aircrack-ng / mdk4

MDK4
GNU General Public License v3.0
639 stars 113 forks source link

The channel hopping option needs to be rewritten #80

Open minanagehsalalma opened 2 years ago

minanagehsalalma commented 2 years ago

Mdk4 wlan0 d -B mac -c 10

Works just great when specifying the channel

but without specifying it , the deauth barely works , it almost like it's not running

So i am suggesting , why wouldn't there be an argument , when used it does the channel hopping this Way

That way MDK4 won't need to be hopping channels all the time disrupting the deauth making it very very inefficient

Fluxion too the oldest known & forked evil twin tool , does channel hopping only with two adapters and instead of one running deauth and one running FAKE AP They made one adapter run BOTH while the second look and monitor for AP channel change then provide mdk with the new channel if changed , They obviously did it this way because they Found it not performing as it should through tests when used the built in channel hopping way

fluxion_target_tracker_daemon() {timeout --preserve-status $monitorTimeout airodump-ng -aw "$capturePath" \
      -d "$FluxionTargetMAC" $FluxionTargetTrackerInterface &> /dev/null

    if [ "$targetChannel" -ne "$FluxionTargetChannel" ]; then
      echo "[T-Tracker] Target channel change detected!"
      FluxionTargetChannel=$targetChannel
      break

  echo "$FluxionTargetChannel" >> "$FLUXIONWorkspacePath/target_info.txt"

And Another famous tool like airgeddon Created channel hopping in another method using mdk because they found it very inefficient too Even that they ran mdk on one adapter and fake AP on another , they still didn't use the regular mdk channel hopping

while hopping, the DoS is not effective , but when it hits the right channel it is deauthing again for a while. then the client could reconnect, but is disconnected again in some seconds when the hopping hits the channel again

${mdk_command} ${interface_pursuit_mode_deauth} d -b ${tmpdir}bl.txt -c ${channel}" "${1} (DoS Pursuit mode)"
    sleep ${dos_delay}
    airodump-ng -w "${tmpdir}dos_pm" "${interface_pursuit_mode_scan}" --band "${airodump_band_modifier}" > /dev/null 2>&1 &
    dos_pursuit_mode_scan_pid=$!
    dos_pursuit_mode_pids+=("${dos_pursuit_mode_scan_pid}")

pid_control_pursuit_mode() {

    if [[ -n "${2}" ]] && [[ "${2}" = "evil_twin" ]]; then
        rm -rf "${tmpdir}${channelfile}" > /dev/null 2>&1
        echo "${channel}" > "${tmpdir}${channelfile}"
    fi

    while true; do
        sleep 5
        if grep "${bssid}" "${tmpdir}dos_pm-01.csv" > /dev/null 2>&1; then
            readarray -t DOS_PM_LINES_TO_PARSE < <(cat < "${tmpdir}dos_pm-01.csv" 2> /dev/null)

            for item in "${DOS_PM_LINES_TO_PARSE[@]}"; do
                if [[ "${item}" =~ ${bssid} ]]; then
                    dos_pm_current_channel=$(echo "${item}" | awk -F "," '{print $4}' | sed 's/^[ ^t]*//')

                    if [[ "${dos_pm_current_channel}" =~ ^([0-9]+)$ ]] && [[ "${BASH_REMATCH[1]}" -ne 0 ]] && [[ "${BASH_REMATCH[1]}" -ne "${channel}" ]]; then
                        channel="${dos_pm_current_channel}"
                        if [[ -n "${2}" ]] && [[ "${2}" = "evil_twin" ]]; then
                            rm -rf "${tmpdir}${channelfile}" > /dev/null 2>&1
                            echo "${channel}" > "${tmpdir}${channelfile}"
                        fi
                        kill_dos_pursuit_mode_processes
                        dos_pursuit_mode_pids=()
                        launch_dos_pursuit_mode_attack "${1}" "relaunch"

I been struggling with this problem for years , but i noticed that others did too , and have came up with cleaver fixes to the problem

So i thought why don't i got to the root of the problem , And maybe it would be fixed from there and That would the Real Win

Thanks a lot , and Hope you are doing great

Ps. it's not my first feature suggestion here , Hope this gets accepted as the others Regards

E7mer commented 2 years ago

Thank a lot for your suggestion. The efficiency problem of channel frequency hopping does exist, which is why I haven't added the automatic frequency hopping of 5G. I will seriously consider your suggestion and improve the efficiency of this feature.

minanagehsalalma commented 2 years ago

I will seriously consider your suggestion and improve the efficiency of this feature.

@E7mer Thanks a lot for your work mate

You are doing a great work : )

WaGi-Coding commented 1 year ago

I will seriously consider your suggestion and improve the efficiency of this feature.

Did you pushed out patches for that since this convo?