In these next steps we will make use of oclhashcat/hashcat to crack the WPA. It is a versitile tool set and can be used with or without a wordlist.
Local knowledge. Who are you testing? What sports teams are in the area? What extreme things happen there (cold in alaska, wind in chicago, crime in LA whatever)? What nicknames does the company have.
Wpa Cracking Back Track
Is there a naming schema for employ usernames? Do they have to change their password often? I use all of these types of things with a little python to make permutations of words I think will hit. Example: If testing a bank in denver I might use the words: cash mile high broncs broncos elway cashier. And then run it through a python script that permutes with leet speek etc. EDIT: Also, permute the top few hundred pws from the Adobe leak, bring in a wordlist in another language (I add a spanish wordlist when doing targets in AZ and CA).