Deauth plugin for Kismet

This basic Python plugin for Kismet runclient.py.

The main purpose of the plugin is to collect WPA handshakes by actively deauthenticating
connected clients automatically.

The plugin communicates with Kismet server over the kismet protocol on TCP 2501.
Its listening to BSSID, SSID, Client events and builds an internal database of interesting targets.

Once a client on interesting SSID is captured, it is enqueued to a priority queue for deauth.
Another deauth thread scans the deauth queue and performs deauth & handshake collection.

Plugin is designed to use a different WiFi interface than kismet uses not to interfere with the scanning.
Plugin starts airodump-ng on a given channel to capture the handshake, performs deauth and keeps collecting for next
10 seconds waiting for client to authenticate again.

The plugin is based on kismetclient repo. For more details take a look at the
blog.

kismetclient

A Python client for the Kismet server protocol.

Start by creating a client:

from kismetclient import Client as KismetClient
address = ('127.0.0.1', 2501)
k = KismetClient(address)

Then register any desired builtin protocol handlers:

from kismetclient import handlers
k.register_handler('TRACKINFO', handlers.print_fields)

Create and register a custom protocol handler:

def handle_ssid(client, ssid, mac):
    print 'SSID spotted: "%s" with mac %s' % (ssid, mac)
k.register_handler('SSID', handle_ssid)

and call the listen() method in a loop:

while True:
    k.listen()

The listen() method will retrieve responses from the kismet server,
parsing them, and calling registered handlers as appropriate.

kismetclient is agnostic about how you loop this call; choose a
method that works well with the rest of your application’s
architecture. You could run it in a separate blocking thread that
handles events by parsing them and pushing to a queue, or you could
use gevent to avoid blocking during the socket read call.

A handler is a callable whose first argument is the client generating
the message, with all other arguments named after kismet’s protocol
capabilities. A handler may specify just client and **fields
parameters in order to get all fields for a message in the default
order. In general, your handlers should be quick to run and not
depend on other blocking code.

Handlers are registered by calling the register_handler method on
the client. The first argument is the name of the protocol to handle,
the second is the function to handle it. It is valid to register a
handler for a protocol which is already handled - in this case the new
handler overrides the old one.

Commands can be sent using client.cmd(cmd, *args):

k.cmd('ENABLE', protocol, fields)

The first argument is the kismet command name, followed by the
command arguments.

A trivial example application is included in runclient.py. Reading
the source is also likely to be helpful.

To discover which protocols and capabilities your kismet server
supports, start the kismet server and use the interactive python
shell:

>>> from kismetclient import Client
>>> k = Client()
>>> k.protocols.keys()
['CRITFAIL', 'ACK', 'PACKET', 'NETTAG', 'BTSCANDEV', 'CAPABILITY',
'SOURCE', 'COMMON', 'CLISRC', 'TRACKINFO', 'PROTOCOLS', 'BSSIDSRC',
'STATUS', 'WEPKEY', 'STRING', 'SPECTRUM', 'ERROR', 'CHANNEL', 'GPS',
'INFO', 'SSID', 'BSSID', 'PLUGIN', 'BATTERY', 'TERMINATE', 'REMOVE',
'ALERT', 'KISMET', 'CLIENT', 'TIME', 'CLITAG']
>>> k.protocols['GPS']
['lat', 'lon', 'alt', 'spd', 'heading', 'fix', 'satinfo', 'hdop',
'vdop', 'connected']

To discover Kismet commands, grep the Kismet source for
RegisterClientCommand. At the time of this writing, this list
included: CAPABILITY, ENABLE, REMOVE, SHUTDOWN,
ADDTRACKERFILTER, ADDNETCLIFILTER, ADDNETTAG, DELNETTAG,
ADDCLITAG, DELCLITAG, ADDSOURCE, DELSOURCE, RESTARTSOURCE,
HOPSOURCE, and CHANSOURCE. For usage, consult the source or monitor an
interactive session between the official client and server using
wireshark.

This software is developed using Python 2.7 and the master branch of
Kismet. It may also work on Python 2.6 and earlier versions of Kismet,
but ymmv. Please open tickets for bugs using github.

Donating

This implementation is an open source. If you like the code or you do find it useful please feel free to donate to the
author whatever amount you would like by clicking on the paypal button below.
And if you don’t feel like donating, that’s OK too.

Bitcoin:

19MNw2vgnvymQK66AUEtCDpR3UPjnenqwj