□ iwconfig / airmon-ng enter monitor mode (authorized environment)
□ airodump-ng lock onto target BSSID channel
□ Handshake or PMKID capture (target only)
□ hashcat/aircrack offline password policy assessment
□ Report: Encryption type, isolation, portal bypass, recommendations