{"id":13840388,"url":"https://github.com/aircrack-ng/mdk4","last_synced_at":"2025-04-12T15:33:22.852Z","repository":{"id":29115254,"uuid":"120241961","full_name":"aircrack-ng/mdk4","owner":"aircrack-ng","description":"MDK4","archived":false,"fork":false,"pushed_at":"2024-08-16T15:20:48.000Z","size":435,"stargazers_count":680,"open_issues_count":48,"forks_count":123,"subscribers_count":46,"default_branch":"master","last_synced_at":"2025-04-03T14:11:49.343Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aircrack-ng.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS","dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-02-05T01:54:04.000Z","updated_at":"2025-03-21T12:23:27.000Z","dependencies_parsed_at":"2024-08-16T16:52:24.845Z","dependency_job_id":null,"html_url":"https://github.com/aircrack-ng/mdk4","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aircrack-ng%2Fmdk4","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aircrack-ng%2Fmdk4/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aircrack-ng%2Fmdk4/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aircrack-ng%2Fmdk4/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aircrack-ng","download_url":"https://codeload.github.com/aircrack-ng/mdk4/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248589880,"owners_count":21129695,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:00:47.090Z","updated_at":"2025-04-12T15:33:22.828Z","avatar_url":"https://github.com/aircrack-ng.png","language":"C","funding_links":[],"categories":["C"],"sub_categories":[],"readme":"# MDK4\n\nMDK is a proof-of-concept tool to exploit common IEEE 802.11 protocol weaknesses.\n\n\n# About MDK4\n\nMDK4 is a new version of MDK3.\n\nMDK4 is a Wi-Fi testing tool from E7mer, ASPj of k2wrlz, it uses the osdep library from the aircrack-ng project to inject frames on several operating systems.\nMany parts of it have been contributed by the great aircrack-ng community: Antragon, moongray, Ace, Zero_Chaos, Hirte, thefkboss, ducttape, telek0miker, Le_Vert, sorbo, Andy Green, bahathir, Dawid Gajownik and Ruslan Nabioullin. THANK YOU!\n\nMDK4 is licenced under the GPLv3 or later.\n\n\n# Installation\n\t\tapt-get install pkg-config libnl-3-dev libnl-genl-3-dev libpcap-dev \n\n\t\tgit clone https://github.com/aircrack-ng/mdk4\n\t\tcd mdk4\n\t\tmake\n\t\tsudo make install\n\t\t# Using Arch Linux (and derived) append `CC=clang` after any `make` in commands. \n\n\n# Features\n\n- Supports two WiFi card (one for receiving data, another for injecting data).\n- Supports block the specified ESSID/BSSID/Station MAC in command option.\n- Supports both 2.4 to 5GHz (Linux).\n- supports IDS Evasion (Ghosting, Fragmenting, Does not fully work with every driver).\n- supports packet fuzz testing.\n- supports Proof-of-concept of WiFi protocol implementation vulnerability testing\n\n\n# ATTACK MODE\n\n\t\tATTACK MODE b: Beacon Flooding\n\t\t  Sends beacon frames to show fake APs at clients.\n\t\t  This can sometimes crash network scanners and even drivers!\n\t\tATTACK MODE a: Authentication Denial-Of-Service\n\t\t  Sends authentication frames to all APs found in range.\n\t\t  Too many clients can freeze or reset several APs.\n\t\tATTACK MODE p: SSID Probing and Bruteforcing\n\t\t  Probes APs and checks for answer, useful for checking if SSID has\n\t\t  been correctly decloaked and if AP is in your sending range.\n\t\t  Bruteforcing of hidden SSIDs with or without a wordlist is also available.\n\t\tATTACK MODE d: Deauthentication and Disassociation\n\t\t  Sends deauthentication and disassociation packets to stations\n\t\t  based on data traffic to disconnect all clients from an AP.\n\t\tATTACK MODE m: Michael Countermeasures Exploitation\n\t\t  Sends random packets or re-injects duplicates on another QoS queue\n\t\t  to provoke Michael Countermeasures on TKIP APs.\n\t\t  AP will then shutdown for a whole minute, making this an effective DoS.