FuzzAP

KO | EN

gitlite — search

#typescript #ai-agents #deepseek-harness #dsh-plugin #open-source #ai #cli #dsh #claude-code #codex #developer-tools #react

★ 80 Open GitHub ↗

A python script for obfuscating wireless networks

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

FuzzAP
======

A python script for obfuscating wireless networks

'''
Warning: I am not a programmer by trade, nor would I consider myself one

The common SSID list was pulled from https://wigle.net/gps/gps/Stat
The OUI vendor list was parsed from http://standards.ieee.org/develop/regauth/oui/oui.txt 
for well known vendors (netgear, cisco, linksys, d-link, atheros, ralink, apple)

This idea was created based off of Black Alchemy's FakeAP 
http://www.blackalchemy.to/project/fakeap/ and Pettinger's airraid 
http://www.pettingers.org/code/airraid.html
Some logic for parsing required info from packets was taken from Leandro Meiners 
(lea@coresecurity.com) at Core Security Technology's Power-Saving DoS script

The main differences between these implementations is hardware requirements and how the 
fake access point is generated.

FakeAP generates fake access points by creating an access point using iw and ifconfig 
with a PRISM-based wireless card. The problem is PRISM drivers are mostly deprecated in
most modern distros. Even with a working driver and a PRISM card, I was unable to get
FakeAP to work out of the box.

AirRaid is almost identical to how FakeAP works. However, it is tailored towards Atheros-
based cards and utilizes the madwifi drivers and utilities to create fake access points.
The Madwifi projects seems to be mostly dying down in favor of ath5/9k drivers.
Out-of-the-box, AirRaid no longer worked with my atheros card.

Another problem with these implementations, was speed. As each fake access point was
created, the wireless deviced had to be up-downed and reconfigured.

This implementation differs in a number of ways. It is not totally hardware specific like
FakeAP or AirRaid. Instead of creating a fake access point by changing the settings for 
the wireless adapter and having to reset and reconfigure the device, it takes advantage of
 wireless cards that support packet-injection.

This helps in a number of ways. It supports far more adapters as well as a lot
of modern drivers that support packet-injection and monitor-mode (rtl8187, ath5k, ath9k,
most ralink, etc...). In short, any device that has drivers that can allow an adapter to 
run in monitor-mode via airmon-ng, can use this. Because this utilizes packet-injection 
instead of actually creating an access-point, it injects packets that look like they are
from actual access points.

This is my first project in python, so there are likely going to be flaws, inefficiencies, 
possible ways to detect which APs are the fake ones. I plan on improving this over time as
 problems are discovered and enhancements requested.

One may need less than these requirements to make this work, but I know they work with
the following:

Atheros-based cards using ath5k and ath9k
Realtek 8187 chipsets(ie Alfa AWUS 036H)
Most Ralink chipsets

This was coded in python 2.7 with Scapy 2.2.0. I really don't have a firm grasp on Scapy
as their documentation is kind of thin, so anything done incorrectly, please let me know.
airmon-ng was used to create the monitor interfaces which allows packet injection.

I also realize this writeup is longer than the actual code.

------------------------------------------------------------------------------------------

To run:

Requires python 2.7, Scapy 2.2.0, wireless card with drivers that support packet injection

#####EARLY VERSION WARNING#####

There is virtually no logging for this as I don't know scapy very well at this point, and
when it sends beacon frames and probe responses, it sends "Sent 1 packets" to the terminal.
When we are sending multiple packets a second, this spams your screen with "Sent 1 packets"
I am currently working on finding a way around this and provide more useful logging.

Make sure you have a wireless NIC in monitor mode with packet injection capabilities. I use 
the aircrack-ng suite's airmon-ng to do this:

airmon-ng start \<interface\>

Which should tell you the new virtual monitoring interface that has been created (something like
mon 0)

FuzzAP.py takes four required arguments. First argument is the interface to use, the second
is the number of fake access points to generate, the third is a file of OUIs,
fourth is a file full of SSIDs

sudo python fuzzap.py \<interface\> \<number of APs\> \<OUI file\> \<ssid file\>

If you want to run this out of the repository:

sudo python fuzzap.py \<interface\> \<number of APs\> common.txt ssid.txt

What it looks like from a client perspective: http://imgur.com/QsoFP1a

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
'''

TODO:

Bogus traffic between 'APs' and 'clients'
Channel hopping

FuzzAP

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README