When you're connected to a wireless access point (AP) , you usually save the password and enable auto connection when the AP is in range. When your Wi-Fi is on, it constantly searches for the saved AP's. This means that it emits some kind of beam and waits for a response. So, how can we remotely know what AP's a random Wi-Fi device is searching for? I'm a penetester and I recently started a course on wireless devices. There's a section called evil twin AP that teaches you how to clone an AP, disconnect users from the original AP and direct them to your own for mitm. But with this, the users device has to be connected to an AP before you can do this. I want to be able to do it to a random device that is not connected to an AP but has the Wi-Fi on. The only problem is how to discover the exact AP's (ssid and mac address) that are configured for auto connection.
There's a list of preferred networks (You can add networks manually o save them when you check the "Connect automatically" checkbox).
When a STA (Station/device/laptop/Smartphone) isn't connected to any AP it sends probe requests, looking for AP listed on it's PNL (Preferred network List) if any AP matches with what's on that probe request, it will replay with a probe response and the connection will start.
So, the idea on an evil twin, is to listen to this probe request (This only contain the SSID, not the encryption used) with an antennae on monitor mode, copy the SSID, start virtual access points (Obviously with the SSID you just got) with each authentication (Open, WEP, WPA and WPA2), and see on which it tries to connect. You don't need the MAC address, there's a feature on WiFi called Roaming which lets you connect to different AP (same netwok/SSID), so it's the normal scenario when there are multiple AP with different MAC address.