AIRBASE-NG(8)

📦
version 1.7+git20230807.4bf83f1a · 3 versions
, in debian trixie, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 NAME 💖

airbase-ng — a multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself 👑 iykyk

✨ SYNOPSIS ✨

airbase-ng [options] <interface name>

🦋 DESCRIPTION 🦋

okay so bestie, airbase-ng is a multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself. the way it's so versatile and flexible that summarizing it is literally a challenge?? like, where do we even start. here are some of the feature highlights 💅:

  • Implements the Caffe Latte WEP client attack ☕
  • Implements the Hirte WEP client attack 🐑
  • Ability to cause the WPA/WPA2 handshake to be captured 🔥
  • Ability to act as an ad-hoc Access Point 📡
  • Ability to act as a full Access Point 👑
  • Ability to filter by SSID or client MAC addresses 🔍
  • Ability to manipulate and resend packets 🎀
  • Ability to encrypt sent packets and decrypt received packets 🔐

the main idea of the implementation is that it should encourage clients to associate with the fake AP, not prevent them from accessing the real AP. it's giving inviting, not blocking 🫶

a tap interface (atX) is created when airbase-ng is run. this can be used to receive decrypted packets or to send encrypted packets. slay, free real estate 💖

as real clients will most probably send probe requests for common/configured networks, these frames are important for binding a client to our softAP. in this case, the AP will respond to any probe request with a proper probe response, which tells the client to authenticate to the airbase-ng BSSID 🌸

⚠️ that being said, this mode could possibly disrupt the correct functionality of many APs on the same channel. no cap, so be aware 💀

✨ OPTIONS ✨

okay bestie, here's the whole flag menu. every single one, no skips. periodt. 💅

  • -H, --help — shows the help screen. like, it literally pops up the help. 💖
  • -a <bssid> — if the BSSID isn't explicitly specified by using -a <BSSID>, then the current MAC of the specified interface is used. so it just borrows the MAC. 🎀
  • -i <iface> — also capture and process from this interface in addition to the replay interface. double the interfaces, double the vibe. ✨
  • -w <WEP key> — if WEP should be used as encryption, then the parameter -w <WEP key> sets the en-/decryption key. this is sufficient to let airbase-ng set all the appropriate flags by itself. if the softAP operates with WEP encryption, the client can choose to use open system authentication or shared key authentication. both authentication methods are supported by airbase-ng. but to get a keystream, the user can try to force the client to use shared key authentication. -s forces a shared key auth and -S <len> sets the challenge length. so yeah, WEP key goes in, flags sort themselves out. 🔑
  • -h <MAC> — this is the source MAC for the man-in-the-middle attack. the -M must also be specified. don't forget it. 💅
  • -f <disallow> — if this option is not specified, it defaults to -f allow. this means the various client MAC filters (-d and -D) define which clients to accept. by using the -f disallow option, this reverses selection and causes airbase-ng to ignore the clients specified by the filters. flip the script, bestie. 🔥
  • -W <0|1> — this sets the beacon WEP flag. remember that clients will normally only connect to APs which are the same as themselves. meaning WEP to WEP, open to open. the auto option is to allow airbase-ng to automatically set the flag based on context of the other options specified. for example, if you set a WEP key with -w, then the beacon flag would be set to WEP. one other use of auto is to deal with clients which can automatically adjust their connection type. however, these are few and far between. in practice, it is best to set the value to the type of clients you are dealing with. 💡
  • -q — this suppresses printing any statistics or status information. quiet mode, lowkey. 🤫
  • -v — this prints additional messages and details to assist in debugging. verbose bestie. 🐛
  • -M — this option is not implemented yet. it is a man-in-the-middle attack between specified clients and BSSIDs. so don't expect it to work. 😭
  • -A, --ad-hoc — this causes airbase-ng to act as an ad-hoc client instead of a normal Access Point. in ad-hoc mode airbase-ng also sends beacons, but doesn't need any authentication/association. it can be activated by using -A. the soft AP will adjust all flags needed to simulate a station in ad-hoc mode automatically and generate a random MAC, which is used as CELL MAC instead of the BSSID. this can be overwritten by the -a <BSSID> tag. the interface MAC will then be used as source mac, which can be changed with -h <sourceMAC>. ad-hoc energy. 🦋
  • -Y <in|out|both> — the parameter -Y enables the "external processing" Mode. this creates a second interface atX, which is used to replay/modify/drop or inject packets at will. this interface must also be brought up with ifconfig and an external tool is needed to create a loop on that interface.

the packet structure is rather simple: the ethernet header (14 bytes) is ignored and right after that follows the complete ieee80211 frame the same way it is going to be processed by airbase-ng (for incoming packets) or before the packets will be sent out of the wireless card (outgoing packets). this mode intercepts all data packets and loops them through an external application, which decides what happens with them. the MAC and IP of the second tap interface doesn't matter, as real ethernet frames on this interface are dropped anyway.

there are 3 arguments for -Y: in, out and both, which specify the direction of frames to loop through the external application. obviously in redirects only incoming (through the wireless NIC) frames, while outgoing frames aren't touched. out does the opposite, it only loops outgoing packets and both sends all both directions through the second tap interface.

