) • Custom wordlists with Crunch, GPU vs CPU cracking tradeoffs