Rogue Access Point Attack

Evil Twin Attack

Clone a legitimate WiFi network, force victims onto your rogue access point, and harvest their credentials through a fake captive portal. One of the most devastating wireless social engineering attacks — and you're going to run it end-to-end.

What You'll Learn

  • How Evil Twin attacks abuse WiFi's trust model (clients connect by name, not identity)
  • Setting up a rogue AP with hostapd that perfectly mimics the target network
  • Using deauth floods to kick victims off the real network so they join yours
  • Building a captive portal phishing page that steals credentials
  • Capturing and logging victim credentials in real time
  • How to detect and defend against rogue access points

Legal Warning

Evil Twin attacks are illegal without authorization. Intercepting credentials on networks you don't own is a crime virtually everywhere (Computer Fraud and Abuse Act in the US, Computer Misuse Act in the UK, etc). Everything here runs in a fully simulated environment. Practice only on your own lab equipment or with written permission.

Theory

How Evil Twin Works

Why devices can't tell your fake AP from the real one — and how attackers exploit that.

The Core Flaw

WiFi clients identify networks by SSID (network name) — nothing more. If two access points broadcast "CoffeeShop_WiFi", your phone has no built-in way to know which is legitimate. It will typically connect to whichever has the stronger signal.

An attacker exploits this by:

  • Cloning the SSID of the target network (the "twin")
  • Jamming/deauthing the real AP so clients drop off
  • Broadcasting a stronger signal so victims auto-join the fake AP
  • Serving a captive portal that looks exactly like the real login page

Once connected, every packet the victim sends flows through the attacker's machine — full man-in-the-middle position. Passwords entered into the portal go straight to the attacker.

Attack Scenario
Real AP
L2C-Corp-WiFi
Ch 1 · -35 dBm
(being deauthed)
YOUR Evil Twin
L2C-Corp-WiFi
Ch 6 · -20 dBm
+ captive portal
Victim
John's Laptop
Auto-joins strongest
signal = YOU

The Toolchain

  • hostapd — Turns your wireless card into an access point broadcasting the cloned SSID
  • dnsmasq — Hands out IP addresses and answers DNS queries (redirects everything to your portal)
  • aireplay-ng — Floods the real AP's clients with deauth frames to force reconnection
  • Python/PHP web server — Hosts the fake login page and logs submitted credentials
  • iptables — Routes/controls traffic so the victim gets a "login required" experience
Attack Chain OverviewFlow
# 1. Clone the target SSID with hostapd hostapd evil_ap.conf # 2. Give victims IP + DNS (dnsmasq points ALL domains to your portal) dnsmasq -C dnsmasq.conf # 3. Kick victims off the REAL network aireplay-ng -0 0 -a AA:BB:CC:DD:EE:01 wlan0mon # 4. Serve the phishing portal & log credentials python3 portal_server.py [+] Captive portal on 10.0.0.1:80 [+] Waiting for victims...
Interactive Lab

Run the Evil Twin

Build the rogue AP step by step. Watch the victim fall for it in real time.

John's Laptop (simulated victim)
MAC: 11:22:33:44:55:66 · Auto-connect enabled
Connected to REAL AP
[John's Laptop] Connected to L2C-Corp-WiFi (real AP, 192.168.1.1)
Browsing normally... checking email, Slack, etc.

Attacker Terminal (Simulated)

root@l2c-lab:~/evil-twin
Evil Twin Lab v1.0 — Target: L2C-Corp-WiFi (AA:BB:CC:DD:EE:01)
Type 'help' for commands or follow the steps below.
root@l2c-lab:~#
Quick Commands
nano evil_ap.conf (configure rogue AP)
hostapd evil_ap.conf (start rogue AP)
dnsmasq -C dnsmasq.conf (DHCP/DNS)
deauth the real AP
start captive portal

Lab Steps

1

Configure the Rogue AP

Create the hostapd config that clones "L2C-Corp-WiFi". Same SSID, no password (open network = no friction for victims).

nano evil_ap.conf
2

Launch the Evil Twin

Start hostapd. Your card now broadcasts an identical network name with a stronger signal.

hostapd evil_ap.conf
3

Start DHCP + DNS Spoofing

dnsmasq gives victims an IP and resolves EVERY domain to your portal's IP. Any website they try to open = your phishing page.

dnsmasq -C dnsmasq.conf
4

Deauth the Real Network

Flood the real AP with deauthentication frames. John's laptop gets kicked off and auto-reconnects to the strongest signal — yours.

aireplay-ng -0 0 -a AA:BB:CC:DD:EE:01 wlan0mon
5

Serve the Captive Portal

Start the phishing page. When John's laptop pops open the "WiFi login", he'll enter the network password — straight into your logs.

python3 portal_server.py
Captive Portal

The Phishing Page

This is what the victim sees. Convincing enough that most people just type the password.

Victim's View

After connecting to your Evil Twin, any website John tries to visit gets hijacked to this portal. It mimics a router "re-authentication" page:

Network session expired. Please re-enter the WiFi password to continue.
⬆ Try it — enter any password above and click Connect. Watch what the attacker receives. ⬇

ATTACKER LOG — Credentials Captured!

[10.0.0.50] POST /login HTTP/1.1
Victim IP: 10.0.0.50 · User-Agent: John-Laptop/Chrome · Timestamp logged

Why It Works

  • Context: The victim just lost WiFi — a "reconnect" prompt feels natural, not suspicious
  • Branding: The SSID is pre-filled, so it looks like the router itself is asking
  • Urgency: No internet until they comply — most people just want their connection back
  • No HTTPS warning: It's a local page, so no certificate errors to scare them

In real engagements, attackers clone the exact captive portal of the venue (hotel, airport, coffee shop) or mimic a router firmware login page for maximum credibility.

Defense

Defending Against Evil Twins

Now that you can run the attack — here's how you stop it.

For Users

  • Never enter WiFi passwords into browser pages. Real routers never ask for the WiFi password through a website. Instant red flag.
  • Watch for sudden disconnects. Getting kicked off WiFi and immediately seeing a "login" prompt = classic Evil Twin pattern.
  • Use a VPN on public WiFi. Even on a rogue AP, your traffic stays encrypted end-to-end.
  • Disable auto-connect for open networks and "remembered" public SSIDs.
  • Check for HTTPS. Login pages on plain HTTP on a "secure" network are suspicious.

For Organizations

  • 802.1X / Enterprise auth: Certificate-based mutual authentication means clients verify the AP too — fake APs fail validation
  • 802.11w (PMF): Protected Management Frames make deauth floods far less effective
  • Wireless IDS/IPS: Tools like Kismet, WIDS sensors, or Aruba RAPIDS detect duplicate SSIDs on wrong BSSIDs/channels
  • WPA3-SAE: Better authentication handshake; still not a silver bullet but raises the bar
  • User training: The human is the payload — teach staff what a rogue portal looks like
Detect a Rogue AP with KismetDetection
# Scan for your SSID appearing on unexpected BSSIDs kismet -c wlan0mon ALERT: SSID "L2C-Corp-WiFi" seen on 2 BSSIDs AA:BB:CC:DD:EE:01 (ch 1, known AP) 00:11:22:33:44:55 (ch 6, UNKNOWN - possible rogue!)

Room Complete

You now understand the full Evil Twin attack chain: clone → deauth → redirect → harvest. More importantly, you know the telltale signs that give it away.

Next up: Take the WiFi Cracking room to learn offline password attacks, or head back to the network map to pick another target.