Skip to content

Latest commit

 

History

History
31 lines (18 loc) · 2.27 KB

Evil-Twin.md

File metadata and controls

31 lines (18 loc) · 2.27 KB
Raw

Evil Twin

Evil Twin is a way of using a phishing-fake AP to wait for clients to log in, enter their passwords, and catch those packets.

Pros:

Quick and easy, no need to spend a long time cracking passwords.

Cons:

According to the tools I have used (such as Fluxion, Wifiphisher, and Airgeddon), I do not think they are as effective as I once thought. Specifically, everything is fine from creating a fake AP with the same SSID as the original one, to capturing the handshake packets and faking it to a fake WiFi. Then, I tested it by connecting to the fake WiFi with my phone, and I was able to enter my password without any issues. However, I waited for a long time, but I did not see any clients log in. Although these tools open a terminal and send deauth packets through MDK3 or Aireplay-ng to clients who are already connected to the original WiFi to force them to reconnect to the fake WiFi, I am still concluding that this method is not very efficient.

Weakness

After tools such as Fluxion, Wifiphishing, and Airgeddon send deauth packets to the original AP, clients who are in that original AP are kicked out, but they automatically reconnect to the original AP. The reason is that the signal generated by your fake network card is not strong enough to overpower the original AP, so the client's device automatically reconnects to the original AP.

There are two issues here: distance and the strength of your network card (usually the laptop's network card or a USB WiFi adapter).

Deauthentication or Bumping Him Off The next step is to bump the victim off the access point. The 802.11 standard has a special frame called a deauthentication frame, which, as you might expect, deauthenticates everyone on the access point. When his computer tries to authenticate again, it will automatically connect to the strongest AP with the ESSID of "Elroy."

Note that once again, we have used his BSSID in the aireplay-ng command. If our signal is stronger than his AP, he will automatically connect to our evil twin!

How to fix

The prerequisites for this attack include:

  • Being near the targeted WiFi (about 80-90% signal strength).
  • Having a strong network card to create a fake network with a strong signal to overpower the original one.
  • Choosing the right USB WiFi adapter is also essential.