airgeddon

airgeddon is a menu-driven bash script that wraps a whole set of wireless attacks behind one interactive interface, so you pick an interface and a technique from numbered menus instead of chaining aircrack-ng/mdk4/hashcat commands by hand. It covers a wider spread than most single-purpose Wi-Fi tools:

• DoS attacks — deauth-style floods via mdk3/mdk4/aireplay-ng, with a pursuit mode that follows a channel-hopping AP.
• Handshake/PMKID capture — assisted WPA/WPA2 personal handshake and PMKID capture, with automatic cleaning of the resulting file.
• Offline password cracking — dictionary, brute-force, and rule-based attacks against a captured handshake via aircrack, crunch, or hashcat (GPU-accelerated where available).
• Hidden ESSID decloaking — deauth-based and dictionary-based methods to reveal a concealed network name.
• WPA3 attacks — downgrade attacks on mixed-mode networks, MFP analysis, and online dictionary attacks.
• Evil Twin / rogue AP — a fake access point with optional traffic sniffing, sslstrip2, BeEF hooking, a captive portal, and MAC spoofing.
• WPS attacks — PIN brute-force, Pixie Dust, known-PIN databases, and custom PIN association.
• Enterprise attacks — fake-AP modes that capture hashes and plaintext credentials from 802.1X/Enterprise networks.
• WEP attacks — chop-chop, Caffe-Latte, ARP-replay, and besside-ng, offered as one guided flow.

Security → Wireless Attacks → airgeddon. It’s menu- driven — running it is the action — so Oniomarchy launches you straight into its console.

Using it

Navigation is entirely by number, starting from interface selection and working down through the attack category you want:

airgeddon
 Select interface for the attack: wlan0
 Select an option from menu:
   6. Handshake/PMKID tools menu
   7. Offline WPA/WPA2 decrypt menu
   8. Evil Twin attacks menu
   9. WPS attacks menu
  10. WEP attacks menu
  11. Enterprise attacks menu
  ...

The script checks for its own dependencies on startup and tells you what’s missing rather than failing partway through an attack. Handshake captures and Evil Twin credential dumps land in files under airgeddon’s own working directory, ready to hand to hashcat or read directly.

For a lighter, single-purpose flow use wifite; for a graphical version of the same underlying attacks, see fern-wifi-cracker.