FluxionNetwork/fluxion
Fluxion
Fluxion is a wireless security auditing framework that tests WPA/WPA2 networks by capturing handshakes and deploying rogue access points with captive portals. It operates by deauthenticating clients from legitimate access points, forcing them to reconnect to a cloned network where a fake authentication page collects the network passphrase.
The tool distinguishes itself through a plugin-based attack lifecycle with mandatory hook functions for consistent execution, multilingual metadata scripts that load attack descriptions based on locale, and a handshake verification pipeline that validates captured credentials through external tools. It supports both passive handshake capture and aggressive deauthentication-based methods, with configurable verification intervals and asynchronous checking modes.
Fluxion provides a complete captive portal phishing framework with DNS redirection, SSL encryption for the portal, internet connectivity emulation, and the ability to inject target network details into portal pages. It includes pre-built router portal interfaces that can be downloaded from a remote repository, along with support for custom portal development. The tool logs attack results and captured credentials, and offers a debug mode for troubleshooting.
Features
- Wireless Security Frameworks - Provides a modular platform for executing custom wireless attack scripts and managing network traffic interception during penetration testing.
- Wireless - Launches wireless attacks from the command line with configurable parameters and persistent preferences for repeatable testing.
- Target Detail Injections - Injects target network ESSID, BSSID, and channel into portal pages before attack launch.
- DNS Query Interceptors - Intercepts all DNS requests from connected clients and redirects them to a local gateway for captive portal delivery.
- Captive Portal Redirections - Redirects all DNS queries from connected clients to the local captive portal IP address.
- Wireless Deauthentication Tools - Sends management frames to disconnect wireless clients, triggering a handshake capture opportunity.
- Traffic Redirection Tools - Redirects all DNS and HTTP/HTTPS traffic from connected clients to a local captive portal server.
- Rogue Access Points - Deauthenticates all clients from the legitimate access point, forcing them onto the rogue access point.
- Wireless Network Scanning - Scans the airwaves to locate and select a specific wireless network as the attack target.
- WPA Handshake Hash Verifiers - Checks whether a captured handshake file contains a valid WPA/WPA2 hash using a configurable verification tool.
- Captive Portal Simulations - Adapts router web interfaces to work with the tool's captive portal attack workflow.
- Variable Injections - Injects target network details into captive portal pages to personalize the phishing attack.
- Handshake Hash Verifiers - Checks whether a captured handshake is valid using a configurable verifier tool at a set interval.
- Wireless Security Auditing - Tests WPA/WPA2 wireless networks by capturing handshakes and verifying credentials against dictionary attacks.
- WPA Password Verifiers - Checks submitted passwords against the target network's WPA/WPA2 key using a server-side script.
- Lifecycle Hook Definitions - Defines mandatory hook functions for prep, start, stop, and cleanup in attack modules.
- Wireless Security Auditing - Tests WPA/WPA2 wireless networks by capturing handshakes and launching captive portal attacks for security assessment.
- Handshake Captures - Captures the 4-way authentication handshake from a target access point by listening or deauthenticating.
- Handshake Password Verifiers - Checks each submitted password against a captured WPA handshake using cowpatty, pyrit, or aircrack-ng.
- Handshake Verifications - Validates captured WPA handshakes using external tools with configurable polling intervals.
- Deauthentication Attacks - Sends deauthentication packets to disconnect devices from the legitimate access point.
- Attack Hook Definitions - Defines mandatory and optional hook functions for attack lifecycle management.
- Attack Lifecycle Hooks - Defines mandatory hook functions for preparing, starting, stopping, and cleaning up attacks.
- Attack Lifecycle Hook Definitions - Defines mandatory and optional lifecycle hooks for attack preparation, execution, and cleanup.
- Portal Variable Injections - Inserts dynamic values like target SSID, MAC address, and channel into portal pages before an attack begins.
- Credential Capture Loggers - Logs the verified password and halts the attack, letting clients reconnect to the legitimate access point.
- Router - Displays a captive portal UI that mimics a specific router manufacturer to increase victim trust.
- CLI Attack Launchers - Launches attacks directly from the command line with target details and attack type arguments.
- Custom Portal Interfaces - Allows users to design and integrate their own captive portal HTML pages for tailored phishing campaigns.
- Branded Portal Interfaces - Builds and integrates branded captive portal interfaces that replicate router login screens for social-engineering attacks.
- Custom Portal Deployments - Loads user-supplied HTML captive portal pages to tailor the phishing appearance during an attack.
- Dynamic Captive Portals - Shows a single page that submits passwords via AJAX and displays a success or failure message.
- Portal Template Downloads - Downloads ready-made captive portal interfaces from a remote repository for wireless phishing attacks.
- Router Portal Interfaces - Builds and integrates custom captive portal pages that mimic legitimate router login screens.
- Static Captive Portals - Displays a fixed phishing page that submits passwords to a verifier script and redirects based on correctness.
- Aggressive - Forces clients to reconnect by sending deauthentication packets, increasing the chance of capturing a handshake.
- Passive - Monitors network traffic silently without sending deauthentication packets, making the attack undetectable.
- Credential Session Logs - Records all password attempts and successful credential captures with network details to local log files.
- Wireless Network Tools - Automated social engineering WPA attack suite.
- Wireless Security - Social engineering and Wi-Fi auditing tool.
- Wireless Security Tools - Framework for wireless network auditing and attacks.
