new: wifi.deauth now accepts a broadcast bssid, in which case it'll start deauthing every client from every access point

modules/wifi.go

@@ -87,7 +87,7 @@ func NewWiFiModule(s *session.Session) *WiFiModule {
 		}))
 
 	w.AddHandler(session.NewModuleHandler("wifi.deauth BSSID", `wifi\.deauth ((?:[0-9A-Fa-f]{2}[:-]){5}(?:[0-9A-Fa-f]{2}))`,
-		"Start a 802.11 deauth attack, if an access point BSSID is provided, every client will be deauthenticated, otherwise only the selected client.",
+		"Start a 802.11 deauth attack, if an access point BSSID is provided, every client will be deauthenticated, otherwise only the selected client. Use a broadcast BSSID (ff:ff:ff:ff:ff:ff) to iterate every access point with at least one client and start a deauth attack for each one.",
 		func(args []string) error {
 			bssid, err := net.ParseMAC(args[0])
 			if err != nil {

modules/wifi_deauth.go

@@ -52,6 +52,29 @@ func (w *WiFiModule) startDeauth(to net.HardwareAddr) error {
 	w.writes.Add(1)
 	defer w.writes.Done()
 
+	// deauth all the things!
+	if network.IsBroadcastMac(to) {
+		log.Info("Initiating broadcast deauth attack ...")
+		aps := w.Session.WiFi.List()
+		for _, ap := range aps {
+			clients := ap.Clients()
+			if numClients := len(clients); numClients > 0 {
+				log.Info("Deauthing %d clients from AP %s ...", numClients, ap.ESSID())
+				w.onChannel(network.Dot11Freq2Chan(ap.Frequency), func() {
+					for _, c := range clients {
+						if !w.Running() {
+							break
+						}
+						w.sendDeauthPacket(ap.HW, c.HW)
+					}
+				})
+
+			}
+		}
+
+		return nil
+	}
+
 	bssid := to.String()
 
 	// are we deauthing every client of a given access point?