there is a small and simple example application to replay all frames on the second interface. the tool is called replay.py and is located in ./test. it's written in python, but the language doesn't matter. it uses pcapy to read the frames and scapy to possibly alter/show and reinject the frames. the tool as it is, simply replays all frames and prints a short summary of the received frames. the variable packet contains the complete ieee80211 packet, which can easily be dissected and modified using scapy.

this can be compared to ettercap filters, but is more powerful, as a real programming language can be used to build complex logic for filtering and packet customization. the downside on using python is, that it adds a delay of around 100ms and the cpu utilizations is rather large on a high speed network, but its perfect for a demonstration with only a few lines of code. ✨

  • -c <channel> — this is used to specify the channel on which to run the Access Point. pick your channel, bestie. 📡
  • -X, --hidden — this causes the Access Point to hide the SSID and to not broadcast the value. stealth mode activated. 🤫
  • -s — when specified, this forces shared key authentication for all clients. the soft AP will send an "authentication method unsupported" rejection to any open system authentication request if -s is specified. so if you want shared key, say it with your chest. 💅
  • -S — it sets the shared key challenge length, which can be anything from 16 to 1480. the default is 128 bytes. it is the number of bytes used in the random challenge. since one tag can contain a maximum size of 255 bytes, any value above 255 creates several challenge tags until all specified bytes are written. many clients ignore values different than 128 bytes so this option may not always work. so yeah, 128 is the vibe. 🎀
  • -L, --caffe-latte — airbase-ng also contains the new caffe-latte attack, which is also implemented in aireplay-ng as attack -6. it can be used with -L or caffe-latte. this attack specifically works against clients, as it waits for a broadcast arp request, which happens to be a gratuitous arp. see this for an explanation of what a gratuitous arp is. it then flips a few bits in the sender MAC and IP, corrects the ICV (crc32) value and sends it back to the client, where it came from. the point why this attack works in practice is, that at least windows sends gratuitous arps after a connection on layer 2 is established and a static ip is set, or dhcp fails and windows assigned an IP out of 169.254.X.X.

-x <pps> sets the number of packets per second to send when performing the caffe-latte attack. at the moment, this attack doesn't stop, it continuously sends arp requests. Airodump-ng is needed to capture the replies. ☕

  • -N, --cfrag — this attack listens for an ARP request or IP packet from the client. once one is received, a small amount of PRGA is extracted and then used to create an ARP request packet targeted to the client. this ARP request is actually made of up of multiple packet fragments such that when received, the client will respond. this attack works especially well against ad-hoc networks. as well it can be used against softAP clients and normal AP clients. 💥
  • -x <nbpps> — this sets the number of packets per second that packets will be sent (default: 100). so if you don't set it, it's 100 pps. 🚀
  • -y — when using this option, the fake AP will not respond to broadcast probes. a broadcast probe is where the specific AP is not identified uniquely. typically, most APs will respond with probe responses to a broadcast probe. this flag will prevent this happening. it will only respond when the specific AP is uniquely requested. so no random probe responses. 🙅‍♀️
  • -0 — this enables all WPA/WPA2/WEP Tags to be enabled in the beacons sent. it cannot be specified when also using -z or -Z. so don't mix them. ⚠️
  • -z <type> — this specifies the WPA beacon tags. the valid values are: 1=WEP40 2=TKIP 3=WRAP 4=CCMP 5=WEP104. pick one. 🔐
  • -Z <type> — same as -z, but for WPA2. 🔐
  • -V <type> — this specifies the valid EAPOL types. the valid values are: 1=MD5 2=SHA1 3=auto. 🔑
  • -F <prefix> — this option causes airbase-ng to write all sent and received packets to a pcap file on disk. this is the file prefix (like airodump-ng -w). save it for later. 💾
  • -P — this causes the fake access point to respond to all probes regardless of the ESSIDs specified. all the probes, all the time. 📡
  • -I <interval> — this sets the time in milliseconds between each beacon. tick tock. ⏱️
  • -C <seconds> — the wildcard ESSIDs will also be beaconed this number of seconds. a good typical value to use is -C 60 (require -P). so -C 60 with -P is a vibe. ✨
  • -n <hex> — ANonce (nonce from the AP) to use instead of a randomized one. it must be 64 hexadecimal characters. exactly 64. no cap. 🔢

🌸 Filter options 🌸

💖 AUTHOR 💖

this manual page was written by Thomas d'Otreppe. permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL. 📜

👀 SEE ALSO 👀

okay bestie, so airbase-ng does NOT exist in a vacuum, she's part of a whole iconic friend group 💅 and you're gonna want to know the whole squad. here's the roster, fr fr:

and that's the whole page bestie, no cap, you made it to the end 🎉 go forth and be dangerous in a legal and authorized way only, okay? 😭💖

this lil masterpiece is Version 1.7.0, dated May 2022, and yeah — you were reading AIRBASE-NG(8) the whole time. periodt. ✨💜

📦 where this page comes from