Beini hacking

@Newhack44

To begin, if you are using a tool or script that is searching for networks secured by WEP and you are seeing zero results is quite possible that any networks within range are not secured using WEP.

Also would probably explain why the networks you do see list as WPA/WPA2.

WEP, WPA/WPA2, ETC are the protocol being implemented by Target network device. Suggest increasing signal strength and or deploying higher dBi antenna to increase range for network discovery however WEP is far passed it EOF, may just be no networks within range using WEP. Would suggest deploying WPA/WPA2 specific techniques since those networks are being discovered. Also the distro you are using hasn't been in active development for years, updated drivers, tools, etc are important.

 

@Newhack44

Answering that question may not be as simple as 1,2,3

1st, what distro are you using or plan to use? As I stated above^ Beini has not been in active development for years.

2nd, due to your non-city setting, PMKID is most effective by proximity to target so may not be an option for you.

3rd, starting overly complex isn't always the best approach so may I suggest starting easy, hanshake capture and cracking with a wordlist, aircrack-ng as base tool, as well as many scripts and tools that use it: wifite, airgeddon, fern-wifi-cracker and run the capture against various dictionary files.

4th, if the above is no success then perhaps WPS attack, again more effective with proximity but reaver, pixiewps, bully as base tools, as well as many scripts that can use these for this attack: wifite, airgeddon, wifi-autopwner.

5th, rogue ap's or fake ap's and captive portals could be an option if all else fails, however with range and proximity to device this may not be as effective or even an option. Scripts and tools most common for this attack: airgeddon, fluxion, wifi-phisher, etc, etc. *Will most likely need a couple or even a few capture/ap/injection capable cards for this attack*

To answer your question in the simplest - possibly one, a few, or all known WPA/WPA2 attacks my have to be looked into. I would suggest looking over this forum and the many like it to get a better understanding of these techniques and the tools best suited for them. May require trying multiple tools, multiple techniques, multiple attempts with the same tools, or different devices and/or antenna used.

 

I am not trying to be lazy or pass you off, but this type of "auditing" relies on three main factors:

1.) software, tools & scripts

2.) hardware, device, device output, device chipset, antenna strength

3.) distance/proximity to target device - both horizontal and vertical

 

@Newhack44

An example of what I mean, as I have posted about in a few forums:

I use, regularly 4 or 5 different wifi cards with different chipsets for wireless auditing, in almost every case my cheap generic micro-usb card with the ralink/mediatek - mt7601u chipset is the most successful in carrying out WPS-pin attack. Core tools carrying out attack are Reaver 1.6.5 , PixieWPS 1.4.2 & Bully 1.1 - in my experience has not mattered so much the core tool as much as the device and chipset being used that made the difference for this type of attack to be successful. This attack was carried out against a local device, each time with a 3dBi , 5dBi & 9dBi antenna, going from ralink, realtek, atheros and to mediatek - every time my ralink/mediatek device was most effective for WPS technique. As @Mr. Penguin says - research, research, research - this is as much of an art as a science