WiFi Attacks

All attacks require being in range of the target. Run scanwifi (sw) first to populate the network index.

Guide Command What it does
Deauth deauth / da Disconnect clients from an AP
Evil Twin eviltwin / et Rogue AP + captive portal
Hidden SSID hiddenssid / hs Reveal hidden network names
WPA Sniff wpasniff / ws Capture + crack WPA2 handshake (needs client)
PMKID Attack pmkid / pm PMKID capture + crack — active clientless by default (pm passive = silent sniff), no client needed
Karma karma / km Rogue-AP suite — probe harvest, PNL fingerprint, half-handshake / portal bait
Cap Cracker crack / cc Offline crack of a .cap (handshake or PMKID) with wordlists — resume cursor, type-a-path picker, and a background mode (cc bg) that grinds even under the undercover cover
WGuard IDS wguard / wg Passive WiFi intrusion detection
Beacon Flood beaconflood / bf Flood WiFi scan lists with fake SSIDs
WPS wps WPS recon (IE decode + device-info leak) + PIN calculator + push-button connect
Pwnagotchi Pet pwn / pw Autonomous AI-adaptive roam (all 13 ch; basic=1/6/11) + capture handshakes/PMKIDs (clientless solicit) + crack on-device (active/stealth/passive); runs card-less (RAM crack → NVS) + pack-shares cracked creds over the grid

Each attack has its own dedicated guide — select one from the table above or use the sidebar.


Table of contents