Configuration

Configuration

Advanced configuration options for WirelessXPL-Forge.

---

Global Framework Options

Set these at the main wxf > prompt. They apply to all modules unless overridden per-module.

wxf > set LOGLEVEL debug
wxf > set TIMEOUT 10
wxf > set THREADS 4
wxf > set SIMULATE true
wxf > set OUTPUT_DIR /evidence
wxf > set SESSION_ID pentest_office_2026_06

Option	Default	Description
LOGLEVEL	info	Log verbosity: debug, info, warning, error
TIMEOUT	30	Network/capture timeout in seconds
THREADS	2	Parallel threads for scan-type modules
SIMULATE	false	Global dry-run flag
OUTPUT_DIR	/tmp	Default output directory for captures and exports
SESSION_ID	``	Identifier for Evidence Vault and Session Manager

---

Configuration File

WXF reads ~/.wxf/config.yaml (or wxf.yaml in the working directory) on startup.

# ~/.wxf/config.yaml

framework:
  loglevel: info
  timeout: 30
  threads: 2
  simulate: false
  output_dir: /evidence

defaults:
  interface: wlan0mon
  gps_port: /dev/ttyACM0
  vault_dir: /evidence
  operator: j.analyst

modules:
  subghz:
    default_interface: hackrf
    default_simulate: true

  drones:
    mavlink_timeout: 5

  wids:
    deauth_thresh: 10
    beacon_thresh: 50
    alert_log: /logs/wids_alerts.json

---

Interface Setup

WiFi monitor mode

# Using aircrack-ng suite
sudo airmon-ng check kill
sudo airmon-ng start wlan0
# Creates: wlan0mon

# Using iw
sudo ip link set wlan0 down
sudo iw wlan0 set monitor none
sudo ip link set wlan0 up

# Verify
iw wlan0mon info

Channel management

# Lock to channel 6
sudo iw wlan0mon set channel 6

# Lock to channel 6 with HT40+
sudo iw wlan0mon set channel 6 HT40+

# WXF handles channel locking internally when CHANNEL option is set
wxf (HandshakeSnooper) > set CHANNEL 6

---

Proxy and Network Options

For modules that make outbound connections (MAVLink, maritime, etc.), set network options per-module:

wxf (MAVLinkScanner) > set RHOST 192.168.1.100
wxf (MAVLinkScanner) > set RPORT 14550
wxf (MAVLinkScanner) > set TIMEOUT 5

---

Output and Logging

Log levels

wxf > set LOGLEVEL debug
[*] Verbose logging enabled
[DEBUG] Module loaded: generic/wifi_lab/handshake_snooper
[DEBUG] Option set: INTERFACE = wlan0mon
...

wxf > set LOGLEVEL warning
[*] Only warnings and errors will be shown

File logging

# Run WXF with output logged to file
python wxf.py 2>&1 | tee /logs/wxf_session_20260608.log

# Or within WXF:
wxf > set LOG_FILE /logs/wxf_session_20260608.log

---

Hashcat Integration

WXF exports captures in formats ready for hashcat:

# WPA2 PMKID / EAPOL (mode 22000)
hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt

# WPA2 EAPOL handshake only (legacy mode)
hashcat -m 2500 capture.hccapx /usr/share/wordlists/rockyou.txt

# WPA2 with rules
hashcat -m 22000 capture.hc22000 rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Check hardware
hashcat -I

---

Environment Variables

Override configuration via environment variables (prefix WXF_):

export WXF_LOGLEVEL=debug
export WXF_OUTPUT_DIR=/mnt/evidence
export WXF_SIMULATE=true
export WXF_INTERFACE=wlan0mon
python wxf.py

---

WSL2 Notes

For WSL2 users, USB WiFi adapters require USB passthrough:

# Windows PowerShell (admin)
usbipd list
usbipd bind --busid 1-1
usbipd attach --wsl --busid 1-1

# WSL2 (Linux)
lsusb  # verify adapter visible
sudo airmon-ng start wlan0

HackRF and RTL-SDR also require USB passthrough via usbipd-win.

---

Dependency Check

After any install or system change, run the dependency audit:

wxf > use generic/external/wireless_tool_prereq_audit
wxf (PrereqAudit) > run

[*] Checking system tool dependencies...
[+] aircrack-ng       : found (/usr/bin/aircrack-ng) v1.7
[+] hcxdumptool       : found (/usr/bin/hcxdumptool) v6.2.7
[+] hashcat           : found (/usr/bin/hashcat) v6.2.6
[+] tshark            : found (/usr/bin/tshark) v4.2.0
[+] hackrf_transfer   : found (/usr/local/bin/hackrf_transfer) 2023.01.1
[+] rtl_test          : found (/usr/bin/rtl_test) v0.6.0
[!] mdk4              : NOT FOUND - optional (beacon flood, deauth storm)
[!] hostapd           : NOT FOUND - optional (evil twin, rogue AP)
[*] Core tools: OK | Optional tools: 2 missing
[*] Install missing: sudo apt install mdk4 hostapd dnsmasq

---

Related pages: Quick Start | CLI Reference | Hardware

---

Author: Andre Henrique (@mrhenrike) | Uniao Geek