TechKnowSurge
TechKnowSurge Catalog Videos Wi-Fi Deauthentication Attack
VideoSecurityFree

Wi-Fi Deauthentication Attack

A Wi-Fi deauthentication attack exploits unencrypted management frames to forcibly disconnect a client from an access point, enabling denial-of-service or adversary-in-the-middle attacks. It is a foundational wireless attack technique and a common precursor to the evil twin attack.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireless communication exposes more information than many users realize. Even when data payloads are encrypted, management frames — including deauthentication frames — are transmitted in plaintext, allowing any nearby observer to capture device MAC addresses and monitor connection activity. This exposure forms the foundation of the Wi-Fi deauthentication attack, a technique that weaponizes a legitimate protocol mechanism to disrupt wireless connectivity. The attack works by spoofing a deauthentication frame on behalf of the targeted client. Because the access point has no way to verify the true origin of the frame, it treats the spoofed request as legitimate and drops the client from the network. At its most basic, this constitutes a denial-of-service attack — the client loses connectivity and may be prevented from reconnecting entirely if the attacker continues flooding deauthentication frames. More significantly, the deauthentication attack is a reliable precursor to the evil twin attack. Once the legitimate client is disconnected, it will automatically attempt to reestablish its wireless connection. If the attacker has deployed a rogue access point mimicking the legitimate one, the client may connect to it instead. From that position, the attacker can conduct an adversary-in-the-middle attack, intercepting and potentially manipulating all traffic passing between the client and the network. Understanding this attack chain is essential for anyone working in wireless security, penetration testing, or network defense.

What you'll learn

What's covered

Wi-Fi Deauthentication Attack

Key terms

Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Man-in-the-Middle Attack
MitM
An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Wireless Access Point
WAP
A device that allows wireless devices to connect to a wired network using Wi-Fi.
Deauthentication Attack
A wireless denial-of-service attack in which an attacker spoofs a client's MAC address to send forged deauthentication frames to an access point, forcibly disconnecting the client.
Evil Twin Attack
An attack in which a rogue wireless access point mimics a legitimate one to intercept client connections and enable an adversary-in-the-middle attack.

Topics

Wireless Security Deauthentication Attack 802 11 Management Frames Denial Of Service Evil Twin Attack Adversary In The Middle Networking

Transcript

Everything Is Done Through the Air

When two devices are connected wirelessly, everything is done through the air. So here we've got a client machine talking to an access point, and all of the communication can be seen by everyone else. This could be encrypted, but not all of the data that's being passed back and forth is encrypted. This means as an attacker we can listen in on this conversation and see a lot of valuable information. For instance, we can see what the MAC address is of these two devices, this access point and this client over here.

Spoofing a Deauthentication

One thing during Wi-Fi communication is that a client can ask to be deauthenticated. This essentially just means that they're done communicating. So if a machine says, hey, I'm done communicating, then there's no longer need for communication back and forth.

The thing is that this is easily spoofed. As an attacker, we can listen in on the conversation here, see what the MAC address is of this machine, and then emulate that and send it to the access point. And then this access point is going to deauthenticate, or stop communication with, this client machine. Therefore, this is a way that we can carry out a denial of service attack.

This is often a precursor to an evil twin attack, where we can start emulating this access point. Now, sending this deauthentication will disconnect the client from that access point. That client will then try to set up that communication again and will reauthenticate. And if you act as a rogue access point that this machine is making a connection to, now you can carry out an adversary attack — or, since this is wireless, it's called an evil twin attack.

The Attack Card

So here's our attack card on our Wi-Fi deauthentication attack. Essentially, it's a way that we can carry out a denial of service attack, or the precursor to doing something like an adversary in the middle attack, where we can send a deauthentication to the access point disconnecting the communication between a client and that access point. Now that client is going to try to reestablish that connection, and we can block that, or we can use ourselves as being an evil twin mimicking this access point and then getting in between, carrying out an adversary in the middle attack.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →