ESP32 Wi-Fi Penetration Tool

The frame_analyzer component processes captured Wi-Fi frames. It can be used for two primary purposes:

1. Filtering: Listen for specific types of frames by providing search criteria (currently search type and BSSID). When a match is found, the component forwards the frame (or a portion of it) to the event pool as a DATA_FRAME_EVENTS event.
2. Parsing: Extract specific data from frames or frame parts using provided parsing functions (e.g., parse_eapol_packet).

To integrate this component into your project, pass captured frames from your sniffer logic to the event loop and initiate the capture process.

The wsl_bypasser component is designed to bypass the Wi-Fi Stack Libraries (WSL) mechanism that prevents the transmission of certain raw 802.11 frames. It achieves this by overriding the ieee80211_raw_frame_sanity_check function, forcing it to always return a value that permits frame transmission.

To implement this bypass during the build process, the linker flag -Wl,-zmuldefs must be used to allow multiple function definitions, enabling the component to override the default behavior of the Wi-Fi stack.

target_link_libraries(${COMPONENT_LIB} -Wl,-zmuldefs)

After flashing and powering the ESP32, a Management Access Point (AP) starts automatically. Connect to it using a smartphone or computer to access the web-based configuration interface.

Default Credentials:

• SSID: ManagementAP
• Password: mgmtadmin
• Web UI URL: http://192.168.4.1

To generate an HCCAPX formatted buffer, follow these steps:

1. Initialize the serializer with the target Access Point's SSID using hccapx_serializer_init.
2. Add captured handshake frames using hccapx_serializer_add_frame().
3. Retrieve the pointer to the buffer containing the HCCAPX binary data using hccapx_serializer_get().

The Deauth broadcast attack sends deauthentication frames using a broadcast destination MAC address (ff:ff:ff:ff:ff:ff), the source MAC address, and the BSSID of the target AP. This method uses the WSL Bypasser component to bypass Wi-Fi Stack Libraries that might otherwise block these frames.

Pros: Works even if there is no active communication in progress. Cons: Some client devices may ignore broadcast deauthentication frames. In such cases, a deauthentication directed at a specific client may be required.

The Rogue AP attack creates a duplicated Access Point by setting the same MAC address as the genuine AP using esp_wifi_set_mac. The configuration is derived from the wifi_ap_record_t structure obtained via the AP scanner and applied using esp_wifi_set_config.

Once the rogue AP is active, it responds to any Class 2 or 3 frames received from a Station (STA) with a deauthentication frame. This triggers the STA to deauthenticate from the network as per the 802.11 standard.

Pros: Deauthentication frames are directed specifically to the STA that sent a frame to the AP. Cons: Requires active communication to occur; may cause the STA to attempt to authenticate with the rogue AP instead of the genuine one.

You can flash the project using idf.py flash if you have the ESP-IDF environment set up. Alternatively, you can use esptool.py to flash pre-built binaries located in the build/ directory without a full ESP-IDF installation.

esptool.py -p /dev/ttyS5 -b 115200 --after hard_reset write_flash --flash_mode dio --flash_freq 40m --flash_size detect 0x8000 build/partition_table/partition-table.bin 0x1000 build/bootloader/bootloader.bin 0x10000 build/esp32-wifi-penetration-tool.bin