Hello Duthcode Hackers, this is how i am going to be calling you from now on... In this article i am going to be talking about a hack attack called deauthentication.

In my humble opinion, when a hacker learns about a new attack, he or she has the obligation to also learn how to prevent it. So, this is not going to be a simple how to, this article will be divided in 4 parts:

| What is a Deauth Attack | Why would you want to attack in that way | How to do it | How to prevent the attack and take the necessary precautions

Feel free to skip steps of course.

1 | What is a Deauth Attack ?

Deauthentication attack is a type of denial of service attack that targets communication between a user ( or all users ) and a Wi-Fi access point.

This attack sends disassociate packets to one or more clients which are currently associated with a particular access point. Of course, this attack is totally useless if there are no associated wireless client or no fake authentications.

The cool thing about this attack is that even in 2019 where all networks are using a WPA2 encryption you can still easily deauth anything or anyone without even being inside the network!

Why does a deauth attack work on WPA2 despite encryption? The use of encryption in 802.11 is limited to data payloads only. Encryption does not apply to the 802.11 frame headers, and cannot do so as key elements of 802.11 headers are necessary for normal operations of 802.11 traffic.

Since 802.11 management frames largely work by setting information in the headers, management frames are not encrypted and as such are easily spoofed.

To prevent deauthentication/disassociation attacks, the IEEE implemented the 802.11w amendment to 802.11. This provides a mechanism to help prevent the spoofing of management frames, but both client and infrastructure need to support it (and have it enabled) for it to function. (source)



2 | Why would one attack a network in that way?

A deauth attack is, most of the times, a step of a greater attack! Hackers usually need to deauth a user off of a network so they can:

Capture WPA/WPA2 4-Way Handshakes by forcing a user to reconnect to the network

Force users to connect to their own Rogue access point (search : Evil Twin Attack)

Force users to connect to a Captive Portal

I will be writing articles and tutorials demonstrating every single one of the aforementioned attacks so stay tuned.

You can also deauth users in your network for way simpler reasons, like:

Kick a sibling or a friend off the network just because they are slowing your connection down

Frustrate people and laugh example, let's say your best friend is a waiter, and he takes his orders from customers with a PDA connected to the Cafe's Wi-Fi connection, deauth his PDA and drive him mad. (You didn't read that from me).



Ok, enough with the Theory! Practice!

3 | How to Deauth

For this attack we need a tool called aircrack-ng, aircrack-ng is more of a suite actually containing many tools to assess Wi-Fi network security, I have a list of the aircrack tools in my Introduction to Kali Linux article, tool #5.

Since aircrack-ng suite comes pre-installed inside the Kali Linux Distribution, the whole tutorial is on Kali Linux, if you don't have Kali installed on your computer or on a Virtual Machine take a look at my Kali Linux bootable USB - A Hacker's Swiss army knife article and get ready!

Ok! one last thing, since we are talking about sending packets we will need a wireless adapter both able to work in monitor mode and be a packet injector!

What is Monitor Mode? | For listening and Capturing Monitor mode allows you to capture data sent and received by wireless devices and networks nearby. Without it you can not see which devices are active and what is happening inside the network.

What is Packet Injection? | For transmitting and Attacking Packet injection allows you to craft and inject or send data to wireless devices and networks nearby. Without it you can not intercept or manipulate any activity from within the network.



My favourite wireless adapter, and the one I'll be using for this tutorial, is Alfa AWUSO36NH High Gain USB Wireless G / N Long-Rang WiFi Network Adapter , it has never failed me thus far.

DANGER : 2020 Update, Tp Link Adapters have been updated to the V2 (Version 2) and they don't work with Kali anymore! So go ALFA!

Step 1 | Fire up Kali and open up a Terminal

By typing ifconfig and the enter key on your terminal you get the following output :

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255 inet6 fe80::a00:27ff:fe59:1b51 prefixlen 64 scopeid 0x20<link> ether 08:00:27:59:1b:51 txqueuelen 1000 (Ethernet) RX packets 5 bytes 1360 (1.3 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 69 bytes 5690 (5.5 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 20 bytes 1116 (1.0 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 20 bytes 1116 (1.0 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 wlan0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 ether fa:30:3e:ca:dd:85 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

At the eth0 section in my ifconfig output you see that i have inet 10.0.2.15, this is because i am running Kali Linux on a Virtual Machine and i have it connected on a nat network. Don't worry about it, you do not even have to care!

