help: mdk3

[lucifi]

Excuse my rude behavior, it was a difficult time for me.

I'm looking for some help with mdk3.
I've found this great script on the old forum, and I've updated it for backtrack 4 final, if you want it, just ask.
the problem I'm having is that mdk3 in amok mode is not reading my blacklist txt file, or the txt file is not made the right way.

I just create a mac.txt file, where I put the mac 'AA:AA:AA:AA:AA:AA' for instance, on the first line. is this the correct way to do it?

Whenever I use this '-b' option (path to blacklist file) in mdk3 amok mode, it starts, but shows or does nothing.
the client that's in the blacklist file, is not deauthenticated like it should.
any idea why?

thank you,

d.

[TAPE]

What we're missing here is the code you are using and where you created the blacklist file.

Also, mdk3 is included in backtrack 4, no need to install or update anything.. is it now broke ?

As an example for the Deauthentication/Disassociation Amok mode ;
(assuming mon0 is your interface in monitor mode and that the target is on Channel 1)
First head to mdk3

cd /pentest/wireless/mdk3

Create a txt file with blacklisted MAC;

echo 00:11:22:33:44:55 > blacklist.txt

Start up mdk3;

./mdk3 mon0 d -b blacklist.txt -c 1 -s 150

Make sure that you correctly point to your blacklist file !


Let us know what happens.

[lucifi]

TAPE, thanks alot for responding.
Everything you said, I already know, and the commands I'm using are correct, and point at the correct txt file, that's certainly not the problem.

How am I suppose to input a MAC adress in that txt file? just put on the first line, and the second MAC on the second line? this isn't documented anywhere, including the mdk3 --fullhelp.
I'm thinking it might need like a '#' or something before every MAC adress.
I don't know what else could be causing this problem.

[TAPE]

*slaps self for not reading correctly*
Thats what I get for late night responses..

Didnt notice you were talking about the Client MAC.. the input in blacklist file should be AP MAC..

This isnt really specified in the MDK3 helpfile, however when I was testing mdk3 a while ago I
came to the conclusion that it had to be the AP mac as it, as you correctly say, does nothing when entering the Client MAC..

If you are looking for a tool that can specifically target Client MACs to deny or allow access to a network, I suggest you take a look at airdrop-ng.

There is a post here on installing it from backtrack repo and I put a video up on it in the video section a short while ago.

[lucifi]

my friend TAPE, thank you.
I have yet to test it, but I'm guessing this is problem indeed.
one last question, when I'm running mdk3 destruction mode my ap doesn't get destructed at all .. could it be that some ap's are invulnerable against such attacks?
( auth DoS mode + Beacon flood mode + deauth/disass mode + WIDS/WIPS/WDS Confusion )

[TAPE]

Heya, well please test and let it be known whether the findings are accurate

As for the destruction mode, it is possible that some routers are not affected. I didnt try all the options in the mdk3 suite to be honest.
But during some of my tests with mdk3, my (old & crappy test) router sometimes held its own and did not succumb to all attacks with mdk3.

Although I hate plugging my own stuff.. I did quite a comprehensive test on several of the mdk3 options (on BT4 Pre final, so no need to follow any instructions for install when using BT4 Final -- only difference is that you start from; /pentest/wireless/mdk3/./mdk3 blah blah blah) which you can find here;

A day with Tape: MDK3 - network traffic disruption


Pleased to hear if you get where you need to be.