Disconnect devices from WiFi networks. Deauthentication Attack using aireplay-ng
Tags: cybersecurity, ethicalhacking, hacking, linux
Published: 2022-02-27 04:24:37

Hello! In this post I will explain to you how to deauthenticate any device from a WiFi network without beeing connected to the network itself!
**_Beware, this is illegal without permission, and it can be detected._**

### What you should know:
 - Target Device MUST be connected to a WiFi network. 
 - The target device might switch to another WiFi network that's saved. Or use mobile data.
 - You need a WiFi adapter that supports monitor mode. (_I am using the **Alfa AWUS036ACH**_)

### Data you need to perform the attack:
 - The router its _BSSID_.
 - The target device its _MAC Address_.

_(Will be explained how to get this data.)_


## How it's done: 
First you need to make sure that your adapter is in monitor mode (_so it can start receiving packets around you._)
You can check the mode of your adapter with `$ iwconfig`

![iwconfig command in managed mode](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cfp9pzc58bs3stqrw4i8.png)

If it's not in monitor mode yet you need to follow these steps:
 - Disable your adapter `$ ifconfig wlan1 down`
 - Change mode to monitor mode `$ iwconfig wlan1 mode monitor`
 - Enable the adapter `$ ifconfig wlan1 up`
 

![commands to enable monitor mode](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lkom0wca45muo921sdvf.png)
 
Now that your adapter is in monitor mode, it can receive all WiFi packets sent all around you from different devices. (_Even if you are not connected to the network, or if you don't have the password of the network._)

![iwconfig command with monitor mode turned on](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iwxdgb7td9uoi94fae5r.png)

What we need to do now, is intercept those packets. To intercept those packets we are using a packet sniffer called _airodump-ng_.
This will allow us to collect data from nearby WiFi connections (_such as the **BSSID**, **Channel**, **Encryption method**_) and even devices connected to the networks.

To use _airodump-ng_ we can run the following command, and the given interface _[wlan1]_ will start collecting data.
`$ airodump-ng wlan1`

![terminal airodump-ng wlan1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vs7mkdj66r6qqxiqsz9n.png)

When you see the networks listed. You can use this information as a filter to collect data of a specific network.
Now you can specify the bssid and channel of the network.
`$ airodump-ng --bssid [NETWORK_BSSID] --channel [NETWORK_CHANNEL] wlan1`

Optionally you can use `--write [filename]` in the command. This way you save the collected packets in a file, which you could analyze further with wireshark.

![command airodump-ng with bssid and channel specified](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/afeqfwt8108jx0walyxq.png)

Now we can see the devices connected to the network. (Listed under **_STATION_**)
Once you have the _MAC Address_ of the target device, and the _BSSID_ of the router. You have enough information to start the deauthentication attack.

![result airodump-ng with bssid and channel specified](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g47ohuognm7xkmtt909v.png)

To start the deauthentication attack you can use the following command:
`$ aireplay-ng --deauth 0 -a [ROUTER_BSSID] -c [TARGET_MAC_ADDRESS] wlan1`

`--deauth 0` means that you will send infinite deauthentication packets. It stops sending packets whenever you stop the program from executing. (`CTRL + C`)
**_(NOTE: airodump-ng should be running with the bssid & channel specified simultaneously with aireplay-ng! )_**

![terminal of deauthentication attack](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6x0z7k8qfw022nl0fxir.png)