sudoAPWH / KickThemOut-v3

View on GitHub
Rust networking arp-spoofing security educational
About this project

What is KickThemOut?

KickThemOut v3 is a complete ground-up rewrite in Rust of a classic network administration tool. It lets you selectively disconnect devices from your local network using ARP spoofing — a technique that manipulates the Address Resolution Protocol to intercept or disrupt traffic between devices and the gateway.

The "v3" represents a full standalone rebuild, not an incremental update. The goal was to take the core concept of network device management and deliver it with modern tooling: Rust's memory safety, an interactive terminal interface, and automatic cleanup when you're done.

⚠️ This tool is intended for educational use and authorized network administration only. Always obtain proper authorization before testing on any network.

How It Works

🔍 Network Discovery

Scans your /24 subnet using ARP requests, identifying every connected device with its IP, MAC address, and hardware vendor.

🎯 Interactive Selection

Navigate discovered devices with arrow keys and spacebar. Pick individual targets, select multiple devices, or choose the entire network.

🚫 ARP Spoofing

Sends crafted ARP packets that poison the target's ARP cache, redirecting traffic away from the real gateway and effectively disconnecting the device.

🔄 Automatic Restoration

When you stop the tool, ARP tables are automatically restored to their correct state. No permanent damage to the network.

The ARP Spoofing Concept

Normal Network Flow: Device ──ARP: who has gateway?──> Gateway Device <──gateway is AA:BB:CC── Gateway Device ─────traffic─────────────> Gateway ──> Internet With KickThemOut Active: Device ──ARP: who has gateway?──> KickThemOut Device <──gateway is XX:YY:ZZ── KickThemOut (spoofed!) Device ─────traffic─────────────> nowhere (disconnected)

ARP operates on trust — devices accept ARP replies without verification. KickThemOut exploits this by sending false ARP replies that associate the gateway's IP with an invalid MAC address, causing the target device to send traffic to a non-existent destination.

Three Operating Modes

  1. Single target — Disconnect one specific device. Useful for troubleshooting or isolating a particular client.
  2. Multi-select — Choose several devices to disconnect simultaneously. The interactive UI lets you toggle selections before executing.
  3. Network-wide — Disconnect all discovered devices except the gateway. The nuclear option for network administration scenarios.

Why Rust?

Network tools that craft raw packets need to be reliable and precise. Rust's ownership model prevents the memory bugs that commonly plague low-level networking code in C. The tool requires root/sudo access for raw packet manipulation, so safety guarantees at the language level are especially valuable here.

Back to all repositories