AIRDECLOAK-NG(1)

Okay bestie, this is the AIRDECLOAK-NG(1) page from the General Commands Manual 💅🎀 Yes, the tool is airuncloak-ng, so the name is a little plot twist 🙈

✨ NAME ✨

airuncloak-ng is the tool for removing WEP cloaked frames from a pcap file 🦋

---

🧚 SYNOPSIS 🧚

airuncloak-ng <options>

---

💖 DESCRIPTION 💖

okay so airuncloak-ng strips WEP cloaking off a pcap file 🫶 Some WIPS (actually one) try to "prevent" cracking a WEP key by shoving chaff (fake WEP frames) into the air to fool aircrack-ng 😭 In some rare cases the cloaking fails and the key can still be recovered without removing that chaff. But when the key can't be recovered, this is the tool you use to filter the chaff out 💅

The program reads the input file and picks out packets from one specific network. Each selected packet goes into a list and gets classified (default status is "unknown") 🌸 Then filters are applied to that list, in the order you specify 👑 They change the status of the packets (unknown, uncloaked, potentially cloaked or cloaked). The order matters SO much, because each filter bases its analysis partly on the status of the packets, so different orders give different results 💀

Important requirement: the pcap file needs ALL the packets (including beacons and every other "useless" packet) for the analysis, and if possible, prism/radiotap headers 🙈

---

🎀 OPTIONS 🎀

• -h, --help — shows the help screen 💖
• -i <file> — path to the capture file 📂
• --ssid <ESSID> — the ESSID of the network to filter (not yet implemented) 🥺
• --bssid <BSSID> — the BSSID of the network to filter 🦋
• --null-packets — assumes null packets can be cloaked (not yet implemented) 🌈
• --disable-base-filter — don't apply the base filter 🙅
• --drop-frag — drop fragmented packets 🍓
• --filters <filters> — apply different filters, separated by a comma. See below ⭐

---

🌈 FILTERS 🌈

• signal — tries to filter based on signal, using the prism or radiotap headers in the pcap file 📶
• duplicate_sn — removes all duplicate sequence numbers for both the AP and the client (as long as they're close to each other) 👯
• duplicate_sn_ap — removes duplicate sequence numbers for the AP only (as long as they're close to each other) 🏠
• duplicate_sn_client — removes duplicate sequence numbers for the client only (as long as they're close to each other) 📱
• consecutive_sn — filters based on the fact that IV should be consecutive (only for AP) 🔢
• duplicate_iv — filters out all duplicate IVs 🗑️
• signal_dup_consec_sn — combines signal (if available), duplicate and consecutive sequence numbers. It's way more precise than running all these filters one by one 👑

---

🧁 AUTHOR 🧁

This manual page was written by Thomas d'Otreppe. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation. On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

---

🔗 SEE ALSO 🔗

• airbase-ng(8)
• aireplay-ng(8)
• airmon-ng(8)
• airodump-ng(8)
• airodump-ng-oui-update(8)
• airserv-ng(8)
• airtun-ng(8)
• besside-ng(8)
• easside-ng(8)
• tkiptun-ng(8)
• wesside-ng(8)
• aircrack-ng(1)
• airdecap-ng(1)
• airolib-ng(1)
• besside-ng-crawler(1)
• buddy-ng(1)
• ivstools(1)
• kstats(1)
• makeivs-ng(1)
• packetforge-ng(1)
• wpaclean(1)
• airventriloquist(8)

---

Version 1.7.0, May 2022 🌸 That's the whole page, bestie, and the AIRDECLOAK-NG(1) crew is obsessed with you 💜✨