```text
███████╗██╗███╗ ██╗ █████╗ ██╗ ██╗ ██╗ ~ finally ~
██╔════╝██║████╗ ██║██╔══██╗██║ ╚██╗ ██╔╝ dual-radio lab
█████╗ ██║██╔██╗ ██║███████║██║ ╚████╔╝ aircrack-ng tmux
██╔══╝ ██║██║╚██╗██║██╔══██║██║ ╚██╔╝ hc22000 · no hashcat
██║ ██║██║ ╚████║██║ ██║███████╗ ██║
╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝ ╚═╝
```
**`// capture · deauth · convert · print hashcat cmd`**
LAB / AUTHORIZED ENVIRONMENTS ONLY · MT7612U + RTL8812AU
---
## `$ whoami`
**`finally`** is a single entrypoint: **`./start.sh`**. It flips two interfaces into monitor mode, opens a **tmux** lab console (live **airodump-ng** + automated **aireplay-ng** cycle), dumps raw **`.cap`** under `out//`, then runs **`hcxpcapngtool`** to produce **one** merged **`handshakes.hc22000`** and prints the exact **`hashcat -m 22000`** line — it does **not** invoke hashcat.
📡 threat model (what this is / isn’t)
| In scope | Out of scope |
|----------|--------------|
| Campus pen-test labs with written scope | Anything outside explicit authorization |
| Pair of dedicated USB adapters | Running hashcat for you |
| Clean teardown → managed mode | Teaching OPSEC or evasion |
---
## `$ ./quickstart`
```bash
# from repo root — will sudo itself
chmod +x start.sh
./start.sh
```
**Inside tmux**, quit cleanly:
```text
Ctrl+b # prefix
& # kill-window (confirm y)
```
**Detached** instead of killed? Session keeps running on the radios. See [HOW_IT_WORKS.md](./HOW_IT_WORKS.md) for recovery / manual `airmon-ng stop`.
---
## `$ ls -la stack`
| Layer | Tooling |
|-------|---------|
| **Capture** | `airodump-ng` · channel hop · `CAPTURE_IFACE` → monitor |
| **Attack** | `aireplay-ng` · scan CSV · targeted / broadcast deauth |
| **Convert** | `hcxpcapngtool` → `*.hc22000` + ESSID hint wordlist |
| **Shell** | `bash` · `tmux` · `airmon-ng` · `iw` |
**Target hardware (defaults)**
| Radio | Default iface | Typical dongle |
|-------|---------------|----------------|
| Record / hop | `wlan0` | MediaTek **MT7612U** |
| Scan / deauth | `wlan1` | Realtek **RTL8812AU** |
---
## `$ export THINGS`
| Variable | Default | Role |
|----------|---------|------|
| `CAPTURE_IFACE` | `wlan0` | Physical name before monitor |
| `ATTACK_IFACE` | `wlan1` | Physical name before monitor |
| `IGNORE_SSID` | `thetempleofdoom` | Skip AP rows containing substring |
| `CAPTURE_BAND` | `abg` | `a` / `bg` / `abg` for airodump |
| `SCAN_SECONDS` | `6` | Per-scan dwell |
| `DEAUTH_COUNT` | `18` | Frames per burst |
| `ATTACK_DELAY` | `0.15` | Pace between bursts (seconds) |
| `SESSION_DIR` | `out/` | Artifacts |
| `TMUX_SESSION` | `finally` | Session name |
---
## `$ tree out`
```text
out/20260329_143022/
├── chamber-01.cap # raw capture (rolling)
├── handshakes.hc22000 # hashcat -m 22000
├── essids_from_capture.txt # ESSID hints from conversion
├── .cap.sh # tmux top pane launcher
└── .atk.sh # tmux bottom pane launcher
```
---
## `$ man thoroughly`
Full sequence diagrams and cleanup rules → **[HOW_IT_WORKS.md](./HOW_IT_WORKS.md)**
---
## `$ legal`
> **Authorized access only.** Running deauthentication or passive capture against networks you do not own or have **explicit written permission** to test is illegal in many jurisdictions. This repository is for **education** and **licensed security assessments** (e.g. school lab with scope). The authors assume no liability for misuse.
```text
Monitor mode + airmon-ng check kill can nuke local Wi-Fi (NetworkManager).
Prefer SSH over Ethernet or a dedicated attack box so you don’t lock yourself out.
```
---
~ red team hygiene: scope · logging · teardown · hashcat on your own box ~