added additional information about hcxdumptool's three attack vectors

README.md

@@ -246,7 +246,15 @@ The entire toolkit (hcxdumptool and hcxtools) is designed to be an analysis tool
 
 If you can't control the environment it is absolutely mandatory to set the [BPF](https://wiki.wireshark.org/CaptureFilters)!
 
-Everything is requested/stored by default and unwanted information must be filtered out by option/filter actively or offline.
+By default options hcxdumptool is running three attack vectors:
+
+* connect to an ACCESS POINT to get a PMKID
+
+* disconnect a CLIENT from an associated ACCESS POINT to get a complete handshake (M1M2M3M4) and a PMKID (if supported by the AP)
+
+* allow a CLIENT to connect to hcxdumptool to get a challenge (M1M2) or an EAP-ID
+
+They can be turned off using options. The BPF can be used to select a target (or multible targets) or to protect devices.
 
 You must use hcxdumptool only on networks you have permission to do this and if you know what you are doing, because: