Check each channel work normal

[LLH-l]

Verify in each channel network card working normal
I found in some channel no injected, AP not responding
Resulting a long time capture handshake fail

If acn In start capture before, check network card in each channel working normal

[ZerBea]

If an AP doesn't respond:

• it could be out of RANGE (the RSSI of the attack signal is not enough)
• wireless regulatory domain does not allow to transmit on this channel
• driver is broken

iw reg get or hcxdumptool -I INTERFACE_NAME will show the regulatory settings.
If DFS is unset (00), 5GHz will not work as expected.

[LLH-l]

AP in my 1m

[ZerBea]

Which Driver?
Is AP on 2.4 or 5GHz?
iw reg get?

[LLH-l]

RT5572
Test 5Ghz

iw reg get
global
country 00: DFS-UNSET
        (755 - 928 @ 2), (N/A, 20), (N/A), PASSIVE-SCAN
        (2402 - 2472 @ 40), (N/A, 20), (N/A)
        (2457 - 2482 @ 20), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
        (2474 - 2494 @ 20), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
        (5170 - 5250 @ 80), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
        (5250 - 5330 @ 80), (N/A, 20), (0 ms), DFS, AUTO-BW, PASSIVE-SCAN
        (5490 - 5730 @ 160), (N/A, 20), (0 ms), DFS, PASSIVE-SCAN
        (5735 - 5835 @ 80), (N/A, 20), (N/A), PASSIVE-SCAN
        (57240 - 63720 @ 2160), (N/A, 0), (N/A)




hcxdumptool -I wlan0
Requesting physical interface capabilities. This may take some time.
Please be patient...

interface information:

phy idx hw-mac       virtual-mac  m ifname           driver (protocol)
---------------------------------------------------------------------------------------------
  0   3 00873293035f fe021c639433 + wlan0            rt2800usb (NETLINK)


available frequencies: frequency [channel] tx-power of Regulatory Domain: 00

  2412 [  1] 20.0 dBm     2417 [  2] 20.0 dBm     2422 [  3] 20.0 dBm     2427 [  4] 20.0 dBm
  2432 [  5] 20.0 dBm     2437 [  6] 20.0 dBm     2442 [  7] 20.0 dBm     2447 [  8] 20.0 dBm
  2452 [  9] 20.0 dBm     2457 [ 10] 20.0 dBm     2462 [ 11] 20.0 dBm     2467 [ 12] 20.0 dBm
  2472 [ 13] 20.0 dBm     2484 [ 14] 20.0 dBm     5180 [ 36] 20.0 dBm     5190 [ 38] 20.0 dBm
  5200 [ 40] 20.0 dBm     5210 [ 42] 20.0 dBm     5220 [ 44] 20.0 dBm     5230 [ 46] 20.0 dBm
  5240 [ 48] 20.0 dBm     5250 [ 50] 20.0 dBm     5260 [ 52] 20.0 dBm     5270 [ 54] 20.0 dBm
  5280 [ 56] 20.0 dBm     5290 [ 58] 20.0 dBm     5300 [ 60] 20.0 dBm     5310 [ 62] 20.0 dBm
  5320 [ 64] 20.0 dBm     5500 [100] 20.0 dBm     5510 [102] 20.0 dBm     5520 [104] 20.0 dBm
  5530 [106] 20.0 dBm     5540 [108] 20.0 dBm     5550 [110] 20.0 dBm     5560 [112] 20.0 dBm
  5570 [114] 20.0 dBm     5580 [116] 20.0 dBm     5590 [118] 20.0 dBm     5600 [120] 20.0 dBm
  5610 [122] 20.0 dBm     5620 [124] 20.0 dBm     5630 [126] 20.0 dBm     5640 [128] 20.0 dBm
  5650 [130] 20.0 dBm     5660 [132] 20.0 dBm     5670 [134] 20.0 dBm     5680 [136] 20.0 dBm
  5690 [138] 20.0 dBm     5700 [140] 20.0 dBm     5745 [149] 20.0 dBm     5755 [151] 20.0 dBm
  5765 [153] 20.0 dBm     5775 [155] 20.0 dBm     5785 [157] 20.0 dBm     5795 [159] 20.0 dBm
  5805 [161] 20.0 dBm     5825 [165] 20.0 dBm     4920 [184] disabled     4940 [188] disabled
  4960 [192] disabled     4980 [196] disabled
 

[ZerBea]

country 00: DFS-UNSET
Regulatory Domain: 00

5GHz and partly 2.4GHz will not work as expected!
If RADAR is detected, hcxdumptool will not transmit on DFS channels and it does not transmit on passive scan only channels.

