Tried to pull out a few questions from this:
Why isn't the ESSID enough?
I'd like to point out that in many large, distributed Wi-Fi setups (think corporate or campus networks), there will be several, possibly many access points (APs) broadcasting the same ESSID in a given physical area. Each AP will have its own BSSID, since each piece of network hardware has its own MAC address. Being able to filter by BSSID allows you to focus on a single AP for attacking. Most attacks will typically target a single access point (e.g. using aireplay-ng
, you generally must target a specific BSSID).
Why must I specify the channel?
airodump-ng
is fairly low-level and barebones, and makes little-to-no assumptions about what you are trying to do with it, so it makes sense that the channel must be specified manually. Note that aireplay-ng
is capable of auto-determining the channel given a specific BSSID when launching some attacks, but this tool has a different purpose.
Setting the channel is also useful if you want to capture all of the traffic on a given channel.
Why can't I specify a dictionary file for airodump-ng
?
The main job of airodump-ng
is to capture Wi-Fi packets. It makes no assumptions about what you want to do with said captures; whether you just want to log them or are going to try and recover a network's pre-shared key (PSK). The functionality for attacking captured WPA handshakes resides in the separate aircrack-ng
tool.
How does deauth help with cracking the password?
It doesn't help with cracking the PSK. We use crafted deauthentication frames to kick devices off of the network so that they try to re-associate, thus performing the 4-way WPA handshake again. The 4-way handshake contains the information that we need in order to crack the PSK offline. Crafting deauthentication packets isn't strictly necessary to obtain the 4-way handshake; devices may (re)connect and perform the handshake on their own. In some scenarios, it may not be desirable to send deauthentication frames since it is a noisy operation and can be detected by wireless intrusion detection systems.