Skip to content
HackIndex.io

WPS Interference and Beacon Flooding with mdk3

3 min read Created Mar 17, 2026 Last updated Mar 17, 2026

mdk3 is a wireless stress testing tool that generates 802.11 management frames at high volume. In the context of WPS attacks, it is used to flood the target AP with deauthentication frames to prevent clients from reconnecting to the legitimate AP, or to generate beacon floods that confuse wireless clients and management systems. It is also used to overcome WPS lockouts by keeping the AP busy with other traffic while the WPS attack continues from a second adapter.

Monitor mode must be active before using mdk3.

Notice

mdk3 is old and no longer actively maintained. Prefer mdk4, which has the same interface with additional attack modes and better compatibility with modern drivers.

Install mdk3

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y mdk3

mdk3 Wireless Interference via Deauthentication Flood

Send continuous deauthentication frames to all clients associated with a target BSSID. This is more aggressive than aireplay-ng's targeted deauth and is useful when multiple clients need to be simultaneously disconnected:

┌──(kali㉿kali)-[~]
└─$ echo 'AA:BB:CC:DD:EE:FF' > /tmp/target_bssid.txt
┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon d -b /tmp/target_bssid.txt

The d mode sends deauthentication and disassociation frames. -b takes a file of BSSIDs to target. Without -b mdk3 deauthenticates from all visible APs: avoid this on assessments where scope is limited.

Key differences between mdk3 deauth modes and aireplay-ng:

  • mdk3 sends both deauthentication and disassociation frames simultaneously, while aireplay-ng sends only deauthentication frames.
  • mdk3 floods at maximum rate by default, which is noisier but more effective at keeping clients off the AP.
  • aireplay-ng gives finer control over frame count and target client MAC, making it better for surgical deauths against a single client.

Deauthenticate Using a Blacklist File

To target a list of specific BSSIDs from a file while leaving all others alone:

┌──(kali㉿kali)-[~]
└─$ echo "AA:BB:CC:DD:EE:FF" > /tmp/targets.txt
┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon d -b /tmp/targets.txt

Beacon Flood to Confuse Clients

Beacon flood mode generates large numbers of fake AP beacons with random or specified SSIDs. This fills client scan lists and can prevent clients from finding and reconnecting to the legitimate AP during an evil twin attack:

┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon b

To flood with SSIDs read from a file: useful for making your evil twin harder to identify among noise:

┌──(kali㉿kali)-[~]
└─$ echo -e "FreeWifi\nAirport_Guest\nHotel_Lobby" > /tmp/ssids.txt
┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon b -f /tmp/ssids.txt

Overcome WPS Lockouts

Some APs lock WPS after a number of failed PIN attempts. Running a deauth flood on a second adapter while reaver runs on the first can reset the WPS state machine on certain AP firmware by forcing the AP to handle client reconnection traffic instead of tracking failed WPS attempts. This does not work on all implementations but is worth trying when reaver reports a WPS lockout:

┌──(kali㉿kali)-[~]
└─$ echo 'AA:BB:CC:DD:EE:FF' > /tmp/target_bssid.txt
┌──(kali㉿kali)-[~]
└─$ mdk3 wlan1mon d -b /tmp/target_bssid.txt

Run this on a second interface (wlan1mon) while reaver continues on the first (wlan0mon). Stop the deauth flood once reaver resumes making PIN attempts successfully.

Authentication Denial Against a Specific AP

Authentication denial mode sends malformed authentication frames to prevent new clients from associating with a target AP. Useful for pushing clients toward an evil twin by making the legitimate AP appear unavailable:

┌──(kali㉿kali)-[~]
└─$ mdk3 wlan0mon a -a AA:BB:CC:DD:EE:FF

References