Skip to content
HackIndex logo

HackIndex

WPS Interference and Beacon Flooding with mdk3

3 min read Mar 17, 2026

mdk3 is a wireless stress testing tool that generates 802.11 management frames at high volume. In the context of WPS attacks, it is used to flood the target AP with deauthentication frames to prevent clients from reconnecting to the legitimate AP, or to generate beacon floods that confuse wireless clients and management systems. It is also used to overcome WPS lockouts by keeping the AP busy with other traffic while the WPS attack continues from a second adapter.

Monitor mode must be active before using mdk3.

Install mdk3

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y mdk3

Deauthentication Flood Against a Specific AP

Send continuous deauthentication frames to all clients associated with a target BSSID. This is more aggressive than aireplay-ng's targeted deauth and is useful when multiple clients need to be simultaneously disconnected:

┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon d -b AA:BB:CC:DD:EE:FF

The d mode sends deauthentication and disassociation frames. -b targets a specific BSSID. Without -b mdk3 deauthenticates from all visible APs — avoid this on assessments where scope is limited.

Deauthenticate Using a Blacklist File

To target a list of specific BSSIDs from a file while leaving all others alone:

┌──(kali㉿kali)-[~]
└─$ echo "AA:BB:CC:DD:EE:FF" > /tmp/targets.txt
┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon d -b /tmp/targets.txt

Beacon Flood to Confuse Clients

Beacon flood mode generates large numbers of fake AP beacons with random or specified SSIDs. This fills client scan lists and can prevent clients from finding and reconnecting to the legitimate AP during an evil twin attack:

┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon b

To flood with SSIDs read from a file — useful for making your evil twin harder to identify among noise:

┌──(kali㉿kali)-[~]
└─$ echo -e "FreeWifi\nAirport_Guest\nHotel_Lobby" > /tmp/ssids.txt
┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon b -f /tmp/ssids.txt

Overcome WPS Lockouts

Some APs lock WPS after a number of failed PIN attempts. Running a deauth flood on a second adapter while reaver runs on the first can reset the WPS state machine on certain AP firmware by forcing the AP to handle client reconnection traffic instead of tracking failed WPS attempts. This does not work on all implementations but is worth trying when reaver reports a WPS lockout:

┌──(kali㉿kali)-[~]
└─$ mdk3 wlan1mon d -b AA:BB:CC:DD:EE:FF

Run this on a second interface (wlan1mon) while reaver continues on the first (wlan0mon). Stop the deauth flood once reaver resumes making PIN attempts successfully.

Authentication Denial Against a Specific AP

Authentication denial mode sends malformed authentication frames to prevent new clients from associating with a target AP. Useful for pushing clients toward an evil twin by making the legitimate AP appear unavailable:

┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon a -a AA:BB:CC:DD:EE:FF

References