v3.0.0

KTO v3.0.0

A full rewrite in Rust. KTO is now a single binary that does its own 802.11
scanning and frame injection, so it no longer needs a Python/scapy runtime or
the aircrack-ng tools. The disconnection logic is built around your whitelist
and around what actually works against PMF.

Highlights

• Rewritten in Rust as one binary. No Python, no scapy, no airodump-ng or
  aireplay-ng. It talks to the adapter directly over a raw packet socket and
  only shells out to iw/ip for monitor mode and channel control.
• Whitelist-safe by default. It sends unicast deauth and disassociation to each
  non-whitelisted client, continuously, so there is no reconnect gap. Whitelisted
  devices are never targeted.
• PMF and WPA3 handling with --broadcast: a spoofed CSA beacon plus anonymous
  reassociation, no network password required. Those frames are broadcast by
  nature, so they take the whole BSS down and can't honor the whitelist, which is
  why they are opt-in. WPA3+PMF is designed to resist forged frames, so this is
  best-effort, not guaranteed.
• Live terminal dashboard: target and client panels, a TX-rate sparkline, an
  event log, and a boot animation. The client table marks each device UP, quiet,
  or DOWN so you can watch them drop, including during a broadcast attack. Pass
  --no-tui for plain scrolling output.
• Band-steering aware discovery. It surveys every BSSID advertising the SSID and
  lets you pick one, or target directly with -b/--bssid, take the first match
  with -f/--first, or lock a channel with -c. --client forces a specific
  MAC even when it is idle.
• Sends continuously by default (--sleep 0.05) so clients can't reconnect
  between bursts. Raise --sleep to throttle.

Breaking changes

• You build and run a Rust binary now: cargo build --release, then
  target/release/kto, instead of python3 kto.py.
• Requirements changed to a Rust toolchain and iw/ip, instead of Python,
  scapy, and the aircrack-ng suite.
• The experimental wrong-password EAPOL bypass was removed. PMF clients are
  handled by the CSA and reassociation vectors under --broadcast.
• Dropped or folded in: the separate aireplay engine, --aggressive (continuous
  is the default now), the old live-table flag (replaced by the dashboard), OUI
  vendor lookup, the session log, and the self-updater.

Requirements

• Linux, run as root.
• A Rust toolchain to build, and iw plus iproute2 (ip) on the machine you run
  it on.

Note on WPA3 / PMF

There is no whitelist-safe way to disconnect a PMF or WPA3 client. The only
frames that reach one are broadcast, so on those networks --broadcast is
all-or-nothing: it drops every client, whitelist included. That is a property of
PMF itself, not a KTO limitation.