AngryOxide - 802.11 Attack tool generating Hashcat Formats

[rage]

This has been shared a bit already including in the discord. But I figured I should create a post here too!

I created a WiFi attack tool that generates mode 22000 hashlines for cracking. 

Here are the details:

• Active state-based attack engine used to retrieve relevent EAPOL messages from Access Points and clients.
  
• Target option that accepts MAC (aabbcc..., aa:bb:cc...) and SSID "Test_SSID" to limit attack scope.
  
• Whitelist option to protect specific networks from attacks. Useful if not using targets.
  
• Auto Hunt capability to find all target channels and hop between them.
  
• A Terminal-UI that presents all relevent data while still living in the terminal for easy usage over SSH.
  
• Limits DEAUTHENTICATION frames that can cause more damage than good to the authentication sequence.
  
• EAPOL 4-Way-Handshake validation using Nonce Correction, Replay Counter validation, and Temporal validation.
  
• Automatically elicits PMKID from access points where available.
  
• Utilizes GPSD with ability to set remote GPSD service address.
  
• Provides pcapng files with embedded GPS using the Kismet Format.
  
• Provides a kismetdb file with all frames (with GPS) for post-processing.
  
• Wraps all output files in a gzipped tarball.
  
• Bash autocompletions for easy interface selection provided.
  

Attacks:

Will by default attack ALL access points in range, unless atleast one target is supplied, at which point the tool will only transmit against defined targets. (But will still passively collect on other access points).

• Attempts authentication/association sequence to produce EAPOL Message 1 (PMKID Collection)
  
• Attempts to retrieve hidden SSID's with undirected probe requests.
  
• Utilizes Anonymous Reassociation to force Access Points to deauthenticate their own clients (MFP Bypass)
  
• Will attempt to send Channel Switch Announcement to send clients to adjacent channels.
  
• Attempts to downgrade RSN modes to WPA2-CCMP (Probe Response Injection)
  
• Attempts to collect EAPOL M2 from stations based solely on Probe Requests (Rogue AP)
  
• Will send controlled deauthentication frames unless told not to (--nodeauth)
  

All of these attacks are rate-controlled both to prevent erroneous EAPOL timer resets and to maintain some level of OPSEC.

You can find AngryOxide on my github:

Link

And visit out discord if you want some quick responses to questions:

Discord

Screenshots: