airgeddon, a multi-use bash script for Linux systems to audit wireless networks

[v1s1t0r]

Yeah, it seems more a driver problem. Sorry, I don't have that model to test. Try to launch the commands out of airgeddon. You'll probably get the same result. The command for the capture is simple: airodump-ng -c "${channel}" -d "${bssid}" -w "${tmpdir}handshake" "${interface}"

Regarding more news on airgeddon... on new 7.22 version the new Arcadyan PIN generation algorithm was implemented. It has a 100% of effectiveness on Orange-XXXX networks (very common in some countries like Spain for example). Another new submenu for WPS was added to calculate PINs offline using the different implemented algorithms. Everything is ready but I must wait for some translations... if anybody wants to test it, can be downloaded on "dev" branch using this command: git clone -b dev https://github.com/v1s1t0r1sh3r3/airgeddon

[v1s1t0r]

v7.22 released. This is the changelog:https://github.com/v1s1t0r1sh3r3/air...r/CHANGELOG.md

New features, a PIN can be generated using any integrated algorithm for a target. This also can be done offline, without launching any attack. And the PIN database can be queried to search for PINs of a target too.

As we said before, the Arcadyan algorithm is fully integrated too (bye bye Orange-XXXX networks! xdd). Can anybody give some feedback about this?

[donThomaso]

any plans to implement the new wpa2 hack? https://www.krackattacks.com/

[v1s1t0r]

Sure! It is just awesome. As soon as the tool/s is/are released for sure! it will be integrated on airgeddon.

[underscore88]

Sure! It is just awesome. As soon as the tool/s is/are released for sure! it will be integrated on airgeddon.

Yeah it's awesome.. let's try a search all community/asking for picking it before the 90% of world get the patch ahah

[v1s1t0r]

Hi! I added a new feature on v7.23. Is what I called the DoS pursuit mode. Is more an Evil Twin feature than a DoS feature because is not only available at DoS submenu, it's also available on Evil Twin attacks and is fully integrated with them.

DoS pursuit mode consists in keep a background scanning to detect if target AP changed its channel. If a change is detected, airgeddon warns you and re-launch the attack over the new channel. In this way, the AP channel hopping is avoided. Many APs could have channel configured as "auto" and after a restart could get another different channel and your Evil Twin attack could be useless if you don't detect it in time. Now with this optional modification there is no escape. This increases the Evil Twin effectiveness. To perform it, airgeddon offers the possibility of enabling it on Evil Twin attacks. It warns you that to perform it, another additional wireless interface is required. Of course there is a new intermediate submenu for this interface selection with all validations, etc.

Probably it will pass to master at the end of this month. It's ready and tested but we should wait for translations, etc. If anybody wants to test it, it can be downloaded from "dev" branch of github (as always). git clone -b dev https://github.com/v1s1t0r1sh3r3/airgeddon.git

This is another feature no present on other scripts I think

Now, starting to think about future v8.0 version... I want to add on it full 5ghz support.

[v1s1t0r]

Hello all. Version 8.0 of airgeddon is incoming. Full 5ghz support.

It's already done under testing now and waiting for some translations but it will be on master branch very soon. You can download now from dev branch. You know how... git clone -b dev https://github.com/v1s1t0r1sh3r3/airgeddon.git

It would be nice if somebody could test it. Thanks!

[MiAl]

Great job! Now it looks pretty completed.

I really love WPS PINs attack based on the most common PIN generation algorithms. It is powerful like Pixie Dust!

There are some missing dependencies in Kali Linux for airgeddon, to install them:

sudo apt update && sudo apt install bettercap lighttpd isc-dhcp-server hostapd

It would be great if one day you will implement automation of WPS PINs attacks.

Thanks a lot for continuous development!

[v1s1t0r]

v8.0 with 5ghz support released. WPS pin database also updated with a lot of new pins.

[donThomaso]

hi, I've installed you script on my raspberry pi 3 but i can't find hashcat for it. apt-get install hashcat says it's old and recommends hashcat-data. what attacks require hashcat? do i need some OpenCL for ARM for it to work?

[v1s1t0r]

Hi, 8.11 version is incoming, with some fixes, turkish translations and it will support airmon non compatible cards. Until v8.10 only cards compatible with airmon were able to be used. But for the next coming soon 8.11 version all cards that are able to be in monitor mode will be supported. Regards!

[grid]

Just got around to using airgeddon recently on a wireless test, was a great time-saver!

Many thanks, v1s1t0r, and all involved, for the work

[Ramses2]

Hi V1s1t0r,

Amazing program and really usefull. 1 question about the wireless adapter. I have the realthek and Atheros from Alfa. which adapter is best to use??

[v1s1t0r]

airgeddon v8.11 released. As I said, it has support for any wireless card able to be in monitor mode. Now it doesn't matter if it is not compatible to airmon. Thi version has Turkish translations and some fixes also.

Now started to work on a new branch for future v9.0 with WPA/WPA2 enterprise attacks.

