133 lines
4.8 KiB
Markdown
133 lines
4.8 KiB
Markdown
<div align="center">
|
||
|
||
```text
|
||
███████╗██╗███╗ ██╗ █████╗ ██╗ ██╗ ██╗ ~ finally ~
|
||
██╔════╝██║████╗ ██║██╔══██╗██║ ╚██╗ ██╔╝ dual-radio lab
|
||
█████╗ ██║██╔██╗ ██║███████║██║ ╚████╔╝ aircrack-ng tmux
|
||
██╔══╝ ██║██║╚██╗██║██╔══██║██║ ╚██╔╝ hc22000 · no hashcat
|
||
██║ ██║██║ ╚████║██║ ██║███████╗ ██║
|
||
╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝ ╚═╝
|
||
```
|
||
|
||
**`// capture · deauth · convert · print hashcat cmd`**
|
||
<sub>LAB / AUTHORIZED ENVIRONMENTS ONLY · MT7612U + RTL8812AU</sub>
|
||
|
||
</div>
|
||
|
||
<div align="center">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</div>
|
||
|
||
---
|
||
|
||
## `$ whoami`
|
||
|
||
**`finally`** is a single entrypoint: **`./start.sh`**. It flips two interfaces into monitor mode, opens a **tmux** lab console (live **airodump-ng** + automated **aireplay-ng** cycle), dumps raw **`.cap`** under `out/<timestamp>/`, then runs **`hcxpcapngtool`** to produce **one** merged **`handshakes.hc22000`** and prints the exact **`hashcat -m 22000`** line — it does **not** invoke hashcat.
|
||
|
||
<details>
|
||
<summary><strong>📡 threat model (what this is / isn’t)</strong></summary>
|
||
|
||
| In scope | Out of scope |
|
||
|----------|--------------|
|
||
| Campus pen-test labs with written scope | Anything outside explicit authorization |
|
||
| Pair of dedicated USB adapters | Running hashcat for you |
|
||
| Clean teardown → managed mode | Teaching OPSEC or evasion |
|
||
|
||
</details>
|
||
|
||
---
|
||
|
||
## `$ ./quickstart`
|
||
|
||
```bash
|
||
# from repo root — will sudo itself
|
||
chmod +x start.sh
|
||
./start.sh
|
||
```
|
||
|
||
**Inside tmux**, quit cleanly:
|
||
|
||
```text
|
||
Ctrl+b # prefix
|
||
& # kill-window (confirm y)
|
||
```
|
||
|
||
**Detached** instead of killed? Session keeps running on the radios. See [HOW_IT_WORKS.md](./HOW_IT_WORKS.md) for recovery / manual `airmon-ng stop`.
|
||
|
||
---
|
||
|
||
## `$ ls -la stack`
|
||
|
||
| Layer | Tooling |
|
||
|-------|---------|
|
||
| **Capture** | `airodump-ng` · channel hop · `CAPTURE_IFACE` → monitor |
|
||
| **Attack** | `aireplay-ng` · scan CSV · targeted / broadcast deauth |
|
||
| **Convert** | `hcxpcapngtool` → `*.hc22000` + ESSID hint wordlist |
|
||
| **Shell** | `bash` · `tmux` · `airmon-ng` · `iw` |
|
||
|
||
**Target hardware (defaults)**
|
||
|
||
| Radio | Default iface | Typical dongle |
|
||
|-------|---------------|----------------|
|
||
| Record / hop | `wlan0` | MediaTek **MT7612U** |
|
||
| Scan / deauth | `wlan1` | Realtek **RTL8812AU** |
|
||
|
||
---
|
||
|
||
## `$ export THINGS`
|
||
|
||
| Variable | Default | Role |
|
||
|----------|---------|------|
|
||
| `CAPTURE_IFACE` | `wlan0` | Physical name before monitor |
|
||
| `ATTACK_IFACE` | `wlan1` | Physical name before monitor |
|
||
| `IGNORE_SSID` | `thetempleofdoom` | Skip AP rows containing substring |
|
||
| `CAPTURE_BAND` | `abg` | `a` / `bg` / `abg` for airodump |
|
||
| `SCAN_SECONDS` | `6` | Per-scan dwell |
|
||
| `DEAUTH_COUNT` | `18` | Frames per burst |
|
||
| `ATTACK_DELAY` | `0.15` | Pace between bursts (seconds) |
|
||
| `SESSION_DIR` | `out/<timestamp>` | Artifacts |
|
||
| `TMUX_SESSION` | `finally` | Session name |
|
||
|
||
---
|
||
|
||
## `$ tree out`
|
||
|
||
```text
|
||
out/20260329_143022/
|
||
├── chamber-01.cap # raw capture (rolling)
|
||
├── handshakes.hc22000 # hashcat -m 22000
|
||
├── essids_from_capture.txt # ESSID hints from conversion
|
||
├── .cap.sh # tmux top pane launcher
|
||
└── .atk.sh # tmux bottom pane launcher
|
||
```
|
||
|
||
---
|
||
|
||
## `$ man thoroughly`
|
||
|
||
Full sequence diagrams and cleanup rules → **[HOW_IT_WORKS.md](./HOW_IT_WORKS.md)**
|
||
|
||
---
|
||
|
||
## `$ legal`
|
||
|
||
> **Authorized access only.** Running deauthentication or passive capture against networks you do not own or have **explicit written permission** to test is illegal in many jurisdictions. This repository is for **education** and **licensed security assessments** (e.g. school lab with scope). The authors assume no liability for misuse.
|
||
|
||
```text
|
||
Monitor mode + airmon-ng check kill can nuke local Wi-Fi (NetworkManager).
|
||
Prefer SSH over Ethernet or a dedicated attack box so you don’t lock yourself out.
|
||
```
|
||
|
||
---
|
||
|
||
<p align="center">
|
||
<sub>
|
||
<code>~</code> red team hygiene: scope · logging · teardown · hashcat on your own box <code>~</code>
|
||
</sub>
|
||
</p>
|