ymsniper/kto

KTO, short for Kick Them Out, is a Python tool for disconnecting devices from a Wi-Fi network. It works by sending deauthentication frames, which are a standard part of the Wi-Fi protocol that tell a device it has been disconnected from an access point. The tool is intended for authorized security testing on networks you own or have permission to test. The README prominently warns that using it on networks without explicit permission is illegal in most places. The tool automates what would otherwise be a manual process. Other tools that do this require you to already know the hardware addresses of specific devices, manually target each one, and run the command again if a device reconnects. KTO instead continuously scans the target network, builds a live list of connected devices, deauthenticates all of them except those you have placed on a whitelist, and repeats the cycle. Devices that reconnect get caught on the next sweep without any manual intervention. A whitelist lets you protect specific devices by their hardware address, either entered directly on the command line or read from a file. This is useful when testing your own network and you do not want your own phone or computer to be disconnected. An aggressive mode runs the scanning and disconnection steps in parallel to close the window during which a device could reconnect between sweeps. The tool can display a live table of connected devices in the terminal, log every disconnection event to a file with a timestamp, and optionally run in a passive mode that only discovers and records devices without sending any disconnection frames. It also detects whether the target access point has a security feature called Protected Management Frames enabled, which causes modern devices to ignore deauthentication frames, and warns you if that is the case. KTO requires Python 3.10 or newer, the Scapy networking library, and the aircrack-ng suite of wireless tools. It must be run as root.