KTO 🦿 Kick Them Out

Point it at an SSID and it automatically discovers every connected client and kicks them --- including ones that try to reconnect --- with no manual targeting needed.

Tools like aireplay-ng make you supply a BSSID and a client MAC. You have to know who's on the network first, and if someone reconnects you have to catch them yourself and run it again. KTO does all of that automatically in a loop: continuous scan → live client list → auto deauth → repeat. Anyone who reconnects gets caught on the next sweep.

Authorized use only. Only run this against networks you own or have explicit written permission to test. Unauthorized deauthentication is illegal in most jurisdictions.

Features

• Live blacklist --- client list updates every sweep, new joiners get kicked automatically
• Auto deauth --- no manual targeting, runs fully unattended
• Aggressive mode --- scan and deauth threads run in parallel so there's no reconnect window between sweeps
• Whitelist --- spare specific devices via inline MACs or a file
• Mesh / multi-AP --- handles SSIDs that span multiple BSSIDs, auto-picks the strongest or lets you choose
• PMF detection --- warns you when 802.11w is active and unprotected frames will be dropped by patched clients
• ⚠️ Experimental PMF bypass (WPA2+PMF only) --- uses wrong‑password EAPOL extraction to disarm 802.11w without needing the real network password. Known limitation - does not work against Android 15 clients (see notes below)
• Dual deauth engine --- Scapy raw 802.11 frames (default) or aireplay-ng
• Live table --- --live-table shows a refreshing client table instead of scrolling log, good for demos
• Session log --- --log FILE saves every kick with a timestamp, appends across sessions
• Passive mode --- --scan-only discovers and logs clients without sending any frames
• Auto monitor mode --- enables and restores monitor mode automatically via airmon-ng
• OUI lookup --- shows Apple / Samsung / etc next to each MAC
• Self-updating --- checks for new releases on startup and notifies you if one is available

Requirements

# Python 3.10+
pip install scapy

# aircrack-ng suite
sudo apt install aircrack-ng

Must be run as root.

Installation

git clone https://github.com/Ymsniper/KTO.git
cd KTO
pip install scapy

No other setup required. Single script, no config files.

Usage

sudo python3 kto.py -i <interface> -t <SSID> [options]

The interface needs to be in monitor mode, or pass --auto-monitor to let KTO handle it.

Arguments

Arguments

Examples

# basic
sudo python3 kto.py -i wlan0mon -t "CorpNet"

# let KTO handle monitor mode
sudo python3 kto.py -i wlan0 -t "CorpNet" --auto-monitor

# aggressive mode — no reconnect window
sudo python3 kto.py -i wlan0mon -t "CorpNet" --aggressive

# spare your own device
sudo python3 kto.py -i wlan0mon -t "CorpNet" -w AA:BB:CC:DD:EE:FF

# passive discovery only, no deauth
sudo python3 kto.py -i wlan0mon -t "CorpNet" --scan-only

# mesh or multi-AP network
sudo python3 kto.py -i wlan0mon -t "CorpNet" --auto-bssid

# save a log and show live table
sudo python3 kto.py -i wlan0mon -t "CorpNet" --log session.txt --live-table

# heavier burst with aireplay-ng
sudo python3 kto.py -i wlan0mon -t "CorpNet" -n 10 --aireplay --broadcast

# disable PMF bypass (fall back to standard deauth on WPA2+PMF)
sudo python3 kto.py -i wlan0mon -t "CorpNet" --no-bypass

Whitelist file format

# my phone
AA:BB:CC:DD:EE:FF

# laptop
11:22:33:44:55:66

⚠️ Experimental PMF feature (WPA2+PMF only)

Starting with v2.1.6, KTO includes an experimental PMF feature for WPA2-PSK networks with Protected Management Frames (PMF) enabled. When PMF is detected on a WPA2 network, KTO automatically attempts a wrong‑password EAPOL extraction:

• It connects to the AP using a random PSK (no real password needed).
• The AP sends EAPOL Msg1 (plaintext, before the handshake fails), revealing Key Info and replay counter.
• Those parameters are used to craft fake EAPOL Msg1 frames that trigger a disconnect in many clients, bypassing PMF entirely.

This bypass does NOT require the actual network password --- it only needs the SSID.

Important limitations:

• Does not work on WPA3 (SAE) networks --- the bypass is strictly for WPA2‑PSK + PMF.
• Does not work against Android 15 clients --- Android 15 implements stricter PMF validation that defeats the fake EAPOL Msg1 attack. Other patched clients may also resist it.

If you want to skip the bypass entirely and just blast standard deauth frames (accepting that PMF‑capable clients will drop them), use the --no-bypass flag.

Notes on PMF / 802.11w

If the target AP has Protected Management Frames enabled KTO will warn you at startup. Clients with 802.11w support will silently drop unprotected deauth frames, so effectiveness depends on which devices are connected.

However, in aggressive mode with a high enough deauth burst, KTO has been observed to still disconnect PMF‑protected clients on some networks---even without a bypass. The sheer volume of frames appears to overwhelm certain implementations. So while PMF is a critical defense, it isn't bulletproof in every setup.

Stopping

Ctrl+C stops everything cleanly, restores the interface to managed mode if KTO created the monitor interface, and prints a session summary with burst counts per client.

License

MIT License --- see LICENSE