If their using WPA, Use same steps as WEP to find bssid of AP, channel, clients connecting, and spoof mac address if needed, then: airodump-ng mon0 -c channel -t wpa -d bssid -w log crtl+shift+t aireplay-ng -0 50 -a bssid -c clientmac mon //this one may have to be ran several times, and number 50 adjusted along the way since it's deauthing connected devices, and airodump is attempting to record the handshake. If you continually deauth them then they can't connect, but sending a few deauths may not be seen. watch first terminal until airodump shows a wpa handshake captured, then kill both processes. aircrack-ng log-01.cap -J crackme If your computer sucks you can use aircrack with some wordlists against log-01.cap, or throw the crackme file against oclhashcat-plus (GPU based). Two AMD HD 6990 results in 350,000 keys tested per second. Brute forcing the min 8 characters doesn't very long. Then throw in wordlists and rules, and the only thing between them and the router is a strong password.