1AIRDECLOAK-NG(1) General Commands Manual AIRDECLOAK-NG(1)
2
6 airuncloak-ng - Removes wep cloaked framed from a pcap file.
7
9 airuncloak-ng <options>
10
12 airuncloak-ng is a tool that removes wep cloaking from a pcap file.
13 Some WIPS (actually one) can actively "prevent" cracking a WEP key by
14 inserting chaff (fake wep frames) in the air to fool aircrack-ng. In
15 some rare cases, cloaking fails and the key can be recovered without
16 removing this chaff. In the cases where the key cannot be recovered,
17 use this tool to filter out chaff.
18 The program works by reading the input file and selecting packets from
20 a specific network. Each selected packet is put into a list and clas‐
21 sified (default status is "unknown"). Filters are then applied (in the
22 order specified by the user) on this list. They will change the status
23 of the packets (unknown, uncloaked, potentially cloaked or cloaked).
24 The order of the filters is really important since each filter will
25 base its analysis amongst other things on the status of the packets and
26 different orders will give different results.
27 Important requirement: The pcap file needs to have all packets (includ‐
29 ing beacons and all other "useless" packets) for the analysis (and if
30 possible, prism/radiotap headers).
31
33 -h, --help
34 Shows the help screen.
35 -i <file>
37 Path to the capture file.
38 --ssid <ESSID>
40 Essid of the network (not yet implemented) to filter.
41 --bssid <BSSID>
43 BSSID of the network to filter.
44 --null-packets
46 Assume that null packets can be cloaked.
47 --disable-base-filter
49 Do not apply base filter.
50 --drop-frag
52 Drop fragmented packets.
53 --filters <filters>
55 Apply different filters (separated by a comma). See below.
56
58 signal Try to filter based on signal (prism or radiotap headers in the
59 pcap file).
60 duplicate_sn
62 Remove all duplicate sequence numbers for both the AP and the
63 client (that are close to each other).
64 duplicate_sn_ap
66 Remove duplicate sequence number for the AP only (that are close
67 to each other).
68 duplicate_sn_client
70 Remove duplicate sequence number for the client only (that are
71 close to each other).
72 consecutive_sn
74 Filter based on the fact that IV should be consecutive (only for
75 AP).
76 duplicate_iv
78 Filter out all duplicate IV.
79 signal_dup_consec_sn
81 Use signal (if available), duplicate and consecutive sequence
82 number (filtering is much more precise than using all these fil‐
83 ters one by one).
84
86 This manual page was written by Thomas d'Otreppe. Permission is
87 granted to copy, distribute and/or modify this document under the terms
88 of the GNU General Public License, Version 2 or any later version pub‐
89 lished by the Free Software Foundation On Debian systems, the complete
90 text of the GNU General Public License can be found in /usr/share/com‐
91 mon-licenses/GPL.
92
94 airbase-ng(8)
95 aireplay-ng(8)
96 airmon-ng(8)
97 airodump-ng(8)
98 airodump-ng-oui-update(8)
99 airserv-ng(8)
100 airtun-ng(8)
101 besside-ng(8)
102 easside-ng(8)
103 tkiptun-ng(8)
104 wesside-ng(8)
105 aircrack-ng(1)
106 airdecap-ng(1)
107 airolib-ng(1)
108 besside-ng-crawler(1)
109 buddy-ng(1)
110 ivstools(1)
111 kstats(1)
112 makeivs-ng(1)
113 packetforge-ng(1)
114 wpaclean(1)
115 airventriloquist(8)
116Version 1.6.0 January 2020 AIRDECLOAK-NG(1)