offensive-deauth-disassoc

# Deauth / Disassoc Attacks The most-used 802.11 management-frame attack: send a forged deauthentication or disassociation frame as the AP, and the client disconnects. Modern PMF (802.11w) authenticates these frames cryptographically — but most consumer and many enterprise deployments still don't require PMF. ## Quick Workflow 1. Identify target client + AP (BSSID, channel) 2. Pick deauth scope: single client (quiet) vs. broadcast (loud, DoS) 3. Verify PMF status — if required, classic deauth fails; pivot to action-frame attacks 4. Send the deauth burst at the right rate --- ## Single-Client Deauth (Preferred) Used to force handshake capture, push client to evil twin, or test reconnection behavior. ```bash sudo aireplay-ng --deauth 5 \ -a AA:BB:CC:DD:EE:FF \ # AP BSSID -c 11:22:33:44:55:66 \ # client MAC wlan0mon ``` - `--deauth 5` sends 5 deauths (10 frames — 5 to AP, 5 to client). 3–10 is usually enough. - More than 30 in a burst is unnecessarily noisy. ## Broadcast Deauth (DoS, Use Sparingly) ```bash # Single AP, all clients sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon # --deauth 0 = continuous # Multiple APs from a list sudo mdk4 wlan0mon d -B target_bssids.txt -c 1,6,11 ``` Only with explicit authorization. Continuous broadcast deauth is a clear DoS signal and trips most WIPS within seconds. ## PMF (802.11w) Awareness PMF authenticates deauth/disassoc frames. Status visible in beacon RSN capabilities: ```bash sudo airodump-ng wlan0...