3

I am currently trying to better understand this attack.

If the network is open ie, not password, I would assume that it would be super easy for the evil twin to work. If I understand correctly, wireless clients won't be able to tell the difference both the legit and twin would look the same. Likely causing the evil twin and legit network to show up as one network name when people look.

So if the same thing is done on a wifi network with, say wpa2/ccmp I am assuming if I set up the evil twin I would have to know the password in order to get other wifi clients to show it as one ssid. If I did not know it, I guess the evil twin would cause wireless clients to show two different ssids?

Is this correct?

Pat
  • 31
  • 1
  • 1
    Hi and welcome to Security.SE. Great first question, but please be more mindful to only use relevant tags in the future. –  Jun 29 '21 at 08:37

1 Answers1

3

On the Evil Twin attack you use a rogue AP to imitate a genuine one by using the same SSID (so yes, answering to one of your questions, the SSID is going to be the same) however the Rogue AP usually does not implement any password and will probably have a captive portal that will lure the victim to write the password on it before proceeding:

Captive portal

Evil Twin attacks may perform a de-authentication attack in order to force the users to re-connect, ideally with the Rogue AP.

I think that is very relevant to also bring some helpful answers that treated a slightly different question (but still related) and it is about how to protect yourself against EvilTwin attack:

Does WPA2 Enterprise mitigate evil twin attacks?

Since it looks like you encountered some troubles with this attack , if I had to choose a tool to perform an Evil Twin attack I would personally go for Airgeddon (https://github.com/v1s1t0r1sh3r3/airgeddon) which has a myriad of Evil Twin attacks, including:

  • Only Rogue/Fake AP mode to sniff using external sniffer (Hostapd + DHCP + DoS)
  • Simple integrated sniffing (Hostapd + DHCP + DoS + Ettercap)
  • Integrated sniffing, sslstrip2 (Hostapd + DHCP + DoS + Bettercap)
  • Integrated sniffing, sslstrip2 and BeEF Browser Exploitation Framework (Hostapd + DHCP + DoS + Bettercap + BeEF)
  • Captive portal with "DNS blackhole" to capture wifi passwords (Hostapd + DHCP + DoS + Dnsspoff + Lighttpd)
  • Optional MAC spoofing for all Evil Twin attacks

It is a super interesting suite well documented and made completely in Bash that is the reason why it is usually my first (and last) stop in terms of these attacks.

borcho
  • 550
  • 2
  • 15