Drift — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Drift is a wireless reconnect client designed to be installed on a device already connected to a target wireless network. It periodically disconnects and reconnects to the network, generating deauthentication and re-association traffic that can be used to trigger and test wireless misconfiguration vulnerabilities.

Architecture: Drift is a lightweight, single-file CLI tool with no Flask component or web UI. It uses platform-specific wireless management commands to perform disconnect/reconnect cycles. The tool auto-detects the operating system (Linux or macOS) and dispatches to the appropriate command set.

Workflow:

Interface Detection — Automatically detects the active wireless interface. On Linux, queries iw dev and falls back to /proc/net/wireless. On macOS, probes the Apple80211 framework and defaults to en0.
SSID Verification — Before each cycle, checks the currently associated SSID using iwgetid (Linux) or airport -I (macOS). Skips the cycle if not associated with the target SSID.
Disconnect — Attempts disconnection using multiple methods in priority order:
- Linux: iw <iface> disconnect → wpa_cli -i <iface> disconnect → nmcli device disconnect <iface>
- macOS: airport <iface> -z (disassociate) with Apple80211 framework fallback
Wait Period — Pauses 3 seconds after disconnect to ensure the deauthentication frame window is captured by any monitoring tool.
Reconnect — Reconnects to the target SSID using:
- Linux: nmcli device wifi connect <ssid> ifname <iface> → wpa_cli -i <iface> reconnect → iw <iface> connect <ssid>
- macOS: networksetup -setairportnetwork <iface> <ssid>
Association Polling — After reconnect, polls every 2 seconds for up to 20 seconds to confirm the interface re-associated with the expected SSID.
Jittered Sleep — Sleeps for the configured interval plus random jitter (minimum 10 seconds floor) before the next cycle.

Use with Aether: Drift is typically deployed on a second device while Aether (or Aether-B/Z/U) monitors the same network from the attacking station. Drift's reconnect traffic triggers PMKID capture, KRACK retransmission windows, and WPA-Enterprise credential replay opportunities that Aether can capture.

Phase Pipeline

Phase 1 — Interface Detection
Phase 2 — Network Scanning
Phase 3 — RF Monitoring
Phase 4 — Attack Execution
Phase 5 — Findings Generation

Security

Drift deliberately generates wireless deauthentication and re-association traffic on a target network. It requires the device to already be an authorized client on the target SSID (connected with valid credentials). The tool does not perform any injection or eavesdropping itself — it is a traffic generator that creates opportunities for other tools to capture authentication handshakes.

A dry-run mode (--dry-run) allows testing the cycle logic without actually disconnecting, useful for verifying interface detection and timing before a live engagement.

Features

Platform Support

Linux Support

Uses iw, wpa_cli, nmcli, and iwgetid for wireless management on Linux. Falls back through multiple tools automatically if one is unavailable.

macOS Support

Uses Apple80211 airport framework for status/disconnect and networksetup for reconnection on macOS.

Automatic Interface Detection

Detects the active wireless interface automatically. On Linux, parses 'iw dev' output and /proc/net/wireless. On macOS, queries the airport framework and defaults to en0.

Safety & Logging

Dry-Run Mode

Simulates disconnect/reconnect cycles without actually touching the wireless interface. Useful for verifying timing and configuration before a live test.

Timestamped Logging

Logs every action with timestamps. Supports logging to a file (--log-file) in addition to or instead of stdout (--no-log suppresses stdout).

Jitter Randomization

Adds configurable random jitter to the sleep interval between cycles (--jitter, default 20s) to avoid predictable patterns. Enforces a minimum 10-second floor on the sleep interval.

Wireless Cycling

Periodic Disconnect/Reconnect

Continuously cycles through disconnect and reconnect operations at configurable intervals (default: 90 seconds) with random jitter (default: +/- 20 seconds) to generate deauth/re-association traffic.

Configurable Cycle Count

Run a fixed number of cycles (--count N) or run indefinitely (--count 0, the default) until manually interrupted with Ctrl+C.

SSID Verification

Verifies the interface is associated with the target SSID before each disconnect cycle. Skips the cycle with a log message if the device has drifted to a different network or lost association.

Association Polling

After reconnecting, polls every 2 seconds for up to 20 seconds to confirm the interface re-associated with the expected SSID before proceeding.

Use Cases

PMKID Capture Assistance

Deploy Drift on a device connected to the target WPA2 network while running hcxdumptool or Aether on the attacking station. Drift's reconnect cycles generate EAPOL frames that contain PMKID values, which can be captured for offline key cracking.

WPA Handshake Generation

When a monitoring tool needs a complete four-way handshake, Drift generates legitimate deauth/re-association sequences from an authorized client, producing clean handshake captures without external deauthentication attacks.

KRACK Retransmission Window Testing

Generate repeated re-association events to test whether the target access point is vulnerable to Key Reinstallation Attacks (KRACK) by creating retransmission windows during the WPA2 handshake.

WPA-Enterprise Credential Replay

On WPA-Enterprise networks, Drift's reconnect cycles transmit EAP credentials to the RADIUS server, creating opportunities for credential interception if a rogue AP or MitM is in place.

Wireless IDS/IPS Testing

Generate controlled deauthentication and reconnection traffic patterns to test whether the target network's wireless intrusion detection/prevention system properly alerts on repeated disassociation events.

CLI Reference

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

iw

Linux wireless interface management: device enumeration (iw dev), link status (iw <iface> link), disconnect (iw <iface> disconnect), and open-network connect (iw <iface> connect <ssid>)

iw dev

iw wlan0 link

sudo iw wlan0 disconnect

sudo iw wlan0 connect CorpWifi

wpa_cli

Linux WPA supplicant control: disconnect and reconnect operations via the wpa_supplicant daemon

sudo wpa_cli -i wlan0 disconnect

sudo wpa_cli -i wlan0 reconnect

nmcli

Linux NetworkManager CLI: device disconnect and WiFi connect as a fallback when iw/wpa_cli are unavailable

sudo nmcli device disconnect wlan0

sudo nmcli device wifi connect CorpWifi ifname wlan0

iwgetid

Linux utility to retrieve the current SSID of a wireless interface

iwgetid wlan0 -r

airport

macOS Apple80211 framework utility: query current SSID (airport -I) and disassociate (airport -z)

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I

sudo airport en0 -z

networksetup

macOS network configuration: join a saved WiFi network profile

networksetup -setairportnetwork en0 CorpWifi

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Drift && python3 drift.py [OPTIONS]` Run directly with command-line arguments.

Integration

Used By

Aether (generates handshake traffic)

Metadata

Name	Drift
Category	Wireless
Version	unknown
Install Path	`/opt/pr0t31n/Drift`
Main File	`drift.py`
GitHub	https://github.com/pr0t31n/Drift.git