I'd like to know if there exists at least the possibility of a known/theoretical attack on a wireless SSID that does not involve a host within the network, what I mean by this is that some of the common ways of obtaining network access requires a host as a victim either for evil twin attack type or a handshake capture by deauthenticating said host, however, I'd like to know if any of you know ways around this.

Let me explain the scenario:

• I've no physical way to reset the router and by this means, reconfigure it to service me only.
• I've already discovered the router's SSID.
• There are no hosts currently attached to the SSID's network.
• I cannot do a bruteforce attack on the possible SSID's password because the router may "tag" my MAC address and just lock me out of trying to authenticate again.

So the scenario takes out any host that we can use as a leverage for the pentest; if someone has any experiences or knowledge of what to do in this type of scenarios I'd appreciate it.