diff --git a/routes/wifi.py b/routes/wifi.py
index 7abe886..ac6e557 100644
--- a/routes/wifi.py
+++ b/routes/wifi.py
@@ -16,7 +16,7 @@ from typing import Any, Generator
 from flask import Blueprint, jsonify, request, Response
 
 import app as app_module
-from utils.dependencies import check_tool
+from utils.dependencies import check_tool, get_tool_path
 from utils.logging import wifi_logger as logger
 from utils.process import is_valid_mac, is_valid_channel
 from utils.validation import validate_wifi_channel, validate_mac_address
@@ -345,10 +345,11 @@ def toggle_monitor_mode():
                 interfaces_before = get_wireless_interfaces()
 
                 kill_processes = data.get('kill_processes', False)
+                airmon_path = get_tool_path('airmon-ng')
                 if kill_processes:
-                    subprocess.run(['airmon-ng', 'check', 'kill'], capture_output=True, timeout=10)
+                    subprocess.run([airmon_path, 'check', 'kill'], capture_output=True, timeout=10)
 
-                result = subprocess.run(['airmon-ng', 'start', interface],
+                result = subprocess.run([airmon_path, 'start', interface],
                                         capture_output=True, text=True, timeout=15)
 
                 output = result.stdout + result.stderr
@@ -429,7 +430,8 @@ def toggle_monitor_mode():
     else:  # stop
         if check_tool('airmon-ng'):
             try:
-                subprocess.run(['airmon-ng', 'stop', app_module.wifi_monitor_interface or interface],
+                airmon_path = get_tool_path('airmon-ng')
+                subprocess.run([airmon_path, 'stop', app_module.wifi_monitor_interface or interface],
                                capture_output=True, text=True, timeout=15)
                 app_module.wifi_monitor_interface = None
                 return jsonify({'status': 'success', 'message': 'Monitor mode disabled'})
@@ -480,8 +482,9 @@ def start_wifi_scan():
             except OSError:
                 pass
 
+        airodump_path = get_tool_path('airodump-ng')
         cmd = [
-            'airodump-ng',
+            airodump_path,
             '-w', csv_path,
             '--output-format', 'csv,pcap',
             '--band', band,
@@ -579,8 +582,9 @@ def send_deauth():
         return jsonify({'status': 'error', 'message': 'aireplay-ng not found'})
 
     try:
+        aireplay_path = get_tool_path('aireplay-ng')
         cmd = [
-            'aireplay-ng',
+            aireplay_path,
             '--deauth', str(count),
             '-a', target_bssid,
             '-c', target_client,
@@ -625,8 +629,9 @@ def capture_handshake():
 
         capture_path = f'/tmp/intercept_handshake_{target_bssid.replace(":", "")}'
 
+        airodump_path = get_tool_path('airodump-ng')
         cmd = [
-            'airodump-ng',
+            airodump_path,
             '-c', str(channel),
             '--bssid', target_bssid,
             '-w', capture_path,
@@ -664,14 +669,16 @@ def check_handshake_status():
 
     try:
         if target_bssid and is_valid_mac(target_bssid):
-            result = subprocess.run(
-                ['aircrack-ng', '-a', '2', '-b', target_bssid, capture_file],
-                capture_output=True, text=True, timeout=10
-            )
-            output = result.stdout + result.stderr
-            if '1 handshake' in output or ('handshake' in output.lower() and 'wpa' in output.lower()):
-                if '0 handshake' not in output:
-                    handshake_found = True
+            aircrack_path = get_tool_path('aircrack-ng')
+            if aircrack_path:
+                result = subprocess.run(
+                    [aircrack_path, '-a', '2', '-b', target_bssid, capture_file],
+                    capture_output=True, text=True, timeout=10
+                )
+                output = result.stdout + result.stderr
+                if '1 handshake' in output or ('handshake' in output.lower() and 'wpa' in output.lower()):
+                    if '0 handshake' not in output:
+                        handshake_found = True
     except subprocess.TimeoutExpired:
         pass
     except Exception as e:
diff --git a/setup.sh b/setup.sh
index 57e6710..6eab522 100755
--- a/setup.sh
+++ b/setup.sh
@@ -47,9 +47,9 @@ detect_os() {
     echo -e "${BLUE}Detected OS:${NC} $OS"
 }
 
-# Check if a command exists
+# Check if a command exists (also check /usr/sbin for Debian)
 check_cmd() {
-    command -v "$1" &> /dev/null
+    command -v "$1" &> /dev/null || [ -x "/usr/sbin/$1" ] || [ -x "/sbin/$1" ]
 }
 
