Esp8266_deauther: scanning networks - 802.11w

[itsik-b]

When scanning SSID or Clients how do we know if it supports 802.11w ?

[spacehuhn]

You attack it and see what happens 😉

[itsik-b]

I guess what I really wanted to ask is if the MAC address is reachable/known when you scan for SSIDs ? I didn't find any info about it on 802.11w-2009 and I'm not sure if the MAC address is part of the protected frames.
Does the IEEE 802.11ac (5Ghz) has the same vulnerability ?

[spacehuhn]

There's no difference to the 5GHz frequency no, it's the same standard (other than the data-rates and frequency of course).
The MAC address header will always be there unencrypted, otherwise no device would know where to send anything.

[itsik-b]

This is crazy !!! I can't see any company getting into this mess and start making the changes for this thing.
I need to find 5ghz device like the ESP8266 to do the same attack :) .
Did you get to check the ESP32 ? I've managed to do beacon but not deauth...

[spacehuhn]

ESP32 doesn't allow sending your own deauth packets.
Closing this now because the original question is answered :)