To force a handshake (if no client is connecting naturally), the attacker can send deauthentication packets:
Modern cracking tools do not work directly on .cap files. The standard is to convert the handshake to a hccapx file (for Hashcat) or use John the Ripper’s wpapcap2john .
hashcat -m 22000 hash.hccapx wordlist.txt
Hashcat supports rule files that mutate words. For example, the rule $1 $2 $3 $4 appends "1234" to every word. Common mutations: