00 ~ About - SYWorks/wireless-ids GitHub Wiki

Wireless IDS [Intrusion Detection System]

Description

Wireless IDS is an open source tool written in Python and work on Linux environment. This tool may be useful to those wireless penetration testers, enforcers, trainers and for those who interest and want to know more about wireless hacking..WIDs will sniff your surrounding air traffic for suspicious activities such as WEP/WPA/WPS attacking packets. It do the following

Detect mass deauthentication sent to client / access point which unreasonable amount indicate possible WPA attack for handshakes.
Continual sending data to access point using broadcast MAC address which indicate a possibility of WEP attacks
Unreasonable amount of communication between wireless client and access point using EAP authentication which indicate the possibility of WPS bruteforce attack by Reaver / WPSCrack
Detection of changes in connection to anther access point which may have the possibility of connection to Rogue AP (User needs to assess the situation whether similar AP name)

Wireless IDS script have been tested and working well on Backtrack 5.R3 and Kali Linux without having the need to install any new modules or other applications.

Subsequent revision (Detection)

Display similar Access Point's name (SSID) which could have the possibility of WiFi 'Evil Twins'.
Display of probing SSID by wireless devices
Detection of Korek Chopchop packets sent by Aircrack-NG (WEP attacks)
Detection of Fragmentation PRGA packets sent by Aircrack-NG (WEP attacks)
Detection of possible WPA Downgrade attack by MDK3
Detection of possible Michael Shutdown exploitation (TKIP) by MDK3
Detection of Beacon flooding by MDK3
Detection of possible Authentication DoS by MDK3
Detection of possible association flooding
Detection of WPA Migration Attack by Aircrack-NG (WPA Attack)

Subsequent revision (Functions)

Allow logging of events to file.
Allow disabling of displaying of probing devices

Visit my Facebook Page for other updated information and tools.