1

During my first deauthentication attack the client I targeted was disconnected from the wireless network, however I was able to reconnect the client to the network even though aireplay-ng was still sending deauthentication packets. The device was an iPhone XR.

I found that some routers have deauth mitigation built in (by ignoring repeated deauth probes) but I was able to deauth multiple other devices from the same network successfully including different iPhone models so I don't think this is the case.

Is it likely the device (iPhone XR, or indeed all newer iPhone models) has deauth mitigation built in, or do you think the settings on the device have been tweaked manually to prevent deauth attacks?

I'm simply trying to understand why the client was able to reconnect.

Improve this question
4
  • Why is this a problem for you? The re-authentication after being deauthenticated is what you want, isn't it?
    – user163495
    Sep 11, 2019 at 11:35
  • I want the re-authentication after the client is de-authenticated but only when I allow re-authentication. To simply capture a handshake this would be fine, however if I were to perform a social engineering attack (Evil Twin for example) I would want to deny them access to the network until they gave over their credentials.
    – jh4x
    Sep 11, 2019 at 11:43
  • 1
    You have an X/Y problem. You want to block the device from reconnecting. That's a completely different problem from a deauth attack. Why does a device reconnect? Because that's how wifi works. When it reconnects, your attack disconnects it. What you want to know is how to prevent the device from connecting to the original AP. You can't use a deauth for that.
    – schroeder ♦
    Sep 11, 2019 at 11:53
  • Forgive me, I'm very new to all this and appreciate your time/patience. The command I used is as follows: aireplay-ng --deauth 0 -a (target network MAC address) -c (client device MAC address) wlan0 As I understand it, the '0' after --deauth sends an infinite amount of deauthentication packets which I thought continually disconnects the client. When I use this command on other devices connected to the network I am unable to reconnect until I hit cntrl + c on the deauth command.
    – jh4x
    Sep 11, 2019 at 12:03

1 Answer 1

Reset to default
1

It's hard to say exactly what you're seeing, but this is a possible scenario:

  1. Client De-auths
  2. Client sees extra network traffic and changes mode n -> g, or g-> b, etc.
  3. De-auth packets are ignored by client as the client is now in a different mode.

See the end of the doc here: https://www.aircrack-ng.org/doku.php?id=deauthentication

It mentions the problems with deauth packets to devices in different modes. If you can check the logs on your AP, you could validate this was the case.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .