MAC Ghost

Network Scanning | MAC Address Spoofing | Session Data Extraction

MAC Ghost is a terminal CLI tool that bundles network scanning, MAC spoofing, and session extraction into one menu. It is intended for authorized testing on MikroTik-based networks that use a web sign-in page (hotspot/captive portal).

Warning

Only use this tool on networks you own or have written permission to test. MAC spoofing and unauthorized session extraction can be illegal. The author is not responsible for misuse.

Features

• Scan the local network with ARP and list live devices.
• Spoof MAC addresses from a CSV file and try to authenticate through the gateway.
• Extract and save user session info (username, remaining bytes, IP, MAC) to data/output.jsonl.
• Show scan results and saved user info in formatted tables.

Supported Platforms

Platform	Support	Notes
Linux	Main	Tested on Debian/Ubuntu/Arch. Needs root and a wireless interface.
Windows	No	--------

Requirements

• Python 3.7+
• Root privileges (sudo)
• A wireless interface (default is wlan0)
• Python packages:
  • rich==13.7.1
  • scapy==2.5.0
  • netifaces==0.11.0

Install dependencies with:

pip install -r requirements.txt

Installation

git clone https://github.com/Abdulrhman-Adnan/Mac_Ghost.git
cd Mac_Ghost
pip install -r requirements.txt

Files

Mac_Ghost/
├── run.py                  # Entry point
├── requirements.txt        # Python dependencies
├── README.md
├── docs/
│   └── Cover.png           # Project cover image
├── data/
│   ├── scan_results.csv    # Input for spoofing (IP, MAC pairs)
│   ├── scan_results.txt    # Scan output
│   └── output.jsonl        # Extracted session info
└── src/
    ├── mac_clone_tool.py   # Main menu / CLI
    ├── clone_mac.py        # MAC spoofing logic
    └── net_discovery.py    # ARP scanner

Usage

Run with root:

sudo python3 run.py

Main menu:

1) Scan Network (ARP discover devices)
2) Spoof MAC Address (clone Mac address & Extract Users login info)
3) View Results (scan output & Saved Users Login info)
4) Exit Application

1. Scan Network

Scans the local subnet and saves results to data/scan_results.txt.

2. Spoof MAC Address

Reads data/scan_results.csv, clones each MAC address, tries to authenticate through the gateway, and saves valid sessions to data/output.jsonl. It targets MikroTik hotspot sign-in pages where user session data is exposed after authentication.

3. View Results

Open a sub-menu to view scan results or saved user info.

4. Exit

Close the tool.

CSV Format

scan_results.csv should contain IP and MAC pairs:

192.168.1.10,aa:bb:cc:dd:ee:ff
192.168.1.11,11:22:33:44:55:66

Configuration

If your interface is not wlan0, change it in src/clone_mac.py:

INTERFACE = "wlan0"

License

This project is for educational and authorized use only. Make sure you have permission before scanning or spoofing any network.