@Ramses2, not sure if there is an universal answer for that. It depends of the driver. Personally I prefer Atheros but as I said, is hard to determine which is better.

[undersc0re]

Love your work and I have a request! Is it possible to implement the ability to extract the pmkid from a target and convert it to a hash in your project? Keep up the good work and thank you!

[virvivir]

can anybody give a walk through how to install hashcat on kali-pi, any feed will be appreciated, thx so much

[mstrmnn]

^^ https://hashcat.net/wiki/doku.php?id...nstall_hashcat

(Bytheway: This thread here is not the right place to ask about hashcat ...)

[v1s1t0r]

Hi undersc0re, still waiting for a tool which simplifie all the process before implement it in airgeddon.

virvivir, I can't tell this 100% but I think hashcat can't be used in ARM devices.

[mstrmnn]

I can't tell this 100% but I think hashcat can't be used in ARM devices.

Oh, you're right: https://hashcat.net/forum/thread-2368.html

But: https://hashcat.net/forum/thread-724....html#pid39849

[undersc0re]

Hi undersc0re, still waiting for a tool which simplifie all the process before implement it in airgeddon.

virvivir, I can't tell this 100% but I think hashcat can't be used in ARM devices.

It looks like aircrack-ng has embraced it in 1.4 they have implemented pmkid now from what I can see!

[v1s1t0r]

Great news, if you are right it can be implemented in airgeddon with a version check based on that. If aircrack is version 1.4 the attack can be done. In that case, it is an interesting feature that will be added for sure for future versions.

[v1s1t0r]

v8.12 released with some minor changes. v9.0 is still under developing with the enterprise attacks stuff. Cheers!

[wketty]

Than you V1s1t0r, it was usefull

Amazing program and really useful and cool, waiting for the v9! Cheers!

[v1s1t0r]

Still developing enterprise attacks. Pretty close to finish them. It's taking more time because it is not the unique new stuff for that v9.0 . I finished a new options system based in bash fallback substitution vars. With this new system the users will be able to modify a lot of options from the menus, from a configuration file or directly using flags on the command line while launching airgeddon. From this new system a lot of stuff can be done: disable colors, disable the intro to skip flying saucer stuff, set dependencies check to silent mode, disable 5ghz, disable hints, disable autoupdates, etc... here is a link of the available options: https://github.com/v1s1t0r1sh3r3/airgeddon/wiki/Options

The translators are working hard now. The idea is to release v9 on January. If someone wants to test it right now it can be done cloning "enterprise" branch. Regards!

[dmatrix]

could add in menu tools support for GPU development mode. For those who have Cuda / Opencl installed could use in Aircrack or Hashcat

[Rabinhood]

Fantastic script. I have a question: I lunch a script in a vnc terminal and the script don't start because there isn't a X graphic server. I can't use it in a vnc terminal session?

[dmatrix]

Fantastic script. I have a question: I lunch a script in a vnc terminal and the script don't start because there isn't a X graphic server. I can't use it in a vnc terminal session?

I had this problem in Linux Debian, resolved logged graph with root account

[v1s1t0r]

Hi all. At last, airgeddon v9.0 was released today. It took a lot of effort but it worths the time. A link to the changelog: https://github.com/v1s1t0r1sh3r3/air...r/CHANGELOG.md


Started to work on 9.01.

[undersc0re]

Awesome, thanks for your hard work, appreciate it, and love using it!

[v1s1t0r]

Hey, I released today v9.01 as a quick fix. It seems there was some problems using Evil Twin attacks because of the latest iptables update... now iptables command is launching nftables and the old iptables is on iptables-legacy command. So... because of this I did a quick fix in order to get it working flawlessly on any environment. airgeddon is going to detect if you have nftables and will do the needed job etc etc... anyway, for sure in the next future I'll need to adapt iptables rules for the new nftables stuff.

Regards.

[pamamolf]

Hello

Thanks for your great script !

"for sure in the next future I'll need to adapt iptables rules for the new nftables stuff."

Any ETA for this?

[v1s1t0r]

Not yet because with the fix, now is going to work always... but for sure it will be done. If I receive some help it can be done very soon. I just need to "translate" all the iptables commands to the new nomenclature... These are the commands to translate. Any help is welcome:

Saving and restoring:
iptables-save > file
iptables-restore < file

Probably saving and restoring will be the same

Cleaning rules:
iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -X

Cleaning stuff maybe will be unchanged (wild guess, didn't checked yet new nomenclature documentation)

Policy stuff:
iptables -P FORWARD ACCEPT

Some rules:
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.1:80
iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT
iptables -A INPUT -p udp --destination-port 53 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000

NAT masquerading:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Icmp stuff:
iptables -A INPUT -p icmp --icmp-type 8 -s 192.168.1.0/255.255.255.0 -d 192.168.1.1/255.255.255.0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 192.168.1.0/255.255.255.0 -d 192.168.1.1/255.255.255.0 -j DROP

That's all. For sure, airgeddon has more iptables rules... but most of them are "repeated" just with some different data (port or whatever)... but translating this I could adapt it to the new nftables. Any help? I have not too much time lately!

