FLUXION(1)                        User Manuals                       FLUXION(1)

NAME
       fluxion - Fluxion is a security auditing and social-engineering research
       tool

SYNOPSIS
       fluxion  [-m]  [--auto]  [--scan-time N ] [-l language ] [-b bssid ] [-c
       channel ] [--band bg|a|abg ] [--timeout minutes ] ...

DESCRIPTION
       fluxion is a security auditing and social-engineering research tool.  It
       is a remake of linset by vk496 with less bugs  and  more  functionality.
       The  script  attempts  to retrieve the WPA/WPA2 key from a target access
       point by means of a social engineering (phishing) attack. It's  compati‐
       ble  with the latest release of Kali (rolling). Fluxion's attacks' setup
       is mostly manual, but auto-mode handles some of the attacks' setup para‐
       meters.

OPTIONS
       -v     Print version number.

       --help Print help page and exit with 0.

       -m     Use tmux multiplexer instead of xterm. Enables headless operation
              without an X11/graphical session. If not already  inside  a  tmux
              session,  fluxion will re-exec itself inside one. All sub-windows
              are opened as tmux windows instead of xterm terminals.

       --auto Run fluxion in fully non-interactive auto mode. Every interactive
              prompt auto-selects a sensible default. Implies --killer (-k). In
              auto mode, fluxion runs one attack cycle and exits (no  looping).
              Best combined with -m for headless operation.

       --scan-time <seconds>
              Duration  in  seconds for the wireless scanner in auto mode.  De‐
              fault is 30. After this time, the scanner is killed  and  results
              are processed. Only meaningful with --auto or --scan-only.

       --scan-only
              Scan  for nearby WPA networks, print results to stdout, and exit.
              Does not launch any attack. Implies  --auto  and  -k.   Use  with
              --scan-time to control scan duration and -c to restrict channels.
              Output is a machine-friendly table.

       --list-interfaces
              List  all  detected  wireless  network interfaces with their sup‐
              ported bands, driver, chipset, bus type, and state, then exit.

       --interface <iface>
              Use the specified wireless interface for scanning and operations.
              If not given, the first available wireless interface is used.

       --jammer-interface <iface>
              Use the specified wireless interface for the deauth jammer  (Cap‐
              tive Portal attack). Overrides auto-selection for this role only.

       --ap-interface <iface>
              Use  the  specified wireless interface for the rogue access point
              (Captive Portal attack). Overrides auto-selection for  this  role
              only.

       --tracker-interface <iface>
              Use  the  specified  wireless  interface  for  the target tracker
              (channel-change detection). In auto mode the tracker is  disabled
              unless this option is given.

       --ap-service <hostapd|airbase-ng>
              Override  the rogue AP service. Default is hostapd.  On DFS chan‐
              nels (52-64, 100-144) auto mode selects airbase-ng  automatically
              since hostapd requires driver radar/CAC support that USB adapters
              lack.

       --reg-domain <CC>
              Override the wireless regulatory domain used when bringing up the
              rogue AP on 5 GHz channels (e.g. US, DE, JP).  Default is US. The
              original domain is restored on exit.

       --timeout <minutes>
              Maximum  duration  in minutes for the attack in auto mode.  After
              this time the attack is stopped and fluxion exits.  Default is no
              timeout (runs indefinitely until the attack succeeds or is inter‐
              rupted).

       -k     Kill interfering wireless processes (NetworkManager,  etc.)   be‐
              fore allocating interfaces. Implied by --auto.

       -d     Run fluxion in debug mode.

       -r     Reload driver.

       -l <language>
              Define a certain language. In auto mode, defaults to "en".

       -e <essid>
              Select  the target network based on the ESSID. In auto mode, used
              to filter scan results to the matching network.

       --band <bg|a|abg>
              Wireless band to scan. bg = 2.4 GHz, a = 5 GHz, abg =  both.  De‐
              fault is bg. Overrides auto-detection from -c. Passed directly to
              airodump-ng --band.

       -c <channel>
              Indicate  the  channel(s) to listen to. In auto mode, the scanner
              is restricted to these channels.

       -a <attack>
              Define a certain attack. In auto mode, this  selects  the  attack
              type without prompting.

       --ratio <ratio>
              Define the window size. Bigger ratio -> smaller window size.  De‐
              fault is 4. Only applies in xterm mode.

       -b <bssid>
              Select  the target network based on the access point MAC address.
              In auto mode, used to filter scan results.

       -j <jamming interface>
              Define a certain jamming interface.

EXAMPLES
       List all nearby WPA networks (60-second scan):
              sudo ./fluxion.sh -m --scan-only --scan-time 60

       List networks on channel 6 only:
              sudo ./fluxion.sh -m --scan-only --scan-time 30 -c 6

       Scan both 2.4 GHz and 5 GHz bands:
              sudo ./fluxion.sh --scan-only --scan-time 30 --band abg

       Headless, non-interactive, 15-second scan:
              sudo ./fluxion.sh -m --auto -l en --scan-time 15

       Headless with specific target:
              sudo ./fluxion.sh -m --auto -b AA:BB:CC:DD:EE:FF -c 6

FILES
       /tmp/fluxspace/
              The system wide tmp directory.
       $FLUXION/attacks/
              Folder where handshakes and passwords are stored in.

ENVIRONMENT
       FLUXIONAuto
              Automatically run fluxion in auto mode if exported.

       FLUXIONDebug
              Automatically run fluxion in debug mode if exported.

       FLUXIONWIKillProcesses
              Automatically kill any interfering process(es).

DIAGNOSTICS
       Please checkout the other log files or use the debug mode.

BUGS
       Please report any bugs at: https://github.com/FluxionNetwork/fluxion/is‐
       sues

AUTHOR
       Cyberfee, l3op, dlinkproto, vk496, MPX4132

SEE ALSO
       aircrack-ng(8),

Linux                              MARCH 2026                        FLUXION(1)
