new: wifi.probe to send fake client probe requests

modules/wifi/wifi.go

@@ -200,6 +200,21 @@ func NewWiFiModule(s *session.Session) *WiFiModule {
 
 	mod.AddHandler(deauth)
 
+	probe := session.NewModuleHandler("wifi.probe BSSID ESSID",
+		`wifi\.probe\s+([a-fA-F0-9:]{11,})\s+([^\s].+)`,
+		"Sends a fake client probe with the given station BSSID, searching for ESSID.",
+		func(args []string) error {
+			bssid, err := net.ParseMAC(args[0])
+			if err != nil {
+				return err
+			}
+			return mod.startProbing(bssid, args[1])
+		})
+
+	probe.Complete("wifi.probe", s.WiFiCompleterFull)
+
+	mod.AddHandler(probe)
+
 	mod.AddParam(session.NewStringParameter("wifi.deauth.skip",
 		"",
 		"",

modules/wifi/wifi_deauth.go

@@ -159,4 +159,4 @@ func (mod *WiFiModule) startDeauth(to net.HardwareAddr) error {
 	}()
 
 	return nil
-}
+}

modules/wifi/wifi_recon.go

@@ -2,6 +2,7 @@ package wifi
 
 import (
 	"bytes"
+	"net"
 	"time"
 
 	"github.com/bettercap/bettercap/network"
@@ -49,6 +50,30 @@ func (mod *WiFiModule) stationPruner() {
 	}
 }
 
+func (mod *WiFiModule) startProbing(staMac net.HardwareAddr, ssid string) error {
+	// if not already running, temporarily enable the pcap handle
+	// for packet injection
+	if !mod.Running() {
+		if err := mod.Configure(); err != nil {
+			return err
+		}
+		defer mod.handle.Close()
+	}
+
+	for seq := uint16(0); seq < 5 && mod.Running(); seq++ {
+		if err, pkt := packets.NewDot11ProbeRequest(staMac, seq, ssid, network.GetInterfaceChannel(mod.iface.Name())); err != nil {
+			mod.Error("could not create probe packet: %s", err)
+			continue
+		} else {
+			mod.injectPacket(pkt)
+		}
+	}
+
+	mod.Info("sent probe frames")
+
+	return nil
+}
+
 func (mod *WiFiModule) discoverAccessPoints(radiotap *layers.RadioTap, dot11 *layers.Dot11, packet gopacket.Packet) {
 	// search for Dot11InformationElementIDSSID
 	if ok, ssid := packets.Dot11ParseIDSSID(packet); ok {