Cracking WPA/WPA2 handshake without Wordlist :

Cracking WPA/WPA2 handshake without Wordlist :

Hello guys, I'm not going to discuss handshakes since I guess you all are familiar with airmon, airodump and aireplay and now how to get them. 
that's about the first step in cracking WPA and the easy job. The hard job is to actually crack the WPA key from the capfile.
I was looking for a method that is full proof without actually storing a huge wordlist on your desktop (talking about lots of lots of terrabites)
so i came up with the following:

# crunch 0 25 abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWX YZ0123456789 | aircrack-ng --bssid aa:aa:aa:aa:aa:aa -w- handshakefile.cap

(notice there is a space in the command that shouldnt be there, i guess the forum can't handle 62characters word)

meaning that crunch is making a list with minimum 0 and maximum 25 characters with alfanumeric small and cap characters that are not stored in a wordlistfile.
The "|" ends the crunch command and then we go to the aircrack command:
With the bssid of the "victim" (notice you have to be authorised by the victim to do the test) and -w- wich specifies the handshake.cap file.

It took me about 30 minutes to crack the following WPA password: hickmin123 (wich is an easy password because there are no caps in the password)
However I believe its almost a fullproof method and with lots of time you are able to crack long passwords.
Now the real question...


Crunch with Pyrit together :

crunch 0 25 abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWX YZ0123456789 | pyrit -r xxx.cap -b xx:xx:xx:xx:xx:xx -i - attack_passthrough