Repository navigation
Modules
58 modules. Every one is a standalone script in modules/, runnable without
the GUI. Run any with --help for its verbs, or --info for a summary.
A module does one job and reports honestly whether it did it.
- Output is TSV; errors go to stderr with a non-zero exit code
- Hardware-gated modules name the missing hardware instead of returning empty
- Every module has a
--selftestthat passes with no hardware attached
The last point is the design goal. A module reporting OK while the target is untouched is worse than one that fails loudly, and several modules carry explicit notes about which third-party tool has that failure mode.
◆ marks modules that work with no radio at all.
| # | Module | Script | What it does |
|---|---|---|---|
| 00 | Dependencies | 00_deps.sh |
Checks for required tools, reports versions, offers to install what's missing |
| 01 | Interface Manager | 01_iface.sh |
Lists interfaces, reports driver capabilities, switches monitor and AP mode, clears stuck interfaces |
01_iface is the one to know first. It reports what your driver actually
supports rather than what the card claims:
modules/01_iface.sh --list-tsv
modules/01_iface.sh --caps-tsvIt also handles conflict cleanup — killing processes holding an interface, and restoring managed mode when a module dies mid-capture.
| # | Module | Script | What it does |
|---|---|---|---|
| 02 | Wi-Fi Recon | 02_recon.sh |
airodump-ng wrapper with 6 GHz support, filters and JSON state |
| 03 | WPA/2 Attack | 03_attack.sh |
WPA/WPA2 handshake capture and cracking |
| 04 | Evil Twin | 04_eviltwin.sh |
Rogue AP impersonating a target |
| 08 | Offline PMKID | 08_pmkid_offline.sh |
◆ Cracks a captured PMKID from a file |
| 09 | Wardriving | 09_wardrive.sh |
GPS-tagged survey logging |
| 10 | Rogue DHCP | 10_rogue_dhcp.sh |
Rogue DHCP server, for pairing with an evil twin |
| 11 | KRACK / Kr00k | 11_krack_kr00k.sh |
KRACK (CVE-2017-13077..13088) and Kr00k (CVE-2019-15126) |
| 17 | WPS Attack | 17_wps_attack.sh |
Pixie dust, PIN brute force, and the rest of the WPS surface |
| 20 | Karma | 20_karma.sh |
Karma / known-beacons attack, via hostapd-mana
|
| 21 | Wi-Fi DoS / Flood | 21_beacon_flood.sh |
Beacon and frame flooding |
| 22 | Wi-Fi Direct / P2P | 22_wifi_direct.sh |
P2P enumeration and research |
| 23 | Portal Builder | 23_captive_portal_builder.sh |
◆ Renders HTML captive portals |
| 34 | PMF Bypass | 34_pmf_bypass.sh |
802.11w Management Frame Protection — tests and explains what the verdicts mean |
| 35 | Wi-Fi 6 Attacks | 35_wifi6_attacks.sh |
Wi-Fi 6 (802.11ax) attack surface |
| 47 | WPA3 / SAE Attack | 47_wpa3_attack.sh |
WPA3-Personal (SAE) attack surface on this host |
| 48 | WEP Attacks | 48_wep_attack.sh |
WEP attack surface |
| 53 | Jamming | 53_jamming.sh |
Frame-level jamming via the modwifi driver |
| 54 | Client Isolation | 54_client_isolation.sh |
Client isolation bypass testing |
| 55 | SSID Overflow | 55_ssid_overflow.sh |
SSID-borne buffer overflow, combined with injection |
On 53_jamming: not a deauth flood. It does reactive jamming, carrier-sense
manipulation and FCS corruption through a modified Atheros driver, and can jam
one access point's beacons while leaving the rest of the channel alone. Needs
the modwifi driver — --caps-tsv tells you whether yours supports it.