        (2457 - 2482 @ 20), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
        (2474 - 2494 @ 20), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
        (5170 - 5250 @ 80), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
        (5250 - 5330 @ 80), (N/A, 20), (0 ms), DFS, AUTO-BW, PASSIVE-SCAN
        (5490 - 5730 @ 160), (N/A, 20), (0 ms), DFS, PASSIVE-SCAN
        (5735 - 5835 @ 80), (N/A, 20), (N/A), PASSIVE-SCAN

[ZerBea]

hcxdumptool give some hints if something went wrong:

failed to get interface list
PACKET_STATISTICS failed

1 ERROR(s) during runtime
Possible reasons:
 driver is broken
 driver is busy (misconfigured system, other services access the INTERFACE)
0 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
Warning: too less packets received (monitor mode may not work as expected)
Possible reasons:
 no transmitter in range
 frames are filtered out by BPF
 driver is broken
0 SHB written to pcapng dumpfile
0 IDB written to pcapng dumpfile
0 ECB written to pcapng dumpfile
0 EPB written to pcapng dumpfile

[LLH-l]

No the error

[LLH-l]

country 00: DFS-UNSET
Regulatory Domain: 00

5GHz and partly 2.4GHz will not work as expected!
If RADAR is detected, hcxdumptool will not transmit on DFS channels and it does not transmit on passive scan only channels.

Which model network card suitable, for hcxdmptool

[ZerBea]

All USB adapters (with external antenna connectors) which drivers support full packet injection and full monitor mode and are part of the stock Linux kernel. Some examples are here:
#361

Please do not forget to set your regulator domain.
DFS-UNSET (00) is the worst setting.

[LLH-l]

Please do not forget to set your regulator domain.
DFS-UNSET (00) is the worst setting.

Another card, can ?

iw reg get
phy#3
country 99: DFS-UNSET
        (2402 - 2472 @ 40), (N/A, 20), (N/A)
        (2457 - 2482 @ 40), (N/A, 20), (N/A), PASSIVE-SCAN
        (2474 - 2494 @ 40), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
        (5140 - 5860 @ 80), (N/A, 30), (N/A), PASSIVE-SCAN

[ZerBea]

That depend on your operating system. You can find out exactly how to do this in your distribution's documentation.

On Arch Linux the settings are located here:
/etc/conf.d/wireless-regdom

[LLH-l]

Sorry @ZerBea
I checked to it, RTL8812BU no problem, in all channel ok, the is a USB interface error issue ,need retry again insert wireless card
hcxdumptool work good thanks. . .

[ZerBea]

Glad to hear that is working, now.

By default, KALI is not configured as you might expect it. Just take a look at DFS-UNSET and you now what I mean.
The RTL8812AU/RTL8812BU driver (third party driver) is not part of the Linux kernel tree. You should expect problems.

[LLH-l]

country 00: DFS-UNSET
Regulatory Domain: 00
5GHz and partly 2.4GHz will not work as expected!
If RADAR is detected, hcxdumptool will not transmit on DFS channels and it does not transmit on passive scan only channels.

Please do not forget to set your regulator domain.
DFS-UNSET (00) is the worst setting.

RT5572
How change regulatory domain and country DFS-UNSET ?

