GTK4 and CLI wireless security toolkit with 57 standalone modules for Wi-Fi, Bluetooth, 802.15.4, SDR/RF, NFC and router-side or network MITM testing on Linux.
A GTK4 wireless security toolkit for Linux. 57 modules covering Wi-Fi, Bluetooth, RF, router-side and network MITM work behind one interface.
Every module is a standalone shell script. The GUI is a view over them, not a container — nothing is locked behind the interface.
Early development. Tested thoroughly on one machine with one adapter. The section What actually works is honest about what that means, and it is worth reading before you file a bug.
sudo bash wifisting.sh gives you a numbered menu grouped by
category. bash wifisting.sh --list prints module availability without
needing root.
A native GUI. wifisting-gui builds on GTK4 + VTE and drives the
same shell modules through a strict TSV protocol. Roughly 15,000 lines
of C, no runtime dependency heavier than GTK and VTE.
A module collection. More than 50 shell scripts, each one self-contained,
each one self-locating its project root (works under pkexec, where
HOME is /root), each one with a --selftest verb that runs offline
and touches no hardware.
The GUI and the CLI are not alternatives — they share the state under
/tmp/wifisting/. Select a target in the GUI's Recon tab and the CLI sees
it. Kick off a scan from the CLI and the GUI's status pills update.
Most wireless tooling is deep in one lane. aircrack-ng is Wi-Fi. bettercap
is network MITM. BlueZ tooling is Bluetooth. An assessment means five tools,
five config formats, and no shared view of the target.
wifisting is wide on purpose — across layers and protocols, in one place. It also wraps Responder, mitm6, ntlmrelayx, mdk4 and hcxdumptool rather than reimplementing them, so the specialist tools stay underneath where they belong.
The other thing it does differently: most tools tell you they worked. This
one is built to tell you when they didn't. A module that reports OK while the
target is untouched is worse than one that fails loudly, so there is a
--selftest per module and the hardware-gated ones say what's missing instead
of returning an empty result.
Frame-level jamming. Not a deauth flood — actual reactive jamming, carrier-sense manipulation and FCS corruption, driven through a modified Atheros driver. This needed porting modwifi to kernel 7.0, which is why almost nobody ships it. You can jam one access point's beacons while leaving the rest of the channel alone.
SSID overflow with real IE-length control. Beacons whose SSID exceeds the 32-byte limit, carrying injection payloads in the same bytes. The published ESP32 tools can't do this — WiFi.softAP() truncates at 32, so they all list it as future work. Building the frame by hand means the length byte is independent of the content, which is the case that actually matters.
Router Advertisement poisoning. mitm6 does DHCPv6 and deliberately skips Router Advertisements, so a network with no DHCPv6 in play is untouched by it. This does RA/SLAAC: one forged packet reconfigures every host's default route and resolver.
Client isolation bypass. Gateway bouncing, port stealing, broadcast reflection, plus an inter-NIC relay to hold the bypass open. From the AirSnitch work (NDSS'26).
USB Ethernet MITM. RNDIS-based, PoisonTap-style, over a USB port.
Router recovery and console. Recovery-mode TFTP, UART/U-Boot guidance, offline flash image parsing. Unusual to find in a wireless tool.
Multi-node capture. Drive a fleet of remote nodes — Pi, VM, laptop — and correlate what they see.
The one I'd argue matters most: it's built to tell you when it failed. Every module has a --selftest. Hardware-gated modules name the hardware they're missing instead of returning an empty result. A module that reports OK while the target is untouched is worse than one that fails loudly, and that's the bug class I'm hunting.
| Module | Description |
|---|---|
00_deps | Inspect installed tools and install missing packages |
01_iface | Discover wireless interfaces and control monitor mode |
| Module | Description |
|---|---|
02_recon | Live scan, target selection, CSV parsing |
03_attack | Deauth, WPA/WPA2 handshake capture and PMKID |
04_eviltwin | Rogue AP with captive portal and credential capture |
08_pmkid_offline | Offline PMKID extraction and hashcat conversion |
09_wardrive | GPS-tagged scanning for coverage mapping |
10_rogue_dhcp | Malicious DHCP server for interception |
11_krack_kr00k | KRACK and Kr00k key reinstallation |
17_wps_attack | Pixie Dust and WPS PIN |
20_karma | Answer every probe request to ensnare clients |
21_beacon_flood | Beacon and auth floods, WIDS confusion, Michael countermeasures |
22_wifi_direct | P2P devices, services and group owner negotiation |
23_captive_portal_builder | Render captive portal HTML from templates |
34_pmf_bypass | 802.11w management frame protection posture per AP |
35_wifi6_attacks | HE elements, BSS colour collisions, TWT, spatial reuse |
47_wpa3_attack | Transition downgrade, Dragonblood, SAE capture and dictionary |
48_wep_attack | Fake auth, ARP replay, ChopChop, fragmentation, key recovery |
53_jamming | Frame-level jamming via the modwifi driver |
54_client_isolation | Gateway bounce, port stealing, broadcast reflection, inter-NIC relay |
55_ssid_overflow | Oversized SSID past the 32-byte limit, with injection in the same bytes |
| Module | Description |
|---|---|
07_arp | ARP spoofing and MITM capture |
13_802.1x_relay | RADIUS relay for 802.1X |
32_resolver_poison | LLMNR/NBT-NS/mDNS poisoning, NTLM relay, mitm6, Router Advertisement |
49_usb_mitm | USB Ethernet MITM over RNDIS |
50_router_lan | TR-064, HNAP, UPnP/SSDP, SNMP, DNS rebinding, CSRF |
51_router_web | Diagnostic-page injection, rom-0 disclosure, default credentials |
52_router_console | Recovery-mode TFTP, UART/U-Boot guidance, offline flash parsing |