I read about 802.11 networks and found out that all the frames from client are directed to the AP. How can I forge IEEE 802.11 packets so that I can send them directly to the clients using the group encryption key and hence spoofing as the AP. In other words, how can I exploit the hole 196?


If you want to inject custom frames on a Linux machine its pretty straightforward. The Linux wireless stack lets you create a virtual monitor mode device alongside the normal device.

iw phy phy0 interface add mon0 type monitor
ifconfig mon0 promisc up

Anything written to this device will be sent directly over the air without any further processing. This lets you format a layer 2 frame with whatever fields you require. Of course, a lot depends on the actual hardware itself - some cards do not allow injection of raw frames. Others do not provide for fine control. To control the transmission (what rate its sent at etc.) you will have to prepend a radiotap header and the details of which fields will be needed will depend on the WNIC hardware you are using.

  • will it be straight forward if I try to modify the ath5k/ath9k driver? What about the radiotap header, can I prepend it using the same driver?
    – Sunny
    Nov 15 '15 at 9:52
  • My explanation above paints a broad outline of raw L2 frame injection using Linux wireless. Why do you want to modify the driver? Modifying any driver requires a good knowledge of both the hardware and the kernel wireless stack. The approach I explained requires that you encrypt the frame yourself because the hardware simply transmits any frame you inject on the monitor mode interface as is. You also misunderstand the purpose of the radiotap header. It is used to communicate between the userland program and the kernel. It is not sent over the air.
    – stiabhan
    Nov 15 '15 at 21:42

This is a good place to start: WPA2-Hole196 The tools you are looking for are wpa_supplicant and madwifi.

The subject was presented in Defcon 18: dc18 archive
(Scroll down to "WPA Too!")

  • I have read about them, however it seems like I have to edit driver code to get it working. Is there any easier way?
    – Sunny
    Nov 14 '15 at 17:33
  • None that I know of. There was someone in Defcon a few years ago who showed how to do it. Try to search for his presentation.
    – yaloner
    Nov 14 '15 at 17:35
  • Actually that presentation was really helpful. But there was nothing more about that in the internet, no follow up.
    – Sunny
    Nov 15 '15 at 5:33
  • I'm glad it was helpful, adding it to my answer for future reference. This is all I got...
    – yaloner
    Nov 15 '15 at 6:05
  • MadWifi is long since deprecated. If you have Atheros hardware then the ath5k/ath9k device drivers are the right ones to use. These days you can be a little more device agnostic - see my answer below.
    – stiabhan
    Nov 15 '15 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.