[ZerBea]

To do this non persistent:
sudo iw reg set US
where US is the country code
https://www.thinkpenguin.com/gnu-linux/country-code-list

To do this persistent, please refer to the documentation of your distribution

[LLH-l]

I do many experiments In 5GHz channel: 36,40,44,48,52,56,60,64,149,153,157,161,165

e.g
In confirmed repeatedly the AP 60 channel capture fail,
I attempted switch the AP channel to 149, success capture to it
This should is because the injected attack frame not working (in 60 channel)
Forced re association access points, cancels client authentication fail

[ZerBea]

As long as you get this ( DFS-UNSET) after requesting the wireless regulatory domain settings (iw reg get):

country 00: DFS-UNSET
	(755 - 928 @ 2), (N/A, 20), (N/A), PASSIVE-SCAN
	(2402 - 2472 @ 40), (N/A, 20), (N/A)
	(2457 - 2482 @ 20), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
	(2474 - 2494 @ 20), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
	(5170 - 5250 @ 80), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
	(5250 - 5330 @ 80), (N/A, 20), (0 ms), DFS, AUTO-BW, PASSIVE-SCAN
	(5490 - 5730 @ 160), (N/A, 20), (0 ms), DFS, PASSIVE-SCAN
	(5735 - 5835 @ 80), (N/A, 20), (N/A), PASSIVE-SCAN
	(57240 - 63720 @ 2160), (N/A, 0), (N/A)

injection may fail.

https://installati.one/install-crda-kalilinux/

[LLH-l]

I think, need use different attacks achieve cancel client authentication
Only relying one type attack is far from enough

[LLH-l]

OK, good...test in 5GHz all channel successfully capture
I believe hcxdumpttool is best capture handshakes tool ! thanks thanks

[LLH-l]

Regulatory domain code test sort
Recommend add to help information
hcxdumptool -help

domain code sort
IN ** ** ** ** etc

[ZerBea]

No, this is networks basics and the settings highly depend on the distribution. I don't want to blow up help by adding this basics.
https://wiki.archlinux.org/title/Network_configuration/Wireless#Respecting_the_regulatory_domain

We always come to this point:
#388 (reply in thread)

https://www.kali.org/docs/general-use/kali-training/
and they get paid for this!

I'm not a KALI help desk!

[LLH-l]

In start run hcxdumptoool, at least should remind them

[ZerBea]

No, using wireless settings which do not match to your country is illegal.

[LLH-l]

@ZerBea
This command cannot set the "phy#3" regulatory domain, it is wireless interface network card
How can set "phy#3" to IN by using command method ?

$ sudo iw reg set IN
$ iw reg get

global
country IN: DFS-UNSET
	(2402 - 2482 @ 40), (N/A, 30), (N/A)
	(5150 - 5250 @ 80), (N/A, 30), (N/A)
	(5250 - 5350 @ 80), (N/A, 24), (0 ms), DFS
	(5470 - 5725 @ 160), (N/A, 24), (0 ms), DFS
	(5725 - 5875 @ 80), (N/A, 30), (N/A)

phy#3
country 99: DFS-UNSET
        (2402 - 2472 @ 40), (N/A, 20), (N/A)
        (2457 - 2482 @ 40), (N/A, 20), (N/A), PASSIVE-SCAN
        (2474 - 2494 @ 40), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
        (5140 - 5860 @ 80), (N/A, 30), (N/A), PASSIVE-SCAN

[ZerBea]

This can't be done by "iw reg set" because the wireless regulatory domain is either hard coded by driver or hard coded by device firmware.
Please comment vendor and driver of this interface.

An example.
I have a cheap TP-Link TL WN722N bought in China. The wireless regulatory domain is "hard" coded (EEPROM) to CN:
$ sudo iw reg set US