On 54_client_isolation: includes gateway bouncing, port stealing,
broadcast reflection and an inter-NIC relay to hold the bypass open. Also
carries the traffic-rewrite rules (--rewrite-add, --rewrite-list) used by
the relay. Needs two interfaces associated at once.
On 21_beacon_flood and several others: the module documents that it
verifies frames actually left the adapter, because aireplay-ng and mdk4
exit 0 whether or not a frame was transmitted. Reporting a successful attack
that never happened is the failure mode being guarded against.
| # | Module | Script | What it does |
|---|---|---|---|
| 05 | Bluetooth Recon | 05_bt_recon.sh |
Classic and BLE device discovery |
| 06 | Bluetooth Attack | 06_bt_attack.sh |
Classic + BLE attack primitives |
| 24 | BLE Mesh | 24_bt_mesh.sh |
Mesh enumeration, sniffing, provisioning capture |
| 36 | Tracker Hunt | 36_ble_tracker_hunt.sh |
BLE tracker detection |
| 37 | Classic SSP | 37_bt_classic_ssp.sh |
Secure Simple Pairing |
| 38 | Adv Forge | 38_ble_adv_forge.sh |
BLE advertisement forging |
| 39 | BLE Fuzzing | 39_ble_fuzz.sh |
BLE payload fuzzing |
All need a Bluetooth adapter. A recent one — older CSR dongles silently drop BLE advertising data, which limits what you'll see without telling you.
| # | Module | Script | What it does |
|---|---|---|---|
| 07 | ARP / MITM | 07_arp.sh |
ARP poisoning with dynamic HTTPS interception |
| 13 | Enterprise Kit | 13_802.1x_relay.sh |
802.1X relay. Emits MSCHAPv2 challenge/response pairs in the same session, rather than requiring a second pass |
| 28 | Live Traffic | 28_live_traffic.sh |
Live 802.11 frame stream |
| 32 | Resolver Poison | 32_resolver_poison.sh |
LLMNR / NBT-NS / mDNS poisoning plus NTLM relay |
| 50 | Router LAN Attacks | 50_router_lan.sh |
Router attack surface over the LAN |
| 51 | Router Web UI | 51_router_web.sh |
Router web-interface attack surface |
32_resolver_poison has four backends: Responder, mitm6, ntlmrelayx, and
RA/SLAAC. The fourth matters because mitm6 deliberately skips Router
Advertisements — a network with no DHCPv6 in play is untouched by it. One
forged RA reconfigures every host's default route and resolver.
| # | Module | Script | What it does |
|---|---|---|---|
| 12 | HID Injection | 12_hid_injection.sh |
2.4 GHz proprietary HID — Mousejack / LOGITacker |
| 40 | Wi-Fi CSI | 40_wifi_csi.sh |
Channel State Information |
| 42 | Sub-GHz RF | 42_subghz.sh |
315 / 433.92 / 868 / 915 MHz OOK/ASK pulse work |
| 43 | NFC / RFID | 43_nfc_rfid.sh |
◆ NDEF codec, tag identification, MIFARE layout |
| 44 | LoRa / LoRaWAN | 44_lora_loraWAN.sh |
◆ LoRaWAN 1.0.x frame codec |
| 45 | Drone Remote ID | 45_drone_remote_id.sh |
◆ ASTM F3411 Remote ID message codec |
| 49 | USB Ethernet MitM | 49_usb_mitm.sh |
USB Ethernet / RNDIS MitM, PoisonTap-style |
| 52 | Router Console | 52_router_console.sh |
Bootloader and physical access. UART/U-Boot guidance, TFTP recovery, offline flash image parsing |
Several are partly or wholly offline. 43, 44 and 45 are pure codec
work — the message formats, without a radio. Useful for parsing captures and
for understanding the protocols without buying hardware.