 # Check if a package is installable (Debian)
@@ -200,6 +200,17 @@ check_tools() {
     if check_cmd aireplay-ng; then
         echo -e "  ${GREEN}✓${NC} aireplay-ng - Deauthentication (optional)"
     fi
+    # PMKID tools are optional
+    if check_cmd hcxdumptool; then
+        echo -e "  ${GREEN}✓${NC} hcxdumptool - PMKID capture (optional)"
+    else
+        echo -e "  ${YELLOW}-${NC} hcxdumptool - PMKID capture (optional)"
+    fi
+    if check_cmd hcxpcapngtool; then
+        echo -e "  ${GREEN}✓${NC} hcxpcapngtool - Hash extraction (optional)"
+    else
+        echo -e "  ${YELLOW}-${NC} hcxpcapngtool - Hash extraction (optional)"
+    fi
 
     echo ""
     echo "Bluetooth Tools:"
@@ -296,6 +307,8 @@ install_macos_tools() {
         echo -e "${BLUE}Installing WiFi tools...${NC}"
         echo "  Installing aircrack-ng..."
         brew install aircrack-ng || echo -e "${YELLOW}  Warning: aircrack-ng installation failed${NC}"
+        echo "  Installing hcxtools (PMKID capture)..."
+        brew install hcxtools || echo -e "${YELLOW}  Warning: hcxtools installation failed${NC}"
     fi
 
     echo ""
@@ -313,7 +326,7 @@ show_macos_manual() {
     echo "brew install dump1090-mutability"
     echo ""
     echo "# WiFi scanning (optional)"
-    echo "brew install aircrack-ng"
+    echo "brew install aircrack-ng hcxtools"
 }
 
 # ============================================
@@ -452,6 +465,23 @@ install_debian_tools() {
     fi
     pause
 
+    # PMKID capture tools
+    echo "  Installing hcxdumptool (PMKID capture)..."
+    if $SUDO apt-get install -y hcxdumptool; then
+        echo -e "${GREEN}  hcxdumptool installed${NC}"
+    else
+        echo -e "${YELLOW}  Warning: hcxdumptool installation failed${NC}"
+    fi
+    pause
+
+    echo "  Installing hcxtools (hash extraction)..."
+    if $SUDO apt-get install -y hcxtools; then
+        echo -e "${GREEN}  hcxtools installed${NC}"
+    else
+        echo -e "${YELLOW}  Warning: hcxtools installation failed${NC}"
+    fi
+    pause
+
     # Bluetooth tools
     echo ""
     echo -e "${BLUE}Installing Bluetooth tools...${NC}"
@@ -487,7 +517,7 @@ show_debian_manual() {
     echo "sudo apt install dump1090-mutability  # or dump1090-fa"
     echo ""
     echo "# WiFi scanning (optional)"
-    echo "sudo apt install aircrack-ng"
+    echo "sudo apt install aircrack-ng hcxdumptool hcxtools"
     echo ""
     echo "# Bluetooth scanning (optional)"
     echo "sudo apt install bluez bluetooth"
diff --git a/utils/dependencies.py b/utils/dependencies.py
index bd5625c..ec22ddd 100644
--- a/utils/dependencies.py
+++ b/utils/dependencies.py
@@ -1,15 +1,35 @@
 from __future__ import annotations
 
 import logging
+import os
 import shutil
 from typing import Any
 
 logger = logging.getLogger('intercept.dependencies')
 
+# Additional paths to search for tools (e.g., /usr/sbin on Debian)
+EXTRA_TOOL_PATHS = ['/usr/sbin', '/sbin']
+
 
 def check_tool(name: str) -> bool:
     """Check if a tool is installed."""
-    return shutil.which(name) is not None
+    return get_tool_path(name) is not None
+
+
+def get_tool_path(name: str) -> str | None:
+    """Get the full path to a tool, checking standard PATH and extra locations."""
+    # First check standard PATH
+    path = shutil.which(name)
+    if path:
+        return path
+
+    # Check additional paths (e.g., /usr/sbin for aircrack-ng on Debian)
+    for extra_path in EXTRA_TOOL_PATHS:
+        full_path = os.path.join(extra_path, name)
+        if os.path.isfile(full_path) and os.access(full_path, os.X_OK):
+            return full_path
+
+    return None
 
 
 # Comprehensive tool dependency definitions