All YOU have to care about is the wlan0 section that is your wireless adapter and as you can see mine in not even connected to a network.

Now, if we type to our terminal iwconfig and execute it we see:

lo no wireless extensions. eth0 no wireless extensions. wlan0 IEEE 802.11 ESSID:off/any Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm Retry short limit:7 RTS thr:off Fragment thr:off Encryption key:off Power Management:off

Mode : managed, our first goal is to put our wireless adapter on monitor mode.

Step 2 | Setting wireless adapter in monitor mode with airmon-ng

By running the airmon-ng start wlan0 (or whatever your adapter is called, it could be wlan1 or wlan2) you are setting your adapter to monitor mode! Check out the output :

root@kali:~# airmon-ng start wlan0 Found 3 processes that could cause trouble. If airodump-ng, aireplay-ng or airtun-ng stops working after a short period of time, you may want to run 'airmon-ng check kill' PID Name 448 NetworkManager 525 dhclient 654 wpa_supplicant PHY Interface Driver Chipset phy0 wlan0 ath9k_htc Atheros Communications, Inc. TP-Link TL-WN322G v3 / TL-WN422G v2 802.11g [Atheros AR9271] (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon) (mac80211 station mode vif disabled for [phy0]wlan0) root@kali:~# iwconfig lo no wireless extensions. eth0 no wireless extensions. wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm Retry short limit:7 RTS thr:off Fragment thr:off Power Management:off

See the above iwconfig result. Mode:Monitor and the name is wlan0mon! You are ready to go.

Step 3 | Searching for Victims with airodump-ng

Run on your terminal => airodump-ng wlan0mon

CH 12 ][ Elapsed: 6 s ][ 2019-02-13 15:41 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID C8:14:51:15:DD:2C -85 2 1 0 6 130 WPA2 CCMP PSK COSMOTE-834911 E8:DE:27:4D:7D:14 -79 4 0 0 11 65 WPA2 CCMP PSK USER-PC_Network 50:C7:BF:DC:4C:E8 -45 18 0 0 11 270 WPA2 CCMP PSK TP-LINK_AP_4CE8 B0:AC:D2:2B:9E:8D -74 5 0 0 1 270 WPA2 CCMP PSK COSMOTE-2B9E8D 5A:AC:D2:2B:9E:8E -75 5 0 0 1 270 OPN OTE WiFi Fon A4:7E:39:B6:9A:84 -79 6 0 0 6 65 WPA CCMP PSK Wind WiFi B69A84 8C:68:C8:CE:6B:3E -82 2 2 0 2 270 WPA2 CCMP PSK CYTA-n4hu1 DC:02:8E:E0:54:1C -81 4 8 0 13 135 WPA CCMP PSK mpisi wifi 5A:99:35:B7:1F:D3 -91 2 0 0 1 270 OPN OTE WiFi Fon 30:99:35:B7:1F:D2 -92 3 1 0 1 270 WPA2 CCMP PSK Splitting The Sky

You will get a bunch of different access points with a lot of info you don't understand! Let's break them down.

BSSID | MAC address of the access point. In the Client section, a BSSID of “(not associated)” means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.

MAC address of the access point. In the Client section, a BSSID of “(not associated)” means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with. PWR | Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn't support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn't support signal level reporting.

Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn't support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn't support signal level reporting. Beacons | Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.

Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far. # Data | Number of captured data packets (if WEP, unique IV count), including data broadcast packets.

Number of captured data packets (if WEP, unique IV count), including data broadcast packets. #/s | Number of data packets per second measure over the last 10 seconds.

Number of data packets per second measure over the last 10 seconds. CH | Channel number (taken from beacon packets).

Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference.

