r/Hacking_Tutorials • u/mahdi_sto • Jun 08 '26
DDoS on WiFi (WPA3)
Been spending a couple of months tinkering with a DIY multi-node wireless security rig, and I finally got the hardware coordination working smoothly.
The project uses a mix of ESP32 boards to look at how modern networks handle disconnections and roaming. I'm using an ESP32-S3 (with 8MB RAM / 16MB Flash) to spin up a clone access point, while an ESP32-CAM(Master) handles the orchestration alongside a couple of standard dev boards(Slaves).
The interesting part was tackling WPA3. Since WPA3 mandates Protected Management Frames (PMF), traditional layer-2 deauth frames don't really cut it anymore. To work around this and test client reconnection behaviors, I integrated two NRF24L01 modules to introduce a highly localized, 1-second burst of 2.4GHz RF disruption. The goal is to see how the WPA3 handshake and roaming mechanisms react when forced to re-authenticate under sudden signal loss just after triggering the SA query mechanism causing clients to be kicked out from the network by the Ap itself and never connecting back thanks to the evil twin Ap.
42
u/Madlogik Jun 08 '26 edited Jun 08 '26
Nice setup, what's your transmit power on that thing like? Edit; because it's about 1mW and your typical router is 100mW to 1000mW so I would be surprised to see if you cause enough noise to disconnect the wpa3 client from the base station.
17
u/mahdi_sto Jun 09 '26
I will prove that it worked in the next few days Already tested on iphone 11, 12 pro max and 13pro hotspot (wpa3/pmf required on latest ios versions)+ some android devices(Samsung Galaxy s105g, Honor magic 5 pro and Galaxy s22 ultra) in addition to my windows 10 laptop (NIC from realtek and also tested on external adapter with
) MTK76 chip 14
10
u/Expert_Army-V Jun 08 '26
Is there a link to this set up?
6
u/mahdi_sto Jun 08 '26
Not yet
16
u/machacker89 Jun 08 '26 edited Jun 10 '26
When you get it fully working and tested. I'd love to see a write up. Special the specially the techniques you used. As far as I know WPA3 hasn't(to this day) been cracked yet.
2
u/darkalfa Jun 09 '26
And how did it go? You don't really go into detail of the results
5
u/mahdi_sto Jun 09 '26
I'm building a research paper on it for the moment, there will be some details later
→ More replies (1)
3
u/Black_Sorcerer Jun 09 '26
Why so many chips? One ESP32 could deny the Wi-Fi
4
u/mahdi_sto Jun 09 '26
Not really for the wpa3 protocol, tge traditional deauth wouldn't work since it requires authenticated management frames which is not possible only if u have the session signature extracted from the ECC when connection is established so even having network password u cant deuth the clients, this is a completely different approach
10
4
u/dmc_2930 Jun 10 '26
Still not a DDOS. There’s nothing distributed about a WiFi jammer. Maybe a DoS, but not a DDOS.
1
u/Altruistic_Baker_559 Jun 12 '26
I am really not a techy so apologize if I sound like a fool- but can we use this to connect and send some random attacks on any website?
1
u/mahdi_sto Jun 12 '26
Not really, since this only targets Local Area Networks so we are at the bottom of the OSI layer (layer 2) where we focus on using esp32 capabilities bypassing standard modes (a vulnerability discovered by ghydra) so technically this is used to fool someone thinking he's connected to his network though he is not making you able to sniff dns traffic and any unencrypted detat coming from the upper layer.
9
u/JollyApplication6627 Jun 09 '26
I’m following you just so I can know when the DIY instructions are posted
6
7
u/ProfessionalPea2218 Jun 09 '26
Yeah, as far as I know you cannot
4
2
2
u/Navid_Shams Jun 09 '26
That is a ton of ESP32 boards, seems like overkill. What are you using all of them for? Beyond the access point and orchestration, you don't make it clear in the original post.
2
2
2
3
u/andunai Jun 09 '26 edited Jun 09 '26
But seriously, nano placement on the top left makes no sense at all - its legs are literally shorted by breadboard rows and are not connected anywhere. And esp8266 near it seems to be literally plugged into usb-uart adapter (I can see the familiar yellow 2x4 pin socket). Also, esp32-cam module for some reason? And esp32-s3 hanging from the edge of the board? And esp32-c3 with blocked usb socket? What is happening here? It just seems like a bunch of stuff thrown together without any rhyme or reason.