What Is MDK3

What Is MDK3

MDK3 is a wireless tool which comes packaged in Backtrack and Kali distros. It doesn’t seem to be available via package managers in other distros but the tarball can be downloaded here. For the purposes of this tutorial we will be assuming you are working with the Kali distro. Some of these commands would require sudo under other distros as in Kali you run as root, we’ll include the sudo command where it would be necessary.

The program is very versatile and contains a great many options which take advantage of various weaknesses in the 802.11 protocol. It should be considered a proof of concept exploit tool and should not be run without the permission of the network owner. However, when working with a home lab setup it is very useful in developing an understanding of how wifi works and how vulnerable wifi networks can be. With the increasing adoption of wifi within business, attacks which gain entry over wifi are becoming more common and wifi penetration testing is now a skill in demand. Over a series of blog posts we’ll look at wifi and tools used to test it, but for now back to MDK3.

As I’ve said MDK3 has a variety of options, amongst its uses include options to perform a DoS attack by sending multiple authentication packets; sending deauthentication packets which kick computers off a network and an option to try a variety of known MAC addresses to authenticate to a network while dynamically changing the timeout period.

MDK3 does not have a man page and info won’t help either. It’s basic options can be listed simply by typing:

MDK USAGE:
mdk3 <interface> <test_mode> [test_options]

Try mdk3 --fullhelp for all test options
Try mdk3 --help <test_mode> for info about one test only

TEST MODES:
b   - Beacon Flood Mode
      Sends beacon frames to show fake APs at clients.
      This can sometimes crash network scanners and even drivers!
a   - Authentication DoS mode
      Sends authentication frames to all APs found in range.
      Too much clients freeze or reset some APs.
p   - Basic probing and ESSID Bruteforce mode
      Probes AP and check for answer, useful for checking if SSID has
      been correctly decloaked or if AP is in your adaptors sending range
      SSID Bruteforcing is also possible with this test mode.
d   - Deauthentication / Disassociation Amok Mode
      Kicks everybody found from AP
m   - Michael shutdown exploitation (TKIP)
      Cancels all traffic continuously
x   - 802.1X tests
w   - WIDS/WIPS Confusion
      Confuse/Abuse Intrusion Detection and Prevention Systems
f   - MAC filter bruteforce mode
      This test uses a list of known client MAC Adresses and tries to
      authenticate them to the given AP while dynamically changing
      its response timeout for best performance. It currently works only
      on APs who deny an open authentication request properly
g   - WPA Downgrade test
      deauthenticates Stations and APs sending WPA encrypted packets.
      With this test you can check if the sysadmin will try setting his
      network to WEP or disable encryption.