musket33 / varmacscan Goto Github PK

It seems like every time I run the script it starts over. I think this means new SSID list and trying the same pins over again on the same networks. Could you implement some way to save/resume sessions?

Also for SSID that are too weak and produce a lot of wps transction failed errors, the script keeps trying over and over again on them instead of giving up or slowing down/adjusting reaver, ie the 2nd command in the MDK version.

In my experience, fwiw in 2017 the process needs to be hammer AP slowly until rate limits and move on to the next and next and then go around again. There are 3-10 tries per AP anyway. So avoiding multiple attempts of the same pin would be ideal.

Here are some suggestions i believe will improve UX for varmacscan

• Remove all "confirmation prompts" or at least replace the "read VAR" with "read -n1 VAR" on them so user just have to press y/n instead of y/n+enter.

• Make all questions that need only one char as answer read the response with "read -n1".
  Some methods that contains "read var" and could change to "read -n1 var":
  USEAIR_OLD_fn()
  MANUAL_SELECT_fn()
  PIN_SELECT_fn()
  STIM_SELECT_fn()
  etc

• Replace all random 3 sec delay inside code with 1.5 sec.

• Add "--wps" flag for all "airdump-ng" commands so user can see in real time status of WPS (easier to spot APs that disable or lock WPS during bruteforce attacks). Also if possible, detect when a AP WPS is changed to lock or disabled and interrupt the attack to save time (go to next target).

• Remove weak signal APs from the wash01.txt scan list (remove all -8... and -9... dBm) as they're more likely to waste attack time. Add before line 4853 "# Remove all targets except mac fragment as selected else all."

# Filter out weak/bad signal targets (-8.. and -9.. dBm) ($7 is ESSID, if you want to filter specific APs)
cat < /tmp/wash01.txt | awk -F' ' '{ if(($3 !~ "-8") && ($3 !~ "-9") && ($7 ~ "")) {print $a}}' > /tmp/wash01signal.txt
cp /tmp/wash01.txt /tmp/wash01original.txt
mv /tmp/wash01signal.txt /tmp/wash01.txt

• Run airodump-ng filtering the target (add "--bssid $bssid" flag to cmd) on Scan 0 to Scan 4
  xterm -g 140x10-1+250 -T "Airodump-ng Scan 1" -e "airodump-ng --bssid $bssid -c $channel --wps --berlin 10000000 --beacons -w /tmp/ESSIDPROBE_DIR/singchan $monitor" &

Can you please help me with this. Airodump-ng passive scan shows lots of networks but its not showing on wash target scan. I'm using Kali GNU/Linux Rolling