Send disconnect packets to all networked devices Sniff the 4 way handshake when devices reconnect (eapol) Brute force crack the hash