Home > Network Pentesting

Evil Twin Attacks

Evil Twin attacks exploit the way Wi-Fi clients automatically connect to known networks. By creating a fake access point (AP) with the same SSID as a legitimate network, attackers trick devices into connecting to the rogue AP. Once connected, the attacker can intercept traffic, harvest credentials, force captive-portal logins, perform phishing, or capture Enterprise authentication data. Evil Twin attacks work on open networks, WPA2-PSK, WPA2-Enterprise, and even WPA3 in specific conditions.

Why Evil Twin Attacks Work

Wi-Fi devices prioritize networks based on:

  • Previously saved SSIDs

  • Signal strength

  • Network priority

  • Auto-connect behavior

If an attacker broadcasts a stronger signal using the same SSID, many devices connect automatically without user notice.

This allows full MITM, credential theft, and session interception depending on the security type.

Requirements for an Evil Twin Attack

Before launching an Evil Twin, ensure:

  • Wireless adapter supports monitor + AP mode

  • Victim network SSID and channel are known

  • (Optional) A handshake has been captured for WPA2 offline cracking

  • (Optional) A captive portal phishing page is ready

Step 1: Identify the Target Network

Scan for nearby Wi-Fi networks.

Scan with Airodump-ng

sudo airodump-ng wlan0mon

Note:

  • SSID

  • BSSID (MAC)

  • Channel

  • Encryption type

  • Connected clients

This information is required to clone the access point.

Step 2: Create the Evil Twin Access Point

You can create an Evil Twin using multiple tools:

Method 1: Using airbase-ng (Simple Fake AP)

sudo airbase-ng -e "TargetSSID" -c <channel> wlan0mon

This sets up a cloned SSID on the chosen channel.

Method 2: Using hostapd (Powerful AP)

  1. Configure hostapd.conf:

interface=wlan0
ssid=TargetSSID
channel=6
driver=nl80211

  1. Start the AP:

sudo hostapd hostapd.conf

Hostapd supports WPA2-Enterprise Evil Twin attacks and custom authentication flows.

Method 3: Using Bettercap (Most Advanced)

Start Bettercap:

sudo bettercap -iface wlan0

Enable rogue AP:

wifi.recon on
wifi.ap on
set wifi.ap.ssid TargetSSID
set wifi.ap.channel <channel>

Bettercap supports DNS spoofing, captive portals, and credential harvesting.

Step 3: Deauthenticate Clients from the Real AP

To force clients to connect to the fake AP, disconnect them from the real one.

Send Deauth Packets

sudo aireplay-ng --deauth 10 -a <AP_MAC> wlan0mon

Or target specific clients:

sudo aireplay-ng --deauth 10 -a <AP_MAC> -c <CLIENT_MAC> wlan0mon

Clients will automatically try to reconnect—many will connect to the stronger fake AP.

If PMF (Protected Management Frames) is enabled, deauth attacks may fail, requiring alternative techniques.

Step 4: Intercept Traffic or Harvest Credentials

Once a device joins the rogue AP, you control all traffic.

Capturing HTTP Credentials

sudo tcpdump -i at0

Intercepts plaintext logins on unsecured sites.

DNS Spoofing for Phishing

set dns.spoof.on true

Redirect users to attacker-controlled phishing pages.

Captive Portal Credential Harvesting

Serve a fake login page asking for:

  • Wi-Fi password (WPA2-PSK attacks)

  • Username/password (Enterprise attacks)

Bettercap automatically collects submitted credentials.

Step 5: WPA2-Enterprise Credential Harvesting

Evil Twin is extremely effective against misconfigured Enterprise networks.

Start hostapd-wpe (EAP Credential Capture)

sudo hostapd-wpe hostapd-wpe.conf

Victims connecting via PEAP/MSCHAPv2 leak challenge-response pairs.

Captured data supports offline cracking.

Step 6: WPA2-PSK Password Extraction

If the victim enters the Wi-Fi password into a fake portal, attackers capture the passphrase directly.

This bypasses handshake cracking entirely.

Step 7: Advanced Evil Twin Techniques

Bypassing PMF (WPA3)

PMF prevents deauth attacks but clients may still:

  • Prefer stronger AP signal

  • Auto-connect without validation

  • Fail certificate checks in Enterprise mode

Evil Twin remains possible under several conditions.

Making the Fake AP Appear Stronger

Use:

  • High-gain antennas

  • Closer proximity

  • Higher transmit power

Increase transmit power:

sudo iwconfig wlan0 txpower 30

(Not all adapters support high power modes.)

Step 8: Detecting a Successful Attack

Signs:

  • Connected clients appear in airbase-ng terminals

  • ARP/DNS requests flow through at0 interface

  • Captive portal pages load

  • EAP challenge-response is logged (Enterprise)

  • Victims request DHCP leases from the fake AP

Monitoring tools confirm live connections.

Why Evil Twin Attacks Matter

Evil Twin is one of the most effective Wi-Fi attacks because it bypasses cryptography entirely and targets:

  • Auto-connect behavior

  • Weak user awareness

  • Poor certificate validation

  • Misconfigured WPA2-Enterprise

  • Open networks

  • WPA3 transition mode

It provides attackers with:

  • HTTP credentials

  • Captive portal logins

  • WPA2-PSK passwords

  • EAP/MSCHAPv2 hashes

  • DNS-based redirection

  • Full MITM capabilities

Evil Twin attacks are essential in wireless pentesting for evaluating real-world user behavior and network resilience.

Intel Dump

  • Evil Twin clones a legitimate SSID with a stronger fake AP

  • Tools: airbase-ng, hostapd, hostapd-wpe, Bettercap

  • Deauth used to force reconnection

  • Captive portals harvest credentials

  • Enterprise networks leak EAP/MSCHAPv2 if certificates are ignored

  • Works against WPA2, WPA, open networks, and WPA3 transition mode

HOME LEARN COMMUNITY DASHBOARD