yslxotwod/wifistingGTK4 wireless security toolkit with 57 standalone shell modules for Wi-Fi, Bluetooth, RF, Zigbee, NFC and router-side attacks, plus MITM, recon, capture analysis and killchain automation.
A GTK4 wireless security toolkit for Linux. 57 modules covering Wi-Fi, Bluetooth, RF, router-side and network MITM work behind one interface.
Every module is a standalone shell script. The GUI is a view over them, not a container — nothing is locked behind the interface.
Early development. Tested thoroughly on one machine with one adapter. The section What actually works is honest about what that means, and it is worth reading before you file a bug.
Most wireless tooling is deep in one lane. aircrack-ng is Wi-Fi. bettercap
is network MITM. BlueZ tooling is Bluetooth. An assessment means five tools,
five config formats, and no shared view of the target.
wifisting is wide on purpose — across layers and protocols, in one place. It also wraps Responder, mitm6, ntlmrelayx, mdk4 and hcxdumptool rather than reimplementing them, so the specialist tools stay underneath where they belong.
The other thing it does differently: most tools tell you they worked. This
one is built to tell you when they didn't. A module that reports OK while the
target is untouched is worse than one that fails loudly, so there is a
--selftest per module and the hardware-gated ones say what's missing instead
of returning an empty result.
| Module | Description |
|---|---|
00_deps | Inspect installed tools and install missing packages |
01_iface | Discover wireless interfaces and control monitor mode |
| Module | Description |
|---|---|
02_recon | Live scan, target selection, CSV parsing |
03_attack | Deauth, WPA/WPA2 handshake capture and PMKID |
04_eviltwin | Rogue AP with captive portal and credential capture |
08_pmkid_offline | Offline PMKID extraction and hashcat conversion |
09_wardrive | GPS-tagged scanning for coverage mapping |
10_rogue_dhcp | Malicious DHCP server for interception |
11_krack_kr00k | KRACK and Kr00k key reinstallation |
17_wps_attack | Pixie Dust and WPS PIN |
20_karma | Answer every probe request to ensnare clients |
21_beacon_flood | Beacon and auth floods, WIDS confusion, Michael countermeasures |
22_wifi_direct | P2P devices, services and group owner negotiation |
23_captive_portal_builder | Render captive portal HTML from templates |
34_pmf_bypass | 802.11w management frame protection posture per AP |
35_wifi6_attacks | HE elements, BSS colour collisions, TWT, spatial reuse |
47_wpa3_attack | Transition downgrade, Dragonblood, SAE capture and dictionary |
48_wep_attack | Fake auth, ARP replay, ChopChop, fragmentation, key recovery |
53_jamming | Frame-level jamming via the modwifi driver |
54_client_isolation | Gateway bounce, port stealing, broadcast reflection, inter-NIC relay |
55_ssid_overflow | Oversized SSID past the 32-byte limit, with injection in the same bytes |
| Module | Description |
|---|---|
07_arp | ARP spoofing and MITM capture |
13_802.1x_relay | RADIUS relay for 802.1X |
32_resolver_poison | LLMNR/NBT-NS/mDNS poisoning, NTLM relay, mitm6, Router Advertisement |
49_usb_mitm | USB Ethernet MITM over RNDIS |
50_router_lan | TR-064, HNAP, UPnP/SSDP, SNMP, DNS rebinding, CSRF |
51_router_web | Diagnostic-page injection, rom-0 disclosure, default credentials |
52_router_console | Recovery-mode TFTP, UART/U-Boot guidance, offline flash parsing |
| Module | Description |
|---|---|
05_bt_recon | Device enumeration and fingerprinting |
06_bt_attack | BLE spoofing and Bluetooth attack primitives |
12_hid_injection | Bluetooth HID keystroke injection |
24_bt_mesh | BLE Mesh sniffing and attacks |
36_ble_tracker_hunt | AirTag/SmartTag/Tile detection and following detection |
37_bt_classic_ssp | Secure Simple Pairing models and HCI log reconstruction |
38_ble_adv_forge | iBeacon, Eddystone and Fast Pair payload building |
39_ble_fuzz | Malformed BLE payload corpus generation |
| Module | Description |
|---|---|
26_zigbee | Zigbee sniffing and attacks (CC2531 / nRF52840) |
57_thread | Thread mesh analysis and border router discovery |
| Module | Description |
|---|---|
25_rf_spectrum | SDR spectrum sweeps, IQ capture, channel occupancy |
40_wifi_csi | Channel state information parsing and motion analysis |
42_subghz | Sub-GHz OOK pulse train decoding and band reference |
43_nfc_rfid | NDEF codec and MIFARE tag structure analysis |
44_lora_loraWAN | LoRa and LoRaWAN |
45_drone_remote_id | ASTM F3411 Remote ID decode and build |
| Module | Description |
|---|---|
14_wifi_ids | Passive monitoring and wireless intrusion detection |
15_wifi_cve_scan | Probe networks for known Wi-Fi CVE exposure |
16_bt_cve_scan | Probe Bluetooth devices for known CVE exposure |
18_capture_analysis | pcap browsing, hash extraction, hashcat driving |
19_wordlist_manager | Download, compose and manage wordlists and rules |
27_firmware_iot | Firmware extraction, credential harvesting, CVE scan |
27b_fw_update_audit | Firmware update audit |
28_live_traffic | Live traffic view |
30_fingerprint | Client identification, random MAC detection, correlation |
41_wifi_geolocate | Position estimate from BSSID and RSSI |
46_public_wifi_audit | Grade APs for open, WEP, downgrade and evil-twin risk |
| Module | Description |
|---|---|
29_killchain | Chain multi-step attacks into reusable runs |
31_remote_node | Manage a fleet of remote nodes (Pi / VM / PC) |
You need an adapter that can inject.
iwlwifi driver accepts every command
and transmits nothing. The app detects it and refuses with an explanation.Monitor mode alone is not enough. With an Intel card you can browse the interface and read captures, but most modules will refuse to run.
Some modules need more: an SDR for RF work, a Bluetooth adapter, NFC hardware, a CC2531 or nRF52840 for Zigbee and Thread. The GUI marks which ones.
After extracting the archive, in your terminal:
cd native
meson setup builddir && meson compile -C builddir
That builds the GUI. Then, from the project root:
./wifisting.sh
The app asks for your password when a module needs root — that is pkexec,
and it prompts per action rather than once at startup.
Or launch the built binary directly:
./native/builddir/wifisting-gui
Operating system: Linux. Developed on Arch-family and Ubuntu derivatives. It will not run natively on Windows — see Windows below.
Required: GTK4 (4.14+), meson, ninja, a C compiler, python3 with scapy.
# Debian / Ubuntu
sudo apt install build-essential meson ninja-build libgtk-4-dev python3-scapy
# Arch
sudo pacman -S base-devel meson ninja gtk4 python-scapy
If the build fails, the error names the missing dependency. Install it and
re-run meson compile -C builddir.