3

I'm testing a wifi de-authentication attack and it looks like my Windows 7 client is not getting kicked off the network during the deauthentication. Any explanations as to why that might be?

I've got Kali running aireplay-ng and tested both a directed and broadcast attack. During the broadcast, my XP client very clearly lost its connection.

Confirmed with a packet capture that the Windows 7 client is receiving the deauthentication management frames, although aireplay is getting almost no ack messages back.

I'd like to think either the W7 client is getting disconnected and the application layer just isn't showing the disconnection (the wifi icon in the system tray never drops off) or the system is reconnecting too fast for it to even register it was kicked off, although I doubt these are the case, especially since I can still get to the wifi router management webpage (its not connected to the internet so perhaps thats normal, and I wouldnt be able to connect to an outside webpage?). It's an unprotected network, so theres no .11w running. Is there something simple I'm missing here?

Improve this question
1

It shouldn't matter. The 802.11 de-authentication attack is not attacking the computer so the Operating System of the client should not matter. It is attacking the network itself by telling the router that the clients are done the connection and are disconnecting.

There are defences for de-authentication attacks but it is not based on the OS. It is basically making the client jump from 1 AP to another to avoid being disconnected.

Improve this answer
  • It didn't, it still worked. For some reason I don't yet understand the computer still thought it was connected though (the system tray icon showed a connection), but I couldn't access network resources. When I first tried it I thought because the system still looked connected maybe there was something with the operating system preventing a disconnect. There wasn't. I'm still not quite sure though why the system still showed a connection and why after the de-auth packets stopped it couldn't reconnect until after I restarted the router and computer. – gr0k Jul 26 '14 at 7:44
  • @SamThode Windows 7 can act strange about wireless networks sometimes, for example it can think "its all good" when actually it isn't. I always think that mechanism behind connectivity detection is a bit buggy. Have you tried that with W8? – Batuhan Apr 4 '15 at 23:09
1

Make sure you adjust the number of deauths to send.. android devices can get deauth after sending 3-18 consecutive deauth, Linux devices get deauth after 10-30 deauths. IDK with windows.. you gotta test it by yourself..

just add the "-0" that's a zero followed by [number of deauth attack]

Improve this answer
0

Ran another test of my attack on a connection with outside internet access and then the first network again with no outside access, both with success. I'm not sure why the aireplay-ng didn't get results on the W7 machine, but it can definitely be disconnected. After a few seconds of running the hosts were all disconnected. Airodump-ng did not show the disconnection of the hosts though, and it took a long minute for the W7 host to show the disconnection, but even before the system tray icon showed the drop, I was unable to access any webpage. During the attack the hosts were able to briefly reconnect a couple times before getting stopped completely. One interesting note, after I stopped the program the hosts still could not reconnect until I reset the router and the host. My guess is the system was so overloaded from the deauth frames and it needed a hard reset to clear its queue of frames to process, but thats just a guess.

Improve this answer
0

I think you did disconnect all devices deauth. Try targetting Wn7 devices one by one. Maybe the system tray wifi not showing that it's disconnected.

You must try (connected to the internet) ping google.com /t. It will show if the PC is connected to the internet, and if connection lost it will say request timeout

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.