Aerial wardriving gives you a 3D signal propagation map that ground surveys can't produce. WiFi signals bleed upward through windows, roof vents, and atriums. Rooftop APs and point-to-point bridges are invisible from the parking lot but wide open from 100 meters up. This is advanced physical-layer recon and it's incredibly effective when authorized. This is a guide on how to aerial warflying / wardriving works.

Here's a guide on how to get managed into monitor mode across different network cards and operating systems.

Rogue APs are the most reliable wireless attack vector in corporate pentesting. Clients trust what they know, and they'll connect to an AP broadcasting the SSID they're looking for. Here's the full operational guide on hacking with rogue access points (APs).