WiFi Attacks
All attacks require being in range of the target. Run
scanwifi(sw) first to populate the network index.
| Guide | Command | What it does |
|---|---|---|
| Deauth | deauth / da | Disconnect clients from an AP |
| Evil Twin | eviltwin / et | Rogue AP + captive portal |
| Hidden SSID | hiddenssid / hs | Reveal hidden network names |
| WPA Sniff | wpasniff / ws | Capture + crack WPA2 handshake (needs client) |
| PMKID Attack | pmkid / pm | PMKID capture + crack — active clientless by default (pm passive = silent sniff), no client needed |
| Karma | karma / km | Rogue-AP suite — probe harvest, PNL fingerprint, half-handshake / portal bait |
| Cap Cracker | crack / cc | Offline crack of a .cap (handshake or PMKID) with wordlists — resume cursor, type-a-path picker, and a background mode (cc bg) that grinds even under the undercover cover |
| WGuard IDS | wguard / wg | Passive WiFi intrusion detection |
| Beacon Flood | beaconflood / bf | Flood WiFi scan lists with fake SSIDs |
| WPS | wps | WPS recon (IE decode + device-info leak) + PIN calculator + push-button connect |
| Pwnagotchi Pet | pwn / pw | Autonomous AI-adaptive roam (all 13 ch; basic=1/6/11) + capture handshakes/PMKIDs (clientless solicit) + crack on-device (active/stealth/passive); runs card-less (RAM crack → NVS) + pack-shares cracked creds over the grid |
Each attack has its own dedicated guide — select one from the table above or use the sidebar.