52_router_console is unusual to find in a wireless tool: recovery-mode
TFTP, serial console guidance, and signature/NVRAM parsing of a dumped flash
image. The flash parsing is offline and done properly rather than as a
best-effort scan.
| # | Module | Script | What it does |
|---|---|---|---|
| 14 | Wireless IDS | 14_wifi_ids.sh |
Passive wireless intrusion detection |
| 15 | Wi-Fi CVE Kit | 15_wifi_cve_scan.sh |
Tier 1 Wi-Fi CVE test harness |
| 16 | Bluetooth CVE Kit | 16_bt_cve_scan.sh |
Bluetooth CVE test harness |
| 25 | RF Spectrum | 25_rf_spectrum.sh |
HackRF / RTL-SDR spectrum sweeps and waterfall |
| 26 | Zigbee / 802.15.4 | 26_zigbee.sh |
Zigbee / 802.15.4 attack surface |
| 27 | Firmware / IoT | 27_firmware_iot.sh |
Firmware analysis — binwalk, unblob, entropy, signatures |
| # | Module | Script | What it does |
|---|---|---|---|
| 18 | Capture Analysis | 18_capture_analysis.sh |
◆ Capture analysis and conversion |
| 19 | Wordlist Manager | 19_wordlist_manager.sh |
◆ Wordlist preparation and normalisation |
| 27b | Firmware Update Audit | 27b_fw_update_audit.sh |
Firmware update channel audit plus PoC |
| 30 | Fingerprint | 30_fingerprint.sh |
◆ Client fingerprinting, correlation, sequence tracking |
| 41 | Geolocation | 41_wifi_geolocate.sh |
Wi-Fi geolocation from BSSID and RSSI |
| 46 | Public Wi-Fi Audit | 46_public_wifi_audit.sh |
Public Wi-Fi security audit |
41_wifi_geolocate has two independent methods: trilateration from
reference coordinates and RSSI, which refuses to answer when the distances
are inconsistent rather than producing a confident wrong position; and an
Apple Location Services lookup, which turns a BSSID into coordinates with no
signal strength at all:
modules/41_wifi_geolocate.sh --apple-lookup e4:9e:12:05:34:59
e4:9e:12:05:34:59 43.2255745 0.0792846 45Worth knowing before using the Apple lookup in bulk: every BSSID you query is disclosed to Apple. It's cached locally and capped per run, but the disclosure is real.
18_capture_analysis documents a specific trap: hcxpcapngtool exits 0
on a capture containing no handshake. The module checks the content, not the
exit code.
19_wordlist_manager automates only the hashing step — normalising a real
serial number into the right format is left to you, deliberately.
| # | Module | Script | What it does |
|---|---|---|---|
| 29 | Killchain | 29_killchain.sh |
Chain runner with timeouts, conditionals and variables |
| 31 | Remote Node | 31_remote_node.sh |
Fleet controller for remote nodes |
31_remote_node drives a fleet — Pi, VM, laptop — and correlates what they
see. Multi-node capture is unusual to find in a wireless tool.
| # | Module | Script | What it does |
|---|---|---|---|
| 57 | Thread | 57_thread.sh |
Thread (802.15.4) network analysis |
| 58 | Proximity | 58_proximity.sh |
Presence watch |
58_proximity is the only module that runs for hours. Everything else is
a scan or an attack with a beginning and an end; this holds state between
polls and fires an action on a change.
modules/58_proximity.sh --watch aa:bb:cc:dd:ee:01 "my laptop"
modules/58_proximity.sh --start 3600
modules/58_proximity.sh --events-tsvIt finds devices by probe requests and Bluetooth inquiry. Presence, not distance — it reports whether a device is there, not how far away it is.
Departures are debounced across three consecutive silent polls, because a device that stops probing has gone quiet, not necessarily left.
modules/53_jamming.sh --selftest # works here, no hardware needed
modules/53_jamming.sh --caps-tsv # what this machine supports
modules/53_jamming.sh --help # the verbs--selftest first, always. It costs a second and tells you whether a failure
is your invocation or the module.