$ iw reg get
global
country 98: DFS-FCC
	(2400 - 2472 @ 40), (N/A, 20), (N/A)
	(5150 - 5250 @ 100), (N/A, 20), (0 ms), DFS, AUTO-BW
	(5250 - 5350 @ 100), (N/A, 20), (0 ms), DFS, AUTO-BW
	(5725 - 5730 @ 5), (N/A, 24), (0 ms), DFS
	(5730 - 5850 @ 80), (N/A, 30), (N/A)
	(57240 - 59400 @ 2160), (N/A, 28), (N/A)
	(59400 - 63720 @ 2160), (N/A, 40), (N/A)
	(63720 - 65880 @ 2160), (N/A, 28), (N/A)

phy#3
country CN: DFS-FCC
	(2400 - 2483 @ 40), (N/A, 20), (N/A)
	(5150 - 5350 @ 80), (N/A, 20), (0 ms), DFS, AUTO-BW
	(5725 - 5850 @ 80), (N/A, 33), (N/A)
	(57240 - 59400 @ 2160), (N/A, 28), (N/A)
	(59400 - 63720 @ 2160), (N/A, 44), (N/A)
	(63720 - 65880 @ 2160), (N/A, 28), (N/A)

To change the regulatory domain, it is possible to modify the EEPROM value (in case of this Atheros device):
https://github.com/0x90/iwleeprom

[LLH-l]

https://github.com/aircrack-ng/rtl8812au
After success install the RTL8812AU driver
run . . .

$ sudo iw reg set IN
$ iw reg get
global
country IN: DFS-UNSET
	(2402 - 2482 @ 40), (N/A, 30), (N/A)
	(5150 - 5250 @ 80), (N/A, 30), (N/A)
	(5250 - 5350 @ 80), (N/A, 24), (0 ms), DFS
	(5470 - 5725 @ 160), (N/A, 24), (0 ms), DFS
	(5725 - 5875 @ 80), (N/A, 30), (N/A)

phy#3
country 99: DFS-UNSET
        (2402 - 2472 @ 40), (N/A, 20), (N/A)
        (2457 - 2482 @ 40), (N/A, 20), (N/A), PASSIVE-SCAN
        (2474 - 2494 @ 40), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
        (5140 - 5860 @ 80), (N/A, 30), (N/A), PASSIVE-SCAN

$ iw dev    
phy#3
        Interface wlan0

"phy#3" Interface becoming 8812AU, in normal circumstances, it not like this
So, I uspected driver issue

[ZerBea]

RTL8812AU is not a Linux stock kernel driver.
Support is here:
https://github.com/aircrack-ng/rtl8812au

[LLH-l]

But a good news
Kali officially will RTL8812BU driver add to kali
I use hcxdumptool test 8812bu running very good

[ZerBea]

RTL8812BU is not a Linux stock kernel driver.
In case of problems, you have to report them on KALI bug tracker.

[LLH-l]

Hello, ZerBea
Channel frequency algorithm seems have some error ?

4920 [184] disabled     4940 [188] disabled
4960 [192] disabled     4980 [196] disabled

rt5572

[ZerBea]

No. These are 802.11j channels (4.9–5.0 GHz):
https://en.wikipedia.org/wiki/List_of_WLAN_channels

Your device support them, but they are disabled by wireless regulatory domain settings.

hcxdumptool is able to use all(!) frequencies (channels) supported by the device and allowed by your wireless regulatory domain settings.

[LLH-l]

Good my believe

[ZerBea]

Please note:
Channel numbers are not unique since WiFi 6.
That is the reason why it is mandatory to either use frequency options or to add the band to channel option!

[LLH-l]

Thanks I very like hcxdumptool

[LLH-l]

I have another issue
e.g
Using the command
hcxdumptool -m wlan0
5745 [149]
Display this wireless card support this channel 149

then . .
I set the channel to 149 on the router, but my using this wireless card, canno success connect it (my AP, Use PSK correct)

I tried switching to another channel again, but this wireless card cannot display this signal !
When I set to other channel ( E.g 36, 40, 44, 48, 52, 56, 60 ），can success connect !
It should not be driver or system issue, nor an AP issue
I guess the wireless card does't support on some channel connect communication
In Linux and windows test it
This hardware itself issue ?

[ZerBea]

If hcxdumptool show that the frequency is supported by the device and it is not disabled by wireless regulatory domain settings you can use it (5745 [149] 13.0 dBm == ch 149b)

Double check that all capabilities are allowed:
(5725 - 5850 @ 80), (N/A, 33), (N/A)