So what are you going to do if your word list does not have the password?
Here is a how-to for cracking the WPA/WPA2 by brute forcing on the-fly.

First of all make sure you have your wpa handshake that you have have acquired from the AP by using the aircrack-ng suit.

We will be using Pyrit; http://code.google.com/p/pyrit/ for most of our work here.
Pyrit allows to create massive databases, pre-computing part of the WPA/WPA2-PSK authentication phase in a space-time-tradeoff. It has CUDA and Opencl support, which we can use our more powerfull and cheaper GPU that are at most 100 times faster than the CPU

Lets install the needed packages first:

Now Lets Compile the latest SVN of Pyrit:

If you have an NVidia or ATi gpu make sure you compile the extension modules as well

A good thing to do first is strip all the unnessary packets that are in the .cap file
this would make the cracking much faster if the original .cap file was large


Now we compile a program called crunch:

crunch will do an stdout, so you can pipe results into pyrit

Now we are all ready to do some cracking, so make you sure you run these next examples from the place you compiled crunch!
Examples:

This would generate every numeric combination using numbers 0-9 with a length of 8


Same as above but using lower case letters

Lets say you know the password is admin and 3 unknown numbers, so here is what you do:

so only those @' will change with every number combo

Here is an example to use all from length 8 to 63 (lol)


To bad crunch lacks the special characters (?!"#$%&'()*+,-./:;<=>?[\]^_`{|}~)
There is another alternative program called bruteforge: http://masterzorag.blogspot.com/
This program has more options, but bruteforge does NOT compute all chars combinations, it skips ahead when a condition is verified;
Get:


Examples:

This will generate a numeric string from len 8 to 9


Same as above but using lower case letters

Notes: You can compute with all characters by using the -c 6 function with bruteforge, also you use the import_passwords instead of attack_passthrough for inserting generated strings into a database you have created with pyrit
example:


Conclusion:
Well you can compute every possible combination, but it will just take time. This tutorial is just a demo, don't try this at home unless you have performance of a petaflop

some features that should be implimented:
get these generating tools to support cuda or opencl so we can actually speed up the performance if we have a large cluster of super computers, this way we will be able to pype enough data under linux
since linux is faster and better than windows

a new gpu from Nvidia should be released shortly so it should have high performance
(gt 300 core)
then we can simply use motherboards such as
http://www.evga.com/products/moreInfo.a ... otherboard
to build cheap high performace clusters which will have 4 gpus per cluster

now all we have to find is which gpu is faster and cheaper for brute forcing; ATI or Nvidia?