1

In my home pentest lab I though it would be interesting to try this scenario and see if it works:

I have 2 computers and 1 AP, computer A is authenticated to the access point with WPA2 and computer B wants to run a MiTM attack on computer A by making it connect to a fake network. But, computer Bs antenna is not as powerful as computer As so in result computer B can only contact computer A and not the AP thus making a deauth attack though the usual tools useless.

My question is this: Is there a way/utility to deauth a computer without being able to get a frame from the AP?

6
  • A DeAuth IS sending packets to the computer and not the AP, but you need to know about the AP in order to impersonate it.
    – KnightOfNi
    Aug 23, 2014 at 2:27
  • @KnightOfNi Any existing tools to manually feed the AP details without having to write my own script for that? Aireplay and most others I try wait for a frame from the AP, which obviously never comes since its out of range.
    – user36976
    Aug 23, 2014 at 8:06
  • You can use Colasoft's Packet Builder, if you know what a DeAuth packet looks like. If not, I suppose you could intercept one with Wireshark and dissect it a bit from there
    – KnightOfNi
    Aug 24, 2014 at 1:28
  • @KnightOfNi Ah ill try building a deauth packet with that. If you want post these comments as an answer, ill accept it.
    – user36976
    Aug 24, 2014 at 12:21
  • I'd rather not, as I suspect there's an easier way out there somewhere. Thanks for the offer, though.
    – KnightOfNi
    Aug 24, 2014 at 14:13

1 Answer 1

1

You only need the BSSID information from the AP to run the aireplay command. Since you said that you are looking for a tool that would let you provide the AP information manually, the command would be like this:

aireplay-ng -0 1 -a <AP BSSID> -c <COMPUTER A> interface

And to get the AP BSSID you could use the airodump-ng, and look at the AP computer A is connected at. (in this case, airodump would get the BSSID based on the computer that is connected to it)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .