offensive-krack-fragattacks

# KRACK & FragAttacks Two attack families against WPA2 client implementations. Both well-disclosed (KRACK 2017, FragAttacks 2021) and largely patched on modern OSes — but the embedded/IoT long tail keeps them in scope for many engagements. ## When These Apply | Family | Target | Patch Status | |---|---|---| | KRACK | WPA2 supplicants in 4-way handshake / GTK / FT / TDLS | Major OSes patched 2017–2018 | | FragAttacks | Frame fragmentation/aggregation across WPA2/3 | Most stacks patched 2021–2022 | Probability of success today is high only against: - Embedded OEM devices (cameras, sensors, point-of-sale) - Old Android phones (<8 unpatched) - Industrial / SCADA Wi-Fi clients - Wi-Fi-enabled toys, smart bulbs, no-name IoT Modern Win11 / iOS 16+ / Android 13+ / hostapd-2.10 are mitigated. ## KRACK — Key Reinstallation The 4-way handshake's M3 retransmission causes the supplicant to reinstall the same PTK with reset nonce/replay counters. Frames encrypted under the reused keystream become decryptable. ```bash # Vanhoef's official test scripts git clone https://github.com/vanhoefm/krackattacks-scripts cd krackattacks-scripts/krackattack sudo ./krack-test-client.py --interface wlan0 # Tests the supplicant on a connected client ``` Output identifies which CVE variants the client is vulnerable to. ### Practical Outcomes When successful: - Decryption of WPA2-encrypted frames between client and AP - TKIP downgrade enables packet injection - Recovery of session keys for the dur...