tkiptun-ng8
Inject a few frames into a wpa tkip network with qos
Usage
tkiptun-ng [options]
<replay
interface>
Overview
tkiptun-ng is a tool created by Martin Beck aka hirte, a member of aircrack-ng team. This tool is able to inject a few frames into a WPA TKIP network with QoS. He worked with Erik Tews (who created PTW attack) for a conference in PacSec 2008: "Gone in 900 Seconds, Some Crypto Issues with WPA".
Operation
- -H, --help
-
Shows the help screen.
- Filter options:
- -d <dmac>
-
MAC address of destination.
- -s <smac>
-
MAC address of source.
- -m <len>
-
Minimum packet length.
- -n <len>
-
Maximum packet length.
- -t <tods>
-
Frame control, "To" DS bit.
- -f <fromds>
-
Frame control, "From" DS bit.
- -D
-
Disable AP Detection.
- Replay options:
- -x <nbpps>
-
Number of packets per second.
- -p <fctrl>
-
Set frame control word (hex).
- -a <bssid>
-
Set Access Point MAC address.
- -c <dmac>
-
Set destination MAC address.
- -h <smac>
-
Set source MAC address.
- -e <essid>
-
Set target SSID.
- -M <sec>
-
MIC error timeout in seconds. Default: 60 seconds
- Debug options:
- -K <prga>
-
Keystream for continuation.
- -y <file>
-
Keystream file for continuation.
- -j
-
Inject FromFS packets.
- -P <PMK>
-
Pairwise Master key (PMK) for verification or vulnerability testing.
- -p <PSK>
-
Preshared key (PSK) to calculate PMK with essid.
- Source options:
- -i <iface>
-
Capture packets from this interface.
- -r <file>
-
Extract packets from this pcap file.
Releases
7 releases since Debian 8 (Jessie); the text changed 4 times.