Evil Twin and Captive Portals

An Evil Twin is a fake WiFi access point that impersonates a legitimate one (same SSID) so victims connect to it instead of the real one. Once connected, the attacker is in the middle (MITM) of all their traffic and can capture credentials via a fake captive portal (a “log in to use the WiFi” page), steal Enterprise WiFi credentials, or attack the clients. It’s one of the most effective WiFi attacks against people.

Threat model

Devices remember networks and auto-reconnect to known SSIDs, and people can’t tell a legitimate AP from a fake one with the same name. The attacker stands up a twin AP (more powerful or after deauthing from the real one), the victim connects, and from then on all their traffic goes through the attacker. No encryption is broken: the victim is tricked into connecting to the wrong place.

Red Team — set up the Evil Twin

# tools that automate the whole flow
wifiphisher               # evil twin + captive portal + deauth, automated
airgeddon                 # full menu (evil twin, captive portal, WPA, WPS...)
eaphammer                 # specialized in WPA-Enterprise (credential theft)
hostapd-mana / berate_ap  # low-level malicious AP
# conceptual manual flow:
# 1) fake AP with the same SSID (hostapd)
# 2) deauth the real AP to push clients (see wifi)
# 3) DHCP/DNS redirecting everything to your captive portal
# 4) portal asking for the WiFi password / credentials

Captive portal (credential theft)

# the victim connects to the evil twin (open) and their browser opens the portal
# the portal mimics the ISP's/company's and asks for the WiFi password
# -> the captured key is validated against the real AP's handshake
# also: portals asking for corporate credentials, email, etc.

It’s social engineering over WiFi: the victim types the password believing they’re reconnecting to their network.

WPA-Enterprise: evil twin with a fake RADIUS

On Enterprise networks (802.1X), an evil twin with a malicious RADIUS captures the clients’ EAP exchange, obtaining the challenge/response (crackable offline) or the credentials:

eaphammer --cert-wizard                 # generate a certificate
eaphammer -i wlan0 --essid CorpWiFi --creds   # fake AP capturing EAP credentials
# the MSCHAPv2 challenge is cracked offline -> domain credentials (bridge to AD!)

If clients don’t validate the RADIUS server certificate, they connect to the fake one and hand over their credentials. This connects WiFi to AD (see Password Spraying/Active Directory Enumeration).

After the MITM

With the victim connected to the evil twin:

# full MITM (see net-mitm): sniffing, DNS spoofing, SSL stripping
# capture credentials, cookies, tokens from unencrypted traffic
# attack the clients directly (services exposed on their devices)

For the defense

WPA3 / 802.11w (PMF): hinder the deauth that pushes clients to the twin.
Enterprise with server certificate validation (EAP-TLS or PEAP with strict validation): the client rejects the fake RADIUS → doesn’t hand over credentials.
Don’t trust captive portals for credentials; train users (don’t type the WiFi key into pages).
MFA (a captured credential is worth less); E2E encryption (HTTPS/VPN) limits the MITM.
WIDS/WIPS (rogue AP / evil twin detection): alert on duplicate SSIDs and unauthorized APs.

Testing checklist

Identify the target SSID and its clients (wifi)
Stand up the evil twin (wifiphisher/airgeddon)
Deauth to push clients to the twin
Captive portal capturing the WiFi key/credentials
Enterprise: fake RADIUS (eaphammer) → EAP credentials
Crack the MSCHAPv2 challenge → domain credentials
MITM over the connected ones (Man-in-the-Middle)
Blue: PMF, certificate validation, WIPS?