Thanks.

[v1s1t0r]

Done...@pamamolf, nftables integration is finished: https://github.com/v1s1t0r1sh3r3/airgeddon/pull/234

Now airgeddon detects if nft is present and if present is using it. If no nftables present it works as always using iptables... everything is done automatically. I even added a new option AIRGEDDON_FORCE_IPTABLES that can be set to true to force use of iptables instead of nftables if the user prefer that. It is documented as all options at wiki here: https://github.com/v1s1t0r1sh3r3/airgeddon/wiki/Options

This is milestoned to be released on next 9.10 version. Anyway you can use and test it now cloning dev branch of the project (git clone -b dev <repo>).

Cheers.

[v1s1t0r]

airgeddon v9.10 was released today. Now mdk3 was replaced by mdk4 . It has now support for nftables.

We are working hard on v9.20 which will have support for tmux in order to avoid the requirement of a X window system. It will be able to be configured in options .airgeddonrc file and on some environments (headless servers) could be an interesting feature.

Cheers!

[v1s1t0r]

Sorry for reposting... but if there are not too much activity I'll inform anyway about new releases here...

v9.11 released with some fixes making airgeddon compatible with BeEF versions. It seems on new BeEF versions there are some modifications in the config file. Now airgeddon is able to detect BeEF version and perform the needed changes in order to make it work with all of them even with the coming soon 0.4.7.2 BeEF version which did not reached yet the Kali repositories. I added also a couple of minor fixes and now once airgeddon update, the new .airgeddonrc file containing options is also updated to add new possible options and to avoid possible warnings. In addition, airgeddon will save the customizations on this file to avoid overriding them on update, so user can keep safely their customizations.

Tmux support is already done in another branch (headless_tmux) and is now under beta testing. v9.20 will have this new feature which will allow us to launch airgeddon on headless (without X window system) environments. Very useful for old raspberry pi or similar resources limited devices.

Cheers!

[smoothy]

Appreciate the update and love your work. This is by far the funnest setup out there and super reliable, all it needs is PMKID if you can be bothered.

[donThomaso]

Hi, I'm trying the wps bruteforce but it only tries the same pin over and over.

[v1s1t0r]

@smoothy, yeah, that will be implemented for sure!

@donThomaso, What airgeddon version do you have? are you trying reaver or bully bruteforce?

[donThomaso]

@donThomaso, What airgeddon version do you have? are you trying reaver or bully bruteforce?

I have the latest stable, and at the moment I'm running a reaver bruteforce. it does go on to an new pin after a few hours i noticed but it tried like 3 pins in half a day

[v1s1t0r]

hhmm.... it works ok for me. I think it depends of the Access Point. But in anycase it not seems an airgeddon issue. Maybe you want to ask to the reaver staff at their github.

[v1s1t0r]

v9.20 with tmux support to be used in headless servers was released today. Happy hacking!

[asmatadel]

thanks for your hard work

[derrikjeray]

This being said MTeams could find no indication that mac codes of the user are being spoofed and that users are broadcasting their hardware mac.

[v1s1t0r]

Due the retiring of the mdk4 package from the Debian testing repos and from the Kali repos, we added a feature to use mdk3 backward compatibility. For the next v9.21 there will be a new option at options file (.airgeddonrc) called AIRGEDDON_MDK_VERSION with the default value mdk4 but it can be changed to mdk3 to use mdk3 instead.

Now working on the custom certificates creation for enterprise attacks which will released on v9.21 as well. Cheers!

[dmatrix]

I noticed that Pixiedust only works on routers with Ralink chipset
do you know why?

[mkardo]

I've also noticed that wps null attack works on all v***zon D-link 2750b

[v1s1t0r]

The WPS Pixie Dust vulnerability is based on the lack of randomness over the PRNG used to cipher the public key. This vulnerability is affecting only to some Access Points. It depends of the vendor's WPS implementation. Some APs are affected and others are not affected. Here you can find a list (maybe is not pretty much up-to-date) about different access points regarding this topic: https://docs.google.com/spreadsheets...gid=2048815923

Take a look at it if you want to check how many access points are affected. You'll see there there are more APs affected than the Ralink chipset based. Hope it helps.

[v1s1t0r]

Hi, v9.21 was released today with custom certificates creation for enterprise attacks, some fixes and the backwards compatibility for mdk (now mdk3 or mdk4 can be chosen). Happy hacking!

[ea1kt]

Hi, v9.21 is working fine for me. Good job!!
I woluld suggest the following order for the windows:

window1: select wlan
window2: get it into monitor mode
window3: scan for targets
window4: choose attack mode

On my computers window4 appears before window3. Is there some reason for this?

[cold iron]

Hi Only one problem, it the mode where it's looking for sites to use, I find very few site as compeared to airodump-ng start wlan0. Seems like it lacks power. Are there any switches to up it's pull in power?