An IEEE 802.11 packet injector and analyzer software📡

Use it with-radar!

‼️Checkdependencies‼️

🔧ForGNU/Linux:

git clone https://github.com/ANDRVV/gapcast.gitcd gapcastgo build -buildvcs=false./gapcast -i<interface>

💉Injection Table

🕵️‍♂️Deep Scanning

🌐Evil-Twin with Captive Portal

📶Monitor mode handler

Important

If your driver is not supported or if you would like to boot into monitor mode with your changes, just do so before starting gapcast.If gapcast recognizes that the interface has already set monitor mode, it will not make any changes or even try to restart monitor mode.

📈Parameter techniques

SCAN-ALL-FOR-LONG-TIME

./gapcast -i<iface> -2.4+5g -d

Note

Scans all 2.4/5 Ghz channels disabling shifting of inactive devices.

SCAN-ALL-FREQ-OF-ONE-AP

./gapcast -i<iface> -2.4+5g -c 10,36 -p 03:e9:58:65:2a:8

Note

Access Point that have 5 Ghz and 2.4 Ghz transmit via 2 different addresses, the address for 5 Ghz and the one for 2.4 Ghz. In most cases these 2 addresses have a Mac address with a very similar prefix:

In this case of selecting channel 10 for 2.4 Ghz and channel 36 for 5 Ghz with-c <channel> uses 2 channels with different bands, using-2.4+5g. Taking into consideration anAccess Point that has the 5 Ghz address03:e9:58:65:2a:8e and the 2.4 Ghz address03:e9:58:65:2a:86, thecommon prefix is03:e9:58:65:2a:8, which is set via-p <mac-prefix>.With this parameteronly devices with that specified prefix will be displayed.

SCAN-ALL-RANGE

./gapcast -i<iface> -2.4+5g -radar

Note

Scan all 2.4/5 Ghz channels showing the approximate radius of the location in meters with the-radar parameter using theRadarRSSI library,more info.

SCAN-2.4G

./gapcast -i<iface>

Note

Scans all 2.4 channels.

SCAN-5G

./gapcast -i<iface> -5g

Note

Scans all 5 Ghz channels adding-5g parameter.

SCAN-ALL-RECORDING

./gapcast -i<iface> -2.4+5g -w out.pcap

Note

Scans all 2.4/5 Ghz channels, recording it and saving to a pcap file. Registration can be done by adding the-w <file>.pcap parameter.

SCAN-AP-DEAUTH-AND-REC-EAPOL

./gapcast -i<iface> -c 11 -b a3:65:1b:56:7e:3c -w out.pcap

Note

Scan only AP's channel (11) to get the best WPA 4-Way Handshake, To deauthenticate you need to open the gapcast injection table by pressing[CTRL-P], then select the De-Auth type, enter the required information and start the attack by pressingCTRL-D key for a few seconds (check that clients are present via the light-blue bar), as soon as theCTRL-D key is deactivated, the clients that reconnect to theAccess Point:

Willsend and receive EAPOL packets which you will record and save with the-w <file>.pcap parameter.

RESTORE-DATA

./gapcast -l out.pcap

Note

If you want to restore data from a previous scan, done withgapcast,wireshark or other tools and load them on thegapcast table to better analyze the data, just insert the-l <file>.pcap parameter, if you want to restore the data and continue the scan you must add the-i <iface> parameter and/or add other additional parameters.

SCAN-ALL-AP

./gapcast -i<iface> -2.4+5g -beacon

Note

If you want to show or record only theAccess Points you must enter the-beacon parameter. For this technique, where we show allAccess Points of all channels it is necessary to add the parameter-2.4+5g.

📚Dependencies

Caution

You must installlibpcap,libx11,apache2,iptables,hostapd,dnsmasq,aircrack-ng,php, if you'd usegapcast!

🚀Upcoming features