mmusket33
Turns out RSN=WPA2, so if AP has only WPA2 enabled, there won't be WPA section in iw scan.
HT operation (and hence primary channel) only present for 802.11n APs, so your script fails to determine channel for b/g-only APs. Use "DS Parameter set: channel" instead.
I rewrote the part of script parsing iw scan to handle the above as well as hidden ssids. If you want to try replace the code in prepare_fn() between
and
Code:
numi1=$number1 # important for the loop
with this
Code:
# Insert newline at the beginning of file
awk 'BEGIN {print "\n"} {print}' /tmp/HANDTEST/iwscan01.txt > /tmp/HANDTEST/iwscan02.txt
# Make one line per AP, replace newlines with tabs, put tab after BSSID
awk 'BEGIN {RS="\nBSS "} NR>1 {gsub(/\n/,"\t"); gsub(/\(on /,"\t"); print}' /tmp/HANDTEST/iwscan02.txt > /tmp/HANDTEST/iwscan03.txt
# Remove non WPA APs
awk '/(WPA:|RSN:)/' /tmp/HANDTEST/iwscan03.txt > /tmp/HANDTEST/iwscan04.txt
# Make a CSV file consisting of BSSID (capitalized), Channel and SSID
sed -r 's/([^\t]*).*SSID: ([^\t]*).*DS Parameter set: channel ([^\t]*).*/\U\1\E,\3,\2/
# Replace spaces with undescores (in SSIDs)
s/ /_/g
# Replace empty SSIDs with [hidden]
s/(,$)/,[hidden]/' /tmp/HANDTEST/iwscan04.txt > /tmp/HANDTEST/iwscan05.txt
# Sort by SSID descending
sort -t, -k3 -r /tmp/HANDTEST/iwscan05.txt > /tmp/HANDTEST/iwscan06.txt
SSIDS=$(awk -F, '{print $3}' /tmp/HANDTEST/iwscan06.txt)
BSSIDS=$(awk -F, '{print $1}' /tmp/HANDTEST/iwscan06.txt)
CHANN=$(awk -F, '{print $2}' /tmp/HANDTEST/iwscan06.txt)
number1=$(wc -l <<< "$SSIDS")
number2=$(wc -l <<< "$BSSIDS")
number3=$(wc -l <<< "$CHANN")
I'm sure the code can be further shortened with some elaborate awk or sed processing, but I didn't want to invest more time in learning them 
I also added these lines to save scan results to /root/scans folder
Code:
if [ ! -d "/root/scans" ]; then mkdir -m 700 /root/scans; fi
TS=$(date +%y%m%d-%H%M)
cp -f /tmp/HANDTEST/iwscan01.txt /root/scans/hsh-$TS.txt
cp -f /tmp/HANDTEST/iwscan06.txt /root/scans/hsh-$TS.csv
Feel free to use this in your next release.
Airodump still lists more WPA APs than iw scan, but I'm not actually sure whether it's practical to include those extra APs. They are remote with weak signal and may not hear our injections. And I think for this reason script doesn't work on all WPA APs - as it might be that rapidly incrementing numbers in airodump window do not necessarily mean injections reach the AP under attack.
And I suggest you google for "Useless use of echo" and "Useless use of cat award"
Also found another small bug - this line
Code:
echo "[+] Checking /root/HANDSHAKEHOLD for $bssid.cap files."
should be
Code:
echo "[+] Checking /root/HANDSHAKEHOLD for $macadd.cap files."
otherwise it always prints bssid of previous AP
