WebSVN – nexmon – Blame – Rev 1 – /utilities/mdk3/man/mdk3.8

Hop to channel where AP is spoofed - this makes the test more effective against some devices/drivers, but it reduces packet rate due to channel hopping

90

.TP

91

.BI -c " chan"

92

Fake an AP on channel

93

.IR chan

94

\. If you want your card to hop on this channel, you have to set -h option, too!

95

.TP

96

.BI -s " rate"

97

Set speed in packets per second to

.IR rate

(Default: 50)

.RE

.B d

- Deauthentication / Disassociation Amok Mode

104

.br

105

Kicks everybody found from AP.

.RS

.TP

.BI -w " file"

Read MACs from

.IR file

that are to be unaffected (whitelist mode)

.TP

.BI -b " file"

Read MACs from

.IR file

that are to be tested on (blacklist mode)

117

.TP

118

.BI -s " rate"

119

Set speed in packets per second to

120

.IR rate

121

(Default: infinity)

122

.TP

123

.BI -c " [chan_1,chan_2,...chan_n]"

124

Enable channel hopping. Without providing any channels, mdk3 will hop an all 14 b/g channels. The current channel will be changed every 5 seconds.

.RE

.B f

- MAC Filter Bruteforce Mode

129

.br

130

This test uses a list of known client MAC addresses and tries to authenticate them to the given AP while dynamically changing the response timeout for best performance. It currently works only on APs which deny an open authentication request properly.

.RS

.TP

.BI -t " bssid"

Target

.IR bssid

.TP

.BI -m " mac_prefix"

138

Set the MAC adress range

139

.IR mac_prefix

140

(3 bytes, e.g. 00:12:34); without -m, the internal database will be used

141

.TP

142

.BI -f " mac"

143

Begin bruteforcing with MAC address

144

.IR mac

145

(Note: -f and -m cannot be used at the same time)

.RE

.B g

- WPA Downgrade Test

150

.br

151

Deauthenticates Stations and APs sending WPA encrypted packets. With this test you can check if the sysadmin will try setting his network to WEP or disable encryption. mdk3 will let WEP and unencrypted clients work, so if the sysadmin simply thinks "WPA is broken" he sure isn't the right one for this job (this can/should be combined with social engineering).

.RS

.TP

.BI -t " bssid"

Target

.IR bssid

.RE

.B m

- Michael Shutdown Exploitation (TKIP)

161

.br

162

Cancels all traffic continuously.

.RS

.TP

.BI -t " bssid"

Target

.IR bssid

.TP

.BI -w " time"

Time

.IR time

(in seconds) between bursts (Default: 10)

173

.TP

174

.BI -n " ppb"

175

Set packets per burst

.IR ppb

(Default: 70)

.TP

.BI -j

Use the new TKIP QoS-Exploit - needs just a few packets to shut the AP down!

181

.TP

182

.BI -s " rate"

183

Set speed in packets per second to

184

.IR rate

185

(Default: infinity)

.RE

.B p

- Basic Probing and ESSID Bruteforce Mode

190

.br

191

Probes AP and check for answer, useful for checking if the SSID has been correctly decloaked or if AP is in your adaptor's sending range. Use -f and -t option to enable SSID Bruteforcing.

.RS

.TP

.BI -e " ssid"

Probe for

.IR bssid

.TP

.BI -f " file"

Read lines from

.IR file

for bruteforcing hidden SSIDs

.TP

.BI -t " bssid"

Target AP

.IR bssid

.TP

.BI -s " rate"

Set speed in packets per second to

209

.IR rate

210

(Normal Default: infinity; Bruteforce Default: 300)

211

.TP

212

.BI -b " character_set"

213

Use full Bruteforce mode based on

214

.IR character_set

215

(recommended for short SSIDs only!) - use this switch only to show its help screen

.RE

.B w

- WIDS/WIPS/WDS Confusion

220

.br

221

Confuses a WDS with multi-authenticated clients, which messes up routing tables.

.RS

.TP

.BI -e " ssid"

SSID

.IR ssid

of target WDS network

228

.TP

229

.BI -c " [chan_1,chan_2,...chan_n]"

230

Enable channel hopping.

231

.TP

232

.BI -z

233

activate Zero_Chaos' WIDS exploit (authenticates clients from a WDS to foreign APs to make WIDS go nuts)

.RE

.B x

- 802.1X tests

.RS

.RS

.TP

.BI -n " ssid"

Use SSID

.IR ssid

.TP

.BI -t " bssid"

Target AP

.IR bssid

.TP

.BI -w " WPA_type"

Set WPA type to

.IR WPA_type

(1: WPA, 2: WPA2/RSN; default: WPA)

254

.TP

255

.BI -u " unicast_cipher_type"

256

Set unicast cipher type to

257

.IR unicast_cipher_type

258

(1: TKIP, 2: CCMP; default: TKIP)

259

.TP

260

.BI -m " multicast_cipher_type"

261

Set multicast cipher type to

262

.IR multicast_cipher_type

263

(1: TKIP, 2: CCMP; default: TKIP)

264

.TP

265

.BI -s " rate"

266

Set speed in packets per second to

.IR rate

(Default: 400)

.RE

1 - EAPOL Logoff test

.RS

.TP

.BI -t " ssid"

Set target AP MAC address to

.IR ssid

.TP

.BI -c " bssid"

Set target STA MAC address to

.IR bssid

.TP

.BI -s " rate"

Set speed in packets per second to

.IR rate

(Default: 400)

.RE

.RE

.SH AUTHORS

.I mdk3

was written by Pedro Larbig (ASPj) with contributions from the aircrack-ng community: Antragon, moongray, Ace, Zero_Chaos, Hirte, thefkboss, ducttape, telek0miker, Le_Vert, sorbo, Andy Green, bahathir, Dawid Gajownik and Ruslan Nabioullin.

nexmon – Blame information for rev 1