Wi-Fi (phy80211)

The Kismet phy80211 layer processes Wi-Fi packets and devices.

It provides additional APIs for Wi-Fi related data.

WPA handshake

DESC

A WPA handshake is required to attack the WPA and WPA2 key exchanges.

Unless configured not to, Kismet will retain EAPOL handshake packets and the first beacon from an access point, and can provide them as a PCAP file.

Kismet retains a handshake set per client session, indexed by the MAC address of the client.

ROLES
readonly
MODIFIED
API modified 2022-11 for per-client MAC keying
URI
/phy/phy80211/by-key/{DEVICEKEY}/device/{MAC}/pcap/handshake.pcap
METHODS
GET
URI
PARAMETERS
DEVICEKEY string REQUIRED

Kismet device key of AP

MAC string REQUIRED

MAC address of client

RETURN
Basic PCAP format packet capture file.
RESPONSES
200
Success
404
No such device key
ERROR
Request error, such as malformed device key or missing client MAC

WPA PMKID exchange

DESC
The WPA PMKID can be used to perform offline attacks against the WPA key.
ROLES
readonly
ADDED
API added 2019-05
MODIFIED
API modified 2020-10
URI
/phy/phy80211/by-key/{DEVICEKEY}/pcap/handshake-pmkid.pcap
METHODS
GET
URI
PARAMETERS
DEVICEKEY string REQUIRED

Kismet device key

RETURN
Basic PCAP format packet capture file with a beacon and RSN PMKID packet.

Per-device packet stream

DESC

Fetch a streaming PCAP-NG capture of all packets to or from a specific BSSID.

This endpoint will stream packets until closed or cancelled.

ROLES
readonly
URI
/phy/phy80211/pcap/by-bssid/{BSSID}/packets.pcapng
METHODS
GET
URI
PARAMETERS
BSSID string REQUIRED

BSSID of AP

Wi-Fi clients

DESC
Fetch a list of devices associated with an access point. This is also available in the full device record.
ROLES
readonly
URI
/phy/phy80211/clients-of/{DEVICEKEY}/clients.json
/phy/phy80211/clients-of/{DEVICEKEY}/clients.ekjson
/phy/phy80211/clients-of/{DEVICEKEY}/clients.prettyjson
METHODS
GET POST
URI
PARAMETERS
DEVICEKEY string REQUIRED

Kismet device key

JSON
PARAMETERS

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

fields field simplification OPTIONAL

Kismet can reduce the amount of information being processed and returned by an API by simplifying the fields to only return the data needed by the caller.

You can read more about the field simplification API and how to use it here.

Access points device view

DESC

A device view endpoint which returns Wi-Fi access point devices only.

An access point is a Wi-Fi device which has been seen to transmit management frames or packets with from-ds set.

For complete documentation, check the device view api

ROLES
readonly
URI
/devices/views/phydot11_accesspoints/devices.json
/devices/views/phydot11_accesspoints/devices.ekjson
/devices/views/phydot11_accesspoints/devices.prettyjson
METHODS
GET POST
NOTES
This endpoint uses the device view API.

Access point view by timestamp

DESC

A device view endpoint which returns Wi-Fi access point devices only.

An access point is a Wi-Fi device which has been seen to transmit management frames or packets with from-ds set.

Devices which have been active since the specified time will be returned.

For complete documentation, check the device view api

ROLES
readonly
URI
/devices/views/phy80211_accesspoints/last-time/{TIMESTAMP}/devices.json
/devices/views/phy80211_accesspoints/last-time/{TIMESTAMP}/devices.ekjson
/devices/views/phy80211_accesspoints/last-time/{TIMESTAMP}/devices.prettyjson
METHODS
GET POST
URI
PARAMETERS
TIMESTAMP number REQUIRED

Timestamps can be absolute (UNIX epochal) timestamps, or they can be relative negativ numbers, indiciating "number of seconds before now".

You can read more about timestamp handling and how to use it here.

NOTES
This endpoint uses the device view API.
DESC

Kismet can track relate devices. On a Wi-Fi network, a related device occurs when traffic shows they are on the same physical network, make up multiple BSSIDs of the same physical AP, or make up multiple BSSIDs in a roaming SSID.

This endpoint will return an array of complete device records of the associated devices, making it a single query to fetch the nested information.

ROLES
readonly
ADDED
API added 2019-03
URI
/phy/phy80211/related-to/{DEVICEKEY}/devices.json
/phy/phy80211/related-to/{DEVICEKEY}/devices.ekjson
/phy/phy80211/related-to/{DEVICEKEY}/devices.prettyjson
METHODS
GET POST
URI
PARAMETERS
DEVICEKEY string REQUIRED

Access point device key

JSON
PARAMETERS

This endpoint takes additional parameters by using a `POST` request and supplying a JSON document or json form variable.

You can find more information about API parameters here.

fields field simplification OPTIONAL

Kismet can reduce the amount of information being processed and returned by an API by simplifying the fields to only return the data needed by the caller.

You can read more about the field simplification API and how to use it here.