1

I'm trying to perform a De-authentication attack on my wifi network.

My command is:

aireplay-ng -0 0 -a B8:A3:86:5E:9C:DC wlan0

The response looks like this:

20:35:59  Waiting for beacon frame (BSSID: B8:A3:86:5E:9C:DC) on channel 11

NB: this attack is more effective when targeting a connected wireless client (-c <client's mac>).

20:35:59  Sending DeAuth to broadcast -- BSSID: [B8:A3:86:5E:9C:DC]

And so on the DeAuths go.

But it doesn't do anything. I can still browse the web and using for example airodump-ng to get a handshake just waits still. So the devices are not getting deauthenticated. Targeting a specific client doesn't help. I left it up like this for about 5min and still nothing. What am I doing wrong here? The MAC address is correct.

Edit:

After targeting the client I'm getting the following:

12:04:16  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [37| 0 ACKs]
12:04:16  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [86| 0 ACKs]
12:04:17  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [12| 0 ACKs]
12:04:17  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [ 5| 1 ACKs]
12:04:18  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [ 0| 0 ACKs]
12:04:18  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [ 0| 0 ACKs]

Interestingly, I'm getting the acks only when I'm using the internet on my phone.

My WiFi card is Intel Corporation Wireless 7265 (rev 61)

  • Might be helpful to also tell us what kind of wifi card you're using. – Jeroen Sep 2 '17 at 5:15
  • This is my interface: Intel Corporation Wireless 7265 (rev 61) – Alex Ironside Sep 2 '17 at 16:11
2

There are a bunch of reasons why this might not be working. The documentation explains a few:

Why does deauthentication not work?

There can be several reasons and one or more can affect you:

  • You are physically too far away from the client(s). You need enough transmit power for the packets to reach and be heard by the clients. If you do a full packet capture, each packet sent to the client should result in an “ack” packet back. This means the client heard the packet. If there is no “ack” then likely it did not receive the packet.
  • Wireless cards work in particular modes such b, g, n and so on. If your card is in a different mode then the client card there is good chance that the client will not be able to correctly receive your transmission. See the previous item for confirming the client received the packet.
  • Some clients ignore broadcast deauthentications. If this is the case, you will need to send a deauthentication directed at the particular client.
  • Clients may reconnect too fast for you to see that they had been disconnected. If you do a full packet capture, you will be able to look for the reassociation packets in the capture to confirm deauthentication worked.

(emphasis mine)

Keep in mind that, in regard to the final point, many WiFi stacks will simply reconnect immediately without notifying the user. As such your deauthentication may be working, but you're not seeing any effects from it. In general sending a single deauthentication packet does not cause a long-term outage; the device will just reconnect. This behaviour is really useful when you're trying to capture lots of 4-way handshakes to crack WPA/WPA2.

  • The thing is it didn't disconnect them. I was sending the packets and no handshake was obtained. Is there a way to check the mode my wifi card and the router/client uses? When I target the client I am getting the ack packets back. But interestingly only when I'm browsing the net on my phone. But still nothing is getting disconnected, even with direct targetting. I'll edit the post to add the reports. – Alex Ironside Sep 2 '17 at 16:06
  • @polynomial I use MacBook Air and Wireless Card is working on 802.11n is my device still vulnerable to Deauth attack? Thanks – Dark Cyber Jan 4 at 12:19
  • @DarkCyber Yes. As far as I am aware deauth currently works on all 802.11 networks using WPA or WPA2, including enterprise networks (EAP, etc.), except where the 802.11w extension is used (rare). The proposed WPA3 standard should prevent deauth attacks in future, but nothing supports it yet. – Polynomial Jan 10 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.