There are 4 ways to find oud hidden ssid:
1. Wait for a wireless client to associate with the AP. When this happens, airodump-ng will capture and display the SSID.
2. Deauthenticate with aireplay-ng an existing wireless client to force it to associate again:
aireplay-ng -0 1 -a ap_bssid -c client_mac ath0
, listen with airodump-ng
3. Use a tool mdk3 to bruteforce the SSID. (Not recoemmended)
4. You can use Wireshark combined with one or more of these filters to review data capture files. The SSID is included within these packets for the AP.
wlan.fc.type_subtype == 0 (association request)
wlan.fc.type_subtype == 4 (probe request)
wlan.fc.type_subtype == 5 (probe response)