Channel number (taken from beacon packets). Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference. MB | Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. Displays “e” following the MB speed value if the network has QoS enabled.

Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. Displays “e” following the MB speed value if the network has QoS enabled. ENC | Encryption algorithm in use. OPN = no encryption,“WEP?” = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP is present.

Encryption algorithm in use. OPN = no encryption,“WEP?” = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP is present. CIPHER | The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater then 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.

The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater then 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit. AUTH | The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).

The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP). ESSID | Shows the wireless network name. The so-called “SSID”, which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests.

My target is me!!! TP-LINK_AP_4CE8! I am highlighting me because i am trying very hard not to break any laws, so should you!

Step 4 | Specific Targeting for better information gathering

Now that we know all that we need to know about our target we have to find any devices connected to the network, to do that we run the following command.

The commands structure is airodump-ng -d "target's BSSID" -c "target's channel number" "wireless adapter monitor mode name"

In our case the full command is:

airodump-ng -d 50:C7:BF:DC:4C:E8 -c 11 wlan0mon

Now we are monitoring SPECIFICALLY our target, and not many targets in general. Also we can see that there are two devices currently inside the network, one of which is my phone!

CH 11 ][ Elapsed: 1 min ][ 2019-02-13 15:59 ] BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 50:C7:BF:DC:4C:E8 -22 91 610 163 4 11 270 WPA2 CCMP PSK TP-LINK_AP_4CE8 BSSID STATION PWR Rate Lost Frames Probe 50:C7:BF:DC:4C:E8 AC:3C:0B:36:BD:5B -32 0e-24 0 12 50:C7:BF:DC:4C:E8 E0:B5:2D:EA:18:A7 -58 1e-24 6 122

Step 5 | Deauthenticating Device from the network

This is our final command!

aireplay-ng -0 0 -a 50:C7:BF:DC:4C:E8 -c E0:B5:2D:EA:18:A7 wlan0mon

Command instructions:

-0 means deauthentication.

means deauthentication. 0 is the number of deauths to send 0 means send them continuously, you can send 10 if you want the target to disconnect and reconnect.

is the number of deauths to send 0 means send them continuously, you can send 10 if you want the target to disconnect and reconnect. -a 50:C7:BF:DC:4C:E8 is the MAC address of the access point we are targeting.

50:C7:BF:DC:4C:E8 is the MAC address of the access point we are targeting. -c E0:B5:2D:EA:18:A7 is the MAC address of the client to deauthenticate; if this is omitted then all clients are deauthenticated.

E0:B5:2D:EA:18:A7 is the MAC address of the client to deauthenticate; if this is omitted then all clients are deauthenticated. wlan0mon is the interface name.

The command continuous output:

16:14:41 Waiting for beacon frame (BSSID: 50:C7:BF:DC:4C:E8) on channel 11 16:14:42 Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [99|67 ACKs] 16:14:43 Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [61|59 ACKs] 16:14:43 Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [25|48 ACKs] 16:14:44 Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [ 0|72 ACKs] 16:14:45 Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [ 0|57 ACKs] 16:14:45 Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [ 0|65 ACKs] 16:14:45 Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:^C:A7] [ 0|10 ACKs] ... ... [until we hit ctrl+c to stop it sending packets]

And its immediate result :

4 | Prevent the attack and take the necessary precautions

You are now well familiar with the attack and know all the theory a beginner may need! But how could one prepare himself for defending against a deauthentication attack?

You can not stop a bad guy from sending deauth packets. Instead you should make sure your network is configured in a way that the deauth attack doesn't enable an attacker to compromise your network.

Make sure your network is using WPA2 encryption.

Your Wi-Fi passphrase should be very long and strong.

Once you have been disconnected from your network, make sure that you connect back to a WPA2 secure network and not an open one with the same name as yours! IMPORTANT.

That was it! Thank you for reading! Here are some other Articles you might like:

You can show your support by liking our Facebook Page ! Support our efforts on Ko-Fi ! And you can get in contact with us either by sending us a message on Facebook or via the e-mail on the footer of the Page!

Thanks again! Have a lovely day... Or night!