Feature Request: Continuous automated handshake capture mode (like Airslax)

[firedance19871987-glitch]

Hello! First of all, thank you for your great work on this tool (wifit3). I would like to propose a new feature: automated continuous handshake capture, similar to how it is implemented in Airslax.How it would work:The tool would continuously loop through available Wi-Fi networks/channels in the background.It automatically targets access points, sends deauthentication packets (or waits for client association), and captures handshakes in an endless loop until stopped by the user.Why this is useful:This mode makes automated auditing much easier and faster, allowing users to passively or actively gather multiple handshakes without manually switching targets or restarting the scan every time.What do you think about adding this capability? Thank you for considering!

[derv82]

Yep, I've considered this feature ("Hack The Planet", "The Big Red button", --pillage in wifite2, some kind of "mass capture" mode):

1. Dwell on a channel (starting with CH1),
2. Deauth every AP on the channel (that we don't have captures for yet), wait X seconds for handshakes/PMKIDs to arrive.
3. Move on to the next channel and repeat.

This is mostly-free because wifit3 automatically saves any handshakes/PMKIDs seen from any AP, even outside of the Focus view. And fixed-channel periods allows wifit3 to spam deauths to every AP on that channel.

But there's a few snags that need to be ironed out:

1. The UI/UX.
   • Right now Campaigns are executed at the focused-AP level, where we can emit status, print logs, etc.
   • This new feature targets all APs on the channel (not just one) so Focus view doesn't make sense.
   • So we'd need a separate screen to show attack progress (number of handshakes/PMKIDs captured), and prevent the user from focusing on a single AP (to avoid contention with the automated channel selection).
   • New screen would show APs on channel, deauths sent, ACKs received, total handshakes captured, etc.
   • Click button -> Modal prompts user for inputs (TX iface, checkboxes for different deauth methods, a timer?), "START" button opens the new screen & begins the attack loop.
2. Ethical concerns ("This mode makes automated auditing much easier and faster")
   • It's also giving chimps machine guns; it's hard to claim that this is a legitimate auditing tool if it can DoS any-and-all nearby clients.
   • I honestly can't think of a legitimate pentesting scenario where you'd want to audit every single nearby wireless network.
   • Even corporate/university campus environments will probably have some networks that are off-limits.
   • Forcing the user to select every network to attack (in the Modal prompt) avoids these concerns.
3. The Wardriving/warwalking use-cases
   • Targets change over time, so "select every network" doesn't work in these cases.
4. Full suite automation
   • We're only talking about deauths; but wifit3 has PMKID and evil twin and other campaigns.
   • Ideally the user could select which campaigns to run during the automated loop.
   • But some campaigns are invasive (evil twin) and specific to a single AP.

So, I've thought about it, and yea we can probably do it. But I don't want to roll out an entirely new UI/UX feature that only works for one thing (deauthing WPA networks).

And if we add the Big Red Button to wifit3, then that's the feature that everyone will use, instead of the targeted focus attacks. And wifit3 becomes the blitz mode, and all features requests are building on top of that mode... which, if we don't figure out point 4 above, becomes a pain to maintain.

[xxcosita3czxx]

Well, that was my idea with automation plugins, let people do it themselves, cause of the concerns. Simple, people are themselves responsible for their plugins, and our codebase stays ethical. Basicaly my idea "free wifi mode", captures passively handshakes, tries cracking them with the tools and wordlists, and free wifi if the person happens to have stupidly easy password. not exacly ethical worded this way but it would be my responsibility to have such plugin that does this, not maintainers.

[firedance19871987-glitch]

No, it should work in a separate window and scan the channels one by one. If there is a router on a channel, it starts scanning how many routers are on that channel, finds the clients and disconnects them. When everything is successful, the router is added to a list so that next time it has immunity — it is no longer bothered. This can continue indefinitely until only the most resilient ones remain.