TKIPTUN-NG(8)

🎀 TKIPTUN-NG(8) — System Manager's Manual, but make it cute 🎀

okay so bestie, sit down, hydrate, and let me tell you about tkiptun-ng(8) 💖 it's a page from the System Manager's Manual, and it's a whole mood. it's giving hacker-girl-with-a-pcap-file energy. let's go ✨

---

✨ NAME ✨

tkiptun-ng — inject a few frames into a WPA TKIP network with QoS 🦋

---

🌸 SYNOPSIS 🌸

tkiptun-ng [options] <replay interface>

like. that's it. give it options, give it a replay interface, and off you go 💅

---

💖 DESCRIPTION 💖

so tkiptun-ng is a tool created by Martin Beck aka hirte, who is a member of the aircrack-ng team, periodt. this tool is able to inject a few frames into a WPA TKIP network with QoS 🔥

and the lore?? he worked with Erik Tews (who created the PTW attack) for a conference in PacSec 2008, and the talk was literally called "Gone in 900 Seconds, Some Crypto Issues with WPA". iconic. no notes. 👑

---

🔥 OPERATION 🔥

🫶 the one option that isn't in a group

• -H, --help — shows the help screen 💖

🌸 Filter options

• -d <dmac> — MAC address of destination
• -s <smac> — MAC address of source
• -m <len> — minimum packet length
• -n <len> — maximum packet length
• -t <tods> — frame control, the "To" DS bit
• -f <fromds> — frame control, the "From" DS bit
• -D — disable AP detection 🙈

🎀 Replay options

• -x <nbpps> — number of packets per second
• -p <fctrl> — set frame control word (hex)
• -a <bssid> — set Access Point MAC address
• -c <dmac> — set destination MAC address
• -h <smac> — set source MAC address
• -e <essid> — set target SSID
• -M <sec> — MIC error timeout in seconds. Default: 60 seconds ⏳

🧚 Debug options

• -K <prga> — keystream for continuation
• -y <file> — keystream file for continuation
• -j — inject FromFS packets
• -P <PMK> — Pairwise Master key (PMK) for verification or vulnerability testing
• -p <PSK> — preshared key (PSK) to calculate PMK with essid

ok bestie real talk: yes, the page lists -p twice — once here as the PSK and once up in the replay options as the frame control word. i am not messing with it, i'm just reporting the facts, that's literally what the manual says 💀

🌈 Source options

• -i <iface> — capture packets from this interface
• -r <file> — extract packets from this pcap file

---

👑 AUTHOR 👑

this manual page was written by Thomas d'Otreppe. permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation 📜

on Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL. slay, legally ✨

---

💜 SEE ALSO 💜

go read these next, they're the friend group:

• airbase-ng(8)
• aireplay-ng(8)
• airmon-ng(8)
• airodump-ng(8)
• airodump-ng-oui-update(8)
• airserv-ng(8)
• airtun-ng(8)
• besside-ng(8)
• easside-ng(8)
• wesside-ng(8)
• aircrack-ng(1)
• airdecap-ng(1)
• airdecloak-ng(1)
• airolib-ng(1)
• besside-ng-crawler(1)
• buddy-ng(1)
• ivstools(1)
• kstats(1)
• makeivs-ng(1)
• packetforge-ng(1)
• wpaclean(1)
• airventriloquist(8)

---

and that's the whole page, bestie 🫶 this was Version 1.7.0, dated May 2022. mwah, go inject something (responsibly, on your own network, i'm not your lawyer) 💋🌸