You're on-site for a wireless assessment. Evil twin AP is up, same SSID, same encryption type, signal stronger than the real access point. You fire the deauth frames at the target client, the same attack that's worked in every lab and every CTF you've practiced against. The tool reports success, frames sent, no errors. And the client just stays connected to the legitimate AP like nothing happened. No reconnection, no handshake capture, no drop in signal on their end at all. You check your syntax, you check your interface is in monitor mode, you check the target MAC address twice. Everything about your attack is correct. It still doesn't work, and the tool never tells you why.
The answer isn't a misconfigured adapter. It's Protected Management Frames, 802.11w, and it's been quietly closing off the deauth attack you learned first for a few years now.
Deauth and disassociation frames are management frames, not data frames, and for most of Wi-Fi's history management frames were sent completely unauthenticated. Anyone in range could forge one and the client's radio would honor it as if the real AP sent it, because there was no way to tell the difference. That's the entire mechanism behind the deauth attack: spoof the AP's address, tell the client "disconnect," and it does, because it has no way to verify the frame is a lie.
PMF changes exactly that. It adds a cryptographic layer to management frames using keys derived during the original authentication handshake, so a forged deauth frame from an attacker who was never part of that handshake gets silently dropped by the client's radio. Not rejected with an error. Not logged anywhere you can see. Just ignored, as if you never sent it. WPA3 makes PMF mandatory. WPA2 has supported it as optional for years, and a growing number of networks, especially anything touched by a security-conscious IT team or a modern enterprise AP vendor, turn it on by default now.
The mistake isn't running the attack wrong. It's not checking for PMF before you commit engagement hours to an attack that was never going to work against this specific network, and having no way to explain to a client afterward why the wireless assessment came back with nothing.
Check for PMF before you touch a deauth frame. The beacon frames from the target AP advertise this in their RSN capabilities. airodump-ng surfaces PMF status directly in newer versions, and tools like wpa_supplicant's scan output or a Wireshark capture of the beacon will show the MFPC (management frame protection capable) and MFPR (required) bits. Five minutes of passive recon here saves you from an entire engagement day of deauth frames that silently go nowhere.
If PMF is on, deauth is off the table, but the handshake usually still isn't. You don't need to force a reconnection if you can capture the initial four-way handshake when a client joins normally, or target clients that are already configured to auto-connect to open or misconfigured networks regardless of what the "protected" network is doing. The attack surface shifts from forcing a disconnect to being patient and opportunistic instead.
The same lesson shows up on the wired side with ARP spoofing. Dynamic ARP Inspection on a managed switch will drop ARP replies that don't match its DHCP snooping binding table, again silently, again with your tool reporting success while nothing actually reaches the target. The specific defense is different, wireless management frame protection versus switch-level ARP validation, but the trap is identical: a five-year-old tutorial assumes an undefended network, and modern environments increasingly aren't one.
Codelivly's Practical Man-in-the-Middle Attacks book builds against this actual current threat model instead of the undefended-network assumption most MITM material still teaches from, covering where ARP spoofing, DNS spoofing, evil-twin Wi-Fi, and SSL interception still work and where they get quietly shut down. If you want to see PMF and evil-twin mechanics against something real first, the free Wireless & Social Engineering learning path and the Aircrack-ng Suite & Wireless Attacks room put an actual target network in front of you before you spend anything.
Top comments (0)