███████╗██╗███╗ ██╗ █████╗ ██╗ ██╗ ██╗ ~ finally ~
██╔════╝██║████╗ ██║██╔══██╗██║ ╚██╗ ██╔╝ dual-radio lab
█████╗ ██║██╔██╗ ██║███████║██║ ╚████╔╝ aircrack-ng tmux
██╔══╝ ██║██║╚██╗██║██╔══██║██║ ╚██╔╝ hc22000 · no hashcat
██║ ██║██║ ╚████║██║ ██║███████╗ ██║
╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝ ╚═╝
// capture · deauth · convert · print hashcat cmd
LAB / AUTHORIZED ENVIRONMENTS ONLY · MT7612U + RTL8812AU
$ whoami
finally is a single entrypoint: ./start.sh. It flips two interfaces into monitor mode, opens a tmux lab console (live airodump-ng + automated aireplay-ng cycle), dumps raw .cap under out/<timestamp>/, then runs hcxpcapngtool to produce one merged handshakes.hc22000 and prints the exact hashcat -m 22000 line — it does not invoke hashcat.
📡 threat model (what this is / isn’t)
| In scope | Out of scope |
|---|---|
| Campus pen-test labs with written scope | Anything outside explicit authorization |
| Pair of dedicated USB adapters | Running hashcat for you |
| Clean teardown → managed mode | Teaching OPSEC or evasion |
$ ./quickstart
# from repo root — will sudo itself
chmod +x start.sh
./start.sh
Inside tmux, quit cleanly:
Ctrl+b # prefix
& # kill-window (confirm y)
Detached instead of killed? Session keeps running on the radios. See HOW_IT_WORKS.md for recovery / manual airmon-ng stop.
$ ls -la stack
| Layer | Tooling |
|---|---|
| Capture | airodump-ng · channel hop · CAPTURE_IFACE → monitor |
| Attack | aireplay-ng · scan CSV · targeted / broadcast deauth |
| Convert | hcxpcapngtool → *.hc22000 + ESSID hint wordlist |
| Shell | bash · tmux · airmon-ng · iw |
Target hardware (defaults)
| Radio | Default iface | Typical dongle |
|---|---|---|
| Record / hop | wlan0 |
MediaTek MT7612U |
| Scan / deauth | wlan1 |
Realtek RTL8812AU |
$ export THINGS
| Variable | Default | Role |
|---|---|---|
CAPTURE_IFACE |
wlan0 |
Physical name before monitor |
ATTACK_IFACE |
wlan1 |
Physical name before monitor |
IGNORE_SSID |
thetempleofdoom |
Skip AP rows containing substring |
CAPTURE_BAND |
abg |
a / bg / abg for airodump |
SCAN_SECONDS |
6 |
Per-scan dwell |
DEAUTH_COUNT |
18 |
Frames per burst |
ATTACK_DELAY |
0.15 |
Pace between bursts (seconds) |
SESSION_DIR |
out/<timestamp> |
Artifacts |
TMUX_SESSION |
finally |
Session name |
$ tree out
out/20260329_143022/
├── chamber-01.cap # raw capture (rolling)
├── handshakes.hc22000 # hashcat -m 22000
├── essids_from_capture.txt # ESSID hints from conversion
├── .cap.sh # tmux top pane launcher
└── .atk.sh # tmux bottom pane launcher
$ man thoroughly
Full sequence diagrams and cleanup rules → HOW_IT_WORKS.md
$ legal
Authorized access only. Running deauthentication or passive capture against networks you do not own or have explicit written permission to test is illegal in many jurisdictions. This repository is for education and licensed security assessments (e.g. school lab with scope). The authors assume no liability for misuse.
Monitor mode + airmon-ng check kill can nuke local Wi-Fi (NetworkManager).
Prefer SSH over Ethernet or a dedicated attack box so you don’t lock yourself out.
~ red team hygiene: scope · logging · teardown · hashcat on your own box ~