\n\t\tATTACK MODE e: EAPOL Start and Logoff Packet Injection\n\t\t  Floods an AP with EAPOL Start frames to keep it busy with fake sessions\n\t\t  and thus disables it to handle any legitimate clients.\n\t\t  Or logs off clients by injecting fake EAPOL Logoff messages.\n\t\tATTACK MODE s: Attacks for IEEE 802.11s mesh networks\n\t\t  Various attacks on link management and routing in mesh networks.\n\t\t  Flood neighbors and routes, create black holes and divert traffic!\n\t\tATTACK MODE w: WIDS Confusion\n\t\t  Confuse/Abuse Intrusion Detection and Prevention Systems by\n\t\t  cross-connecting clients to multiple WDS nodes or fake rogue APs.\n\t\tATTACK MODE f: Packet Fuzzer\n\t\t  A simple packet fuzzer with multiple packet sources\n\t\t  and a nice set of modifiers. Be careful!\n\t\tATTACK MODE x: Poc Testing\n\t\t  Proof-of-concept of WiFi protocol implementation vulnerability,\n\t\t  to test whether the device has wifi vulnerabilities.\n\t\t  It may cause the wifi connection to be disconnected or the target device to crash.\n\n# Usage\n\n\t\tmdk4 \u003cinterface\u003e \u003cattack_mode\u003e [attack_options]\n\t\tmdk4 \u003cinterface in\u003e \u003cinterface out\u003e \u003cattack_mode\u003e [attack_options]\n\n\t\tTry mdk4 --fullhelp for all attack options\n\t\tTry mdk4 --help \u003cattack_mode\u003e for info about one attack only\n\n\nFULL OPTIONS:\n\n\t\tATTACK MODE b: Beacon Flooding\n\t\t  Sends beacon frames to generate fake APs at clients.\n\t\t  This can sometimes crash network scanners and drivers!\n\t\t      -n \u003cssid\u003e\n\t\t\t Use SSID \u003cssid\u003e instead of randomly generated ones\n\t\t      -a\n\t\t\t Use also non-printable caracters in generated SSIDs\n\t\t\t and create SSIDs that break the 32-byte limit\n\t\t      -f \u003cfilename\u003e\n\t\t\t Read SSIDs from file\n\t\t      -v \u003cfilename\u003e\n\t\t\t Read MACs and SSIDs from file. See example file!\n\t\t      -t \u003cadhoc\u003e\n\t\t\t -t 1 = Create only Ad-Hoc network\n\t\t\t -t 0 = Create only Managed (AP) networks\n\t\t\t without this option, both types are generated\n\t\t      -w \u003cencryptions\u003e\n\t\t\t Select which type of encryption the fake networks shall have\n\t\t\t Valid options: n = No Encryption, w = WEP, t = TKIP (WPA), a = AES (WPA2)\n\t\t\t You can select multiple types, i.e. \"-w wta\" will only create WEP and WPA networks\n\t\t      -b \u003cbitrate\u003e\n\t\t\t Select if 11 Mbit (b) or 54 MBit (g) networks are created\n\t\t\t Without this option, both types will be used.\n\t\t      -m\n\t\t\t Use valid accesspoint MAC from built-in OUI database\n\t\t      -h\n\t\t\t Hop to channel where network is spoofed\n\t\t\t This is more effective with some devices/drivers\n\t\t\t But it reduces packet rate due to channel hopping.\n\t\t      -c \u003cchan\u003e\n\t\t\t Create fake networks on channel \u003cchan\u003e. If you want your card to\n\t\t\t hop on this channel, you have to set -h option, too.\n\t\t      -i \u003cHEX\u003e\n\t\t\t Add user-defined IE(s) in hexadecimal at the end of the tagged parameters\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: 50)\n\n\t\tATTACK MODE a: Authentication Denial-Of-Service\n\t\t  Sends authentication frames to all APs found in range.\n\t\t  Too many clients can freeze or reset several APs.\n\t\t      -a \u003cap_mac\u003e\n\t\t\t Only test the specified AP\n\t\t      -m\n\t\t\t Use valid client MAC from built-in OUI database\n\t\t      -i \u003cap_mac\u003e\n\t\t\t Perform intelligent test on AP\n\t\t\t This test connects clients to the AP and reinjects sniffed data to keep them alive.\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: unlimited)\n\n\t\tATTACK MODE p: SSID Probing and Bruteforcing\n\t\t  Probes APs and checks for answer, useful for checking if SSID has\n\t\t  been correctly decloaked and if AP is in your sending range.\n\t\t  Bruteforcing of hidden SSIDs with or without a wordlist is also available.\n\t\t      -e \u003cssid\u003e\n\t\t\t SSID to probe for\n\t\t      -f \u003cfilename\u003e\n\t\t\t Read SSIDs from file for bruteforcing hidden SSIDs\n\t\t      -t \u003cbssid\u003e\n\t\t\t Set MAC address of target AP\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed (Default: 400)\n\t\t      -b \u003ccharacter sets\u003e\n\t\t\t Use full Bruteforce mode (recommended for short SSIDs only!)\n\t\t\t You can select multiple character sets at once:\n\t\t\t * n (Numbers:   0-9)\n\t\t\t * u (Uppercase: A-Z)\n\t\t\t * l (Lowercase: a-z)\n\t\t\t * s (Symbols: ASCII)\n\t\t      -p \u003cword\u003e\n\t\t\t Continue bruteforcing, starting at \u003cword\u003e.\n\t\t      -r \u003cchannel\u003e\n\t\t\t Probe request tests (mod-musket)\n\n\t\tATTACK MODE d: Deauthentication and Disassociation\n\t\t  Sends deauthentication and disassociation packets to stations\n\t\t  based on data traffic to disconnect all clients from an AP.\n\t\t      -w \u003cfilename\u003e\n\t\t\t Read file containing MACs not to care about (Whitelist mode)\n\t\t      -b \u003cfilename\u003e\n\t\t\t Read file containing MACs to run test on (Blacklist Mode)\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: unlimited)\n\t\t      -x\n\t\t\t Enable full IDS stealth by matching all Sequence Numbers\n\t\t\t Packets will only be sent with clients' addresses\n\t\t      -c [chan,chan,...,chan[:speed]]\n\t\t\t Enable channel hopping. When -c h is given, mdk4 will hop an all\n\t\t\t 14 b/g channels. Channel will be changed every 3 seconds,\n\t\t\t if speed is not specified. Speed value is in milliseconds!\n\t\t      -E \u003cAP ESSID\u003e\n\t\t\t Specify an AP ESSID to attack.\n\t\t      -B \u003cAP BSSID\u003e\n\t\t\t Specify an AP BSSID to attack.\n\t\t      -S \u003cStation MAC address\u003e\n\t\t\t Specify a station MAC address to attack.\n\t\t\t  -W \u003cWhitelist Station MAC address\u003e\n\t\t\t Specify a whitelist station MAC.\n\n\t\tATTACK MODE m: Michael Countermeasures Exploitation\n\t\t  Sends random packets or re-injects duplicates on another QoS queue\n\t\t  to provoke Michael Countermeasures on TKIP APs.\n\t\t  AP will then shutdown for a whole minute, making this an effective DoS.\n\t\t      -t \u003cbssid\u003e\n\t\t\t Set target AP, that runs TKIP encryption\n\t\t      -j\n\t\t\t Use the new QoS exploit which only needs to reinject a few packets instead\n\t\t\t of the random packet injection, which is unreliable but works without QoS.\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: 400)\n\t\t      -w \u003cseconds\u003e\n\t\t\t Wait \u003cseconds\u003e between each random packet burst (Default: 10)\n\t\t      -n \u003ccount\u003e\n\t\t\t Send \u003ccount\u003e random packets per burst (Default: 70)\n\n\t\tATTACK MODE e: EAPOL Start and Logoff Packet Injection\n\t\t  Floods an AP with EAPOL Start frames to keep it busy with fake sessions\n\t\t  and thus disables it to handle any legitimate clients.\n\t\t  Or logs off clients by injecting fake EAPOL Logoff messages.\n\t\t      -t \u003cbssid\u003e\n\t\t\t Set target WPA AP\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: 400)\n\t\t      -l\n\t\t\t Use Logoff messages to kick clients\n\n\t\tATTACK MODE s: Attacks for IEEE 802.11s mesh networks\n\t\t  Various attacks on link management and routing in mesh networks.\n\t\t  Flood neighbors and routes, create black holes and divert traffic!\n\t\t      -f \u003ctype\u003e\n\t\t\t Basic fuzzing tests. Picks up Action and Beacon frames from the air, modifies and replays them:\n\t\t\t The following modification types are implemented:\n\t\t\t 1: Replay identical frame until new one arrives (duplicate flooding)\n\t\t\t 2: Change Source and BSSID (possibly resulting in Neighbor Flooding)\n\t\t\t 3: Cut packet short, leave 802.11 header intact (find buffer errors)\n\t\t\t 4: Shotgun mode, randomly overwriting bytes after header (find bugs)\n\t\t\t 5: Skript-kid's automated attack trying all of the above randomly :)\n\t\t      -b \u003cimpersonated_meshpoint\u003e\n\t\t\t Create a Blackhole, using the impersonated_meshpoint's MAC address\n\t\t\t mdk4 will answer every incoming Route Request with a perfect route over the impersonated node.\n\t\t      -p \u003cimpersonated_meshpoint\u003e\n\t\t\t Path Request Flooding using the impersonated_meshpoint's address\n\t\t\t Adjust the speed switch (-s) for maximum profit!\n\t\t      -l\n\t\t\t Just create loops on every route found by modifying Path Replies\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: 100)\n\t\t      -n \u003cmeshID\u003e\n\t\t\t Target this mesh network\n\n\t\tATTACK MODE w: WIDS Confusion\n\t\t  Confuse/Abuse Intrusion Detection and Prevention Systems by\n\t\t  cross-connecting clients to multiple WDS nodes or fake rogue APs.\n\t\t  Confuses a WDS with multi-authenticated clients which messes up routing tables\n\t\t      -e \u003cSSID\u003e\n\t\t\t SSID of target WDS network\n\t\t      -c [chan,chan,...,chan[:speed]]\n\t\t\t Enable channel hopping. When -c h is given, mdk4 will hop an all\n\t\t\t 14 b/g channels. Channel will be changed every 3 seconds,\n\t\t\t if speed is not specified. Speed value is in milliseconds!\n\t\t      -z\n\t\t\t activate Zero_Chaos' WIDS exploit\n\t\t\t (authenticates clients from a WDS to foreign APs to make WIDS go nuts)\n\t\t      -s \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: 100)\n\n\t\tATTACK MODE f: Packet Fuzzer\n\t\t  A simple packet fuzzer with multiple packet sources\n\t\t  and a nice set of modifiers. Be careful!\n\t\t  mdk4 randomly selects the given sources and one or multiple modifiers.\n\t\t      -s \u003csources\u003e\n\t\t\t Specify one or more of the following packet sources:\n\t\t\t a - Sniff packets from the air\n\t\t\t b - Create valid beacon frames with random SSIDs and properties\n\t\t\t c - Create CTS frames to broadcast (you can also use this for a CTS DoS)\n\t\t\t p - Create broadcast probe requests\n\t\t      -m \u003cmodifiers\u003e\n\t\t\t Select at least one of the modifiers here:\n\t\t\t n - No modifier, do not modify packets\n\t\t\t b - Set destination address to broadcast\n\t\t\t m - Set source address to broadcast\n\t\t\t s - Shotgun: randomly overwrites a couple of bytes\n\t\t\t t - append random bytes (creates broken tagged parameters in beacons/probes)\n\t\t\t c - Cut packets short, preferably somewhere in headers or tags\n\t\t\t d - Insert random values in Duration and Flags fields\n\t\t      -c [chan,chan,...,chan[:speed]]\n\t\t\t Enable channel hopping. When -c h is given, mdk4 will hop an all\n\t\t\t 14 b/g channels. Channel will be changed every 3 seconds,\n\t\t\t if speed is not specified. Speed value is in milliseconds!\n\t\t      -p \u003cpps\u003e\n\t\t\t Set speed in packets per second (Default: 250)\n\t\t\n\t\tATTACK MODE x: Poc Testing\n\t\t  Proof-of-concept of WiFi protocol implementation vulnerability,\n\t\t  to test whether the device has wifi vulnerabilities.\n\t\t  It may cause the wifi connection to be disconnected or the target device to crash.\n\t\t  \t  -s \u003cpps\u003e\n\t\t\t   Set speed in packets per second (Default: unlimited)\n\t\t\t  -c [chan,chan,...,chan[:speed]]\n\t\t\t  \tEnable channel hopping. When -c h is given, mdk4 will hop an all\n\t\t\t\t14 b/g channels. Channel will be changed every 3 seconds,\n\t\t\t\tif speed is not specified. Speed value is in milliseconds!\n\t\t\t  -v \u003cvendor\u003e\n\t\t\t    file name in pocs dir, default test all.\n\t\t\t  -A \u003cAP MAC\u003e\n\t\t\t    set an AP MAC\n\t\t\t  -S \u003cStation MAC\u003e\n\t\t\t    set a station MAC.\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faircrack-ng%2Fmdk4","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faircrack-ng%2Fmdk4","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faircrack-ng%2Fmdk4/lists"}