offensive-krack-fragattacks

Name: offensive-krack-fragattacks
Author: SnailSploit

2.8kstars447forks

How to install offensive-krack-fragattacks?

snailsploit/claude-red/offensive-krack-fragattacks

$npx -y skills add SnailSploit/Claude-Red --skill offensive-krack-fragattacks

Installs into the current project.

Summary

KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unp

Files · 1

View on GitHub

SKILL.md

1	# KRACK & FragAttacks
2
3	Two attack families against WPA2 client implementations. Both well-disclosed (KRACK 2017, FragAttacks 2021) and largely patched on modern OSes — but the embedded/IoT long tail keeps them in scope for many engagements.
4
5	## When These Apply
6
7	\| Family \| Target \| Patch Status \|
8	\|---\|---\|---\|
9	\| KRACK \| WPA2 supplicants in 4-way handshake / GTK / FT / TDLS \| Major OSes patched 2017–2018 \|
10	\| FragAttacks \| Frame fragmentation/aggregation across WPA2/3 \| Most stacks patched 2021–2022 \|
11
12	Probability of success today is high only against:
13	- Embedded OEM devices (cameras, sensors, point-of-sale)
14	- Old Android phones (<8 unpatched)
15	- Industrial / SCADA Wi-Fi clients
16	- Wi-Fi-enabled toys, smart bulbs, no-name IoT
17
18	Modern Win11 / iOS 16+ / Android 13+ / hostapd-2.10 are mitigated.
19
20	## KRACK — Key Reinstallation
21
22	The 4-way handshake's M3 retransmission causes the supplicant to reinstall the same PTK with reset nonce/replay counters. Frames encrypted under the reused keystream become decryptable.
23
24	```bash
25	# Vanhoef's official test scripts
26	git clone https://github.com/vanhoefm/krackattacks-scripts
27	cd krackattacks-scripts/krackattack
28	sudo ./krack-test-client.py --interface wlan0
29	# Tests the supplicant on a connected client
30	```
31
32	Output identifies which CVE variants the client is vulnerable to.
33
34	### Practical Outcomes
35
36	When successful:
37	- Decryption of WPA2-encrypted frames between client and AP
38	- TKIP downgrade enables packet injection
39	- Recovery of session keys for the duration of the affected key cycle
40
41	Not a PSK recovery — you don't get the wireless password from KRACK.
42
43	## FragAttacks — Frame Splicing
44
45	FragAttacks abuse 802.11 fragmentation and aggregation to inject frames that mix encrypted and plaintext fragments, or to splice attacker-controlled fragments into legitimate frames.
46
47	```bash
48	git clone https://github.com/vanhoefm/fragattacks
49	cd fragattacks
50	sudo ./test-fragattacks.py wlan0 --interface wlan0
51	# Suite of ~12 tests covering each variant
52	```
53
54	\| CVE \| Mechanism \|
55	\|---\|---\|
56	\| CVE-2020-24588 \| A-MSDU spoofing — inject crafted A-MSDU subframes \|
57	\| CVE-2020-24587 \| Mixed-key fragment cache poisoning \|
58	\| CVE-2020-24586 \| Decoupled fragment cache → reuse \|
59	\| CVE-2020-26139 \| Forwarding plaintext frames before authentication \|
60	\| CVE-2020-26140 \| Accepting plaintext frames in protected network \|
61
62	### Practical Outcomes
63
64	- Inject malicious frames that the client treats as legitimate (HTTP redirect, DNS poison)
65	- Read decrypted fragments from cached state
66	- Cross-protect data exfil via crafted A-MSDU
67
68	## Targeting Workflow
69
70	1. Identify the in-scope client (MAC, OS, vendor)
71	2. Estimate patch likelihood — if modern OS, likely patched; if embedded, likely vulnerable
72	3. Run the test suite from a controlled AP setup
73	4. Report each vulnerable variant separately with the matching CVE
74
75	```bash
76	# Rogue AP that drives the test
77	sudo hostapd-mana /tmp/krack_test_ap.conf
78
79	# Force client to associate (deauth from real AP, or social-engineer)
80	sudo aireplay-ng --deauth 5 -a <real-BSSID> -c <client-MAC> wlan0mon
81
82	# Run test once associated
83	sudo ./krack-test-client.py --interface wlan0
84	```
85
86	## Detection
87
88	- WIPS may flag deauth-driven roams to attacker AP
89	- Test scripts generate distinctive frame patterns; modern WIPS recognizes Vanhoef's tooling
90	- Successful exploitation is essentially silent at protocol level
91
92	## Reporting
93
94	For each vulnerable CVE:
95
96	- Client model + firmware version (be specific)
97	- Variant tested + result (vulnerable / patched / partial)
98	- Practical impact in the engagement context (decryption only, or injection viable?)
99	- Remediation: vendor patch URL, mitigation (WPA3 + PMF blocks most)
100
101	---
102
103	## Key References
104
105	- KRACK: krackattacks.com (Vanhoef)
106	- FragAttacks: fragattacks.com (Vanhoef)
107	- Original papers: USENIX Security 2017 (KRACK), USENIX Security 2021 (FragAttacks)
108	- CISA advisories tracking embedded vendor patches
109	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

People who liked this also viewed

6 picks

Type

offensive-krack-fragattacks

2.8kstars447forks

View on GitHub

How to install offensive-krack-fragattacks?

snailsploit/claude-red/offensive-krack-fragattacks

$npx -y skills add SnailSploit/Claude-Red --skill offensive-krack-fragattacks

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# KRACK & FragAttacks
2
3	Two attack families against WPA2 client implementations. Both well-disclosed (KRACK 2017, FragAttacks 2021) and largely patched on modern OSes — but the embedded/IoT long tail keeps them in scope for many engagements.
4
5	## When These Apply
6
7	\| Family \| Target \| Patch Status \|
8	\|---\|---\|---\|
9	\| KRACK \| WPA2 supplicants in 4-way handshake / GTK / FT / TDLS \| Major OSes patched 2017–2018 \|
10	\| FragAttacks \| Frame fragmentation/aggregation across WPA2/3 \| Most stacks patched 2021–2022 \|
11
12	Probability of success today is high only against:
13	- Embedded OEM devices (cameras, sensors, point-of-sale)
14	- Old Android phones (<8 unpatched)
15	- Industrial / SCADA Wi-Fi clients
16	- Wi-Fi-enabled toys, smart bulbs, no-name IoT
17
18	Modern Win11 / iOS 16+ / Android 13+ / hostapd-2.10 are mitigated.
19
20	## KRACK — Key Reinstallation
21
22	The 4-way handshake's M3 retransmission causes the supplicant to reinstall the same PTK with reset nonce/replay counters. Frames encrypted under the reused keystream become decryptable.
23
24	```bash
25	# Vanhoef's official test scripts
26	git clone https://github.com/vanhoefm/krackattacks-scripts
27	cd krackattacks-scripts/krackattack
28	sudo ./krack-test-client.py --interface wlan0
29	# Tests the supplicant on a connected client
30	```
31
32	Output identifies which CVE variants the client is vulnerable to.
33
34	### Practical Outcomes
35
36	When successful:
37	- Decryption of WPA2-encrypted frames between client and AP
38	- TKIP downgrade enables packet injection
39	- Recovery of session keys for the duration of the affected key cycle
40
41	Not a PSK recovery — you don't get the wireless password from KRACK.
42
43	## FragAttacks — Frame Splicing
44
45	FragAttacks abuse 802.11 fragmentation and aggregation to inject frames that mix encrypted and plaintext fragments, or to splice attacker-controlled fragments into legitimate frames.
46
47	```bash
48	git clone https://github.com/vanhoefm/fragattacks
49	cd fragattacks
50	sudo ./test-fragattacks.py wlan0 --interface wlan0
51	# Suite of ~12 tests covering each variant
52	```
53
54	\| CVE \| Mechanism \|
55	\|---\|---\|
56	\| CVE-2020-24588 \| A-MSDU spoofing — inject crafted A-MSDU subframes \|
57	\| CVE-2020-24587 \| Mixed-key fragment cache poisoning \|
58	\| CVE-2020-24586 \| Decoupled fragment cache → reuse \|
59	\| CVE-2020-26139 \| Forwarding plaintext frames before authentication \|
60	\| CVE-2020-26140 \| Accepting plaintext frames in protected network \|
61
62	### Practical Outcomes
63
64	- Inject malicious frames that the client treats as legitimate (HTTP redirect, DNS poison)
65	- Read decrypted fragments from cached state
66	- Cross-protect data exfil via crafted A-MSDU
67
68	## Targeting Workflow
69
70	1. Identify the in-scope client (MAC, OS, vendor)
71	2. Estimate patch likelihood — if modern OS, likely patched; if embedded, likely vulnerable
72	3. Run the test suite from a controlled AP setup
73	4. Report each vulnerable variant separately with the matching CVE
74
75	```bash
76	# Rogue AP that drives the test
77	sudo hostapd-mana /tmp/krack_test_ap.conf
78
79	# Force client to associate (deauth from real AP, or social-engineer)
80	sudo aireplay-ng --deauth 5 -a <real-BSSID> -c <client-MAC> wlan0mon
81
82	# Run test once associated
83	sudo ./krack-test-client.py --interface wlan0
84	```
85
86	## Detection
87
88	- WIPS may flag deauth-driven roams to attacker AP
89	- Test scripts generate distinctive frame patterns; modern WIPS recognizes Vanhoef's tooling
90	- Successful exploitation is essentially silent at protocol level
91
92	## Reporting
93
94	For each vulnerable CVE:
95
96	- Client model + firmware version (be specific)
97	- Variant tested + result (vulnerable / patched / partial)
98	- Practical impact in the engagement context (decryption only, or injection viable?)
99	- Remediation: vendor patch URL, mitigation (WPA3 + PMF blocks most)
100
101	---
102
103	## Key References
104
105	- KRACK: krackattacks.com (Vanhoef)
106	- FragAttacks: fragattacks.com (Vanhoef)
107	- Original papers: USENIX Security 2017 (KRACK), USENIX Security 2021 (FragAttacks)
108	- CISA advisories tracking embedded vendor patches
109	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

People who liked this also viewed

6 picks

Type