How to Create an Evil Twin Attack to Capture Wi-Fi Credentials

How to Create an Evil Twin Attack to Capture Wi-Fi Credentials

How to Create an Evil Twin Attack

How to Create an Evil Twin Attack

How to Create an Evil Twin Attack to Capture Wi-Fi Credentials

Let’s say, You are an Ethical hacker and you are learning and trying to figure out how to gain access to a target network using various penetration testing techniques for education purposes. Before we Delve into ” How to Create an Evil Twin Attack to Capture WI-FI Credentials, first we need more information, you never just dive right into an evil twin attack lol
So Here’s a breakdown of how you can approach this problem:

1. Understand the Network Setup

  • First, determine how the building next door or whomever you are testing this on is connected.
  • Is it using Wi-Fi? Ethernet? A combination of both?
  • Are there any publicly available access points?

2. Wireless Network Attacks

If the network is wireless, you’ll need to find a way to gain access without having the password.

Passive Reconnaissance

  • Use tools like Kismet or Airodump-ng to monitor Wi-Fi networks in range.
  • Identify if there are any open or WPA/WPA2-protected networks.
  • Check if there’s a guest network that you can access.

Capturing WPA Handshakes (For Encrypted Networks)

  • If the Wi-Fi is WPA2-protected, you can capture the handshake using Airodump-ng and try to crack the password with tools like aircrack-ng or hashcat (if a weak password is used).

WPS Attack (If Vulnerable)

  • Some routers have WPS enabled, which can be exploited using Reaver or Bully.

Evil Twin Attack (Man-in-the-Middle)

  • Set up a fake access point (using airbase-ng or hostapd) and trick users into connecting to your network instead.

3. Wired Network Access

If the target is using a wired connection, you have to find a way to physically connect to their network.

  • Check for exposed Ethernet ports (conference rooms, lobbies, waiting areas).
  • Use a Rogue Access Point (drop a Wi-Fi-enabled device like a Raspberry Pi to create a backdoor into their network).
  • Look for VOIP phones that might have extra Ethernet ports that connect to the same internal network.

4. Exploiting Network Services

Once you are connected, scan the network using:

bash
nmap -sV -O -T4 <target-ip-range>
  • Look for open ports and vulnerable services.
  • Exploit misconfigured servers or default credentials.
  • Use Responder to capture NTLM hashes if they have Windows-based authentication.

5. Social Engineering

If hacking their network directly is hard, social engineering might be an option:

  • Phishing attacks (sending a fake email with a malicious payload).
  • USB drop attacks (leave a malicious USB in a common area).
  • Tailgating (get inside the building and plug into their network physically).

Conclusion

Think critically  about this, If you can’t connect directly, you need to find an alternative way (e.g., capturing handshakes, phishing, or exploiting physical access). What tools have you tried so far?

So lets assume They are connected wirelessly and you know this because when you scan for wifi networks on your phone the name “Disneyland” shows up, given its actually the name of the business this would be correct. However sometimes its never that easy.

Step 1: Reconnaissance

Before attacking, you need to gather intelligence about the target network.

1. Scan for Networks

Run:

bash
sudo airodump-ng wlan0mon

This will display all nearby networks, including Disney Land and spectrum mobile.

2. Check Security Type

  • Open Network: If Disney Land is open, you can just connect directly.
  • WPA2-Personal: If it uses a password, you’ll need to crack it.
  • WPA2-Enterprise: If it uses enterprise authentication, you’ll need to steal credentials via a fake AP.

Step 2: Attacking the Wi-Fi

If the Wi-Fi is encrypted (WPA2-Personal), your options are:

1. Capture Handshake & Crack the Password

  • Start listening for connections:
    bash
    sudo airodump-ng -c <channel> --bssid <BSSID> -w capture wlan0mon
  • Deauthenticate a user to force a reconnection (captures handshake):
    bash
    sudo aireplay-ng -0 10 -a <BSSID> wlan0mon
  • Crack the password:
    bash
    sudo aircrack-ng -w rockyou.txt -b <BSSID> capture.cap

If the password is weak, it will crack. If not, try…

  • Hashcat with GPU acceleration
  • PMKID Attack (alternative to capturing handshakes)
    bash
    sudo hcxdumptool -i wlan0mon --enable_status=3 -o pmkid.pcap
    sudo hcxpcaptool -z pmkid_hashes pmkid.pcap
    sudo hashcat -m 16800 pmkid_hashes rockyou.txt

    2. WPS Attack (If Enabled)

    If the router has WPS enabled, brute force the PIN using Reaver:

    bash
    sudo reaver -i wlan0mon -b <BSSID> -vv

    If successful, it will give you the Wi-Fi password.

    Step 3: Post-Connection (Once You’re In)

    Once connected to Disney Land, scan the internal network:

    bash
    sudo nmap -sV -O -T4 192.168.1.0/24
    • Look for unsecured devices, open ports, or default credentials.
    • Use Responder to capture NTLM hashes if it’s a Windows network.

    Step 4: Physical Network Access (Hardwired)

    Since the target also has hardwired Ethernet, check if:

    • There are exposed Ethernet ports (conference rooms, public areas).
    • You can drop a Raspberry Pi or rogue access point to maintain access.

     

 Evil Twin Attack (Fake AP)

If you can’t crack the password, you can trick users into connecting to your fake network.

  • Set up a cloned SSID (Disney Land) using:
    bash
    sudo airbase-ng -e "Disney land" -c <channel> wlan0mon
  • Deauth nearby users so they reconnect to your rogue AP:
    bash
    sudo aireplay-ng -0 10 -a <BSSID> wlan0mon
  • Use a captive portal to trick users into entering their Wi-Fi password.

    More indepth Evil Twin attack

    In the world of ethical hacking and penetration testing, one of the most effective ways to compromise a Wi-Fi network is through an Evil Twin Attack. This attack involves setting up a fake Wi-Fi access point that mimics a legitimate network. When unsuspecting users connect, they unknowingly give up their credentials or allow their data to be intercepted.

    In this guide, I’ll walk you through the step-by-step process of setting up an Evil Twin Attack using tools like aircrack-ng, airbase-ng, and SEToolkit. For demonstration purposes, we’ll target a Wi-Fi network named Disneyworld.

    What is an Evil Twin Attack?

    An Evil Twin Attack is a type of Wi-Fi phishing attack where a hacker sets up a rogue wireless network that appears identical to a real one. When users connect to the fake network, they are redirected to a phishing login page, where they are tricked into entering their real Wi-Fi password.

    Once the attacker gets access to the credentials, they can join the real network, conduct Man-in-the-Middle (MITM) attacks, capture login details, and even monitor traffic.

    Step 1: Enable Monitor Mode

    To begin, you’ll need to put your wireless adapter into monitor mode so you can scan nearby Wi-Fi networks.

    Open a terminal and run:

    bash
    sudo airmon-ng start wlan0

    This will enable monitor mode, changing your interface from wlan0 to wlan0mon.

    Step 2: Scan for Nearby Networks

    Next, scan for available Wi-Fi networks to locate the target network (Disneyworld in this case):

    bash
    sudo airodump-ng wlan0mon

    Look for:

    • BSSID (MAC address of the router)
    • Channel (CH column)
    • Encryption Type (WPA2, WPA3, or Open)

    Once you’ve identified the target BSSID and channel, take note of them.

    Step 3: Set Up the Evil Twin

    Now, create a fake access point (AP) with the same name as the target SSID.

    Run:

    bash
    sudo airbase-ng -e "Disneyworld" -c <channel> wlan0mon
    • -e "Disneyworld" → Creates an SSID with the same name as the target.
    • -c <channel> → Uses the same Wi-Fi channel as the real AP.
    • wlan0mon → Uses your wireless adapter in monitor mode.

    This will start broadcasting Disneyworld, and nearby devices will see it as a legitimate network.

    Step 4: Kick Users Off the Real Wi-Fi

    To make users switch to your fake Wi-Fi, you need to deauthenticate them from the real one. This forces them to reconnect—hopefully to your Evil Twin.

    Use:

    bash
    sudo aireplay-ng -0 10 -a <BSSID> wlan0mon
    • -0 10 → Sends 10 deauthentication packets.
    • -a <BSSID> → Targets the real Disneyworld Wi-Fi.
    • This forces users to disconnect and reconnect, likely choosing the stronger signal (your Evil Twin).

    Step 5: Capture Credentials with a Fake Login Page

    Once users connect to the fake Disneyworld network, they should be redirected to a phishing page asking for the Wi-Fi password.

    Method 1: Using SEToolkit

    You can use SEToolkit to create an automatic phishing portal:

