Aireplay-ng Injection Test
Before we send deauthentication frames,
we need to determine if our card can successfully
inject wireless frames into our target AP.
The injection test measures ping response times to the AP.
We can get a good indication of the link quality
by examining the percentage of responses received.
In addition, if we have two wireless cards connected,
the test can also help us determine
which specific injection attacks will be successful.
The basic injection test lists the APs in the area that respond to broadcast probes.
For each of the APs found,
Aireplay-ng performs a 30-frames test to measure the connection quality.
This will tell us whether or not our card can successfully send a response to
and receive a response from the test target.
Basic Injection Test
Prior to running a basic injection test,
it is important that we first set our card to the desired channel.
For this test, our target is on channel 3.
We can set the channel with airmon-ng.
We then execute Aireplay-ng with the -9 option and our wireless interface
Let’s take a moment to analyze some of the output from our injection test.
Our Aireplay-ng command confirms we can inject
into the wifu AP on channel 3 with a 100% success rate.
Incidentally, it is common for our injection
to spill over into overlapping channels
as evidenced by Aireplay-ng
reporting output for the secnet AP on channel 2.
Injection Test for a Specific SSID
Let’s run an injection test against a specific ESSID.
We'll set the ESSID with -e
and the BSSID with -a
and run the injection.
The results indicate that the wireless card can inject successfully
and communicate with the target AP.
We need to know the SSID in order to run this test.
Aireplay-ng validates that the BSSID is correct.
In cases when the signal is too low or too high, the test will fail.
In order to blindly trust the values from the command line,
we can append the -D parameter to the command to disable AP detection.
In this case the injection does not wait for a beacon frame,
but still injects successfully.
Card-to-Card (Attack) Injection Test
The card-to-card injection test is a far more robust check.
It will also test whether or not our card can implement various Aireplay-ng attacks.
Transmitting a frame using Aireplay-ng
or any other tool doesn’t guarantee it will actually be sent.
Sometimes frames are modified by the card’s firmware or driver
before being sent.
Doing a card-to-card injection test
guarantees frames are actually sent correctly.
We’ve set up another wireless interface to demonstrate this.
Let’s run the command with the -i option
followed by our additional capture interface.
Similar to the single card injection test,
this test begins by evaluating the results of the detected APs.
In the second part of the test, the output shows that our attacking card
will perform all attack types successfully.
If we receive a “Fail” message for attack 5 or 7,
the card may still work
if the injection MAC address matches the current card MAC address.
With some drivers, it will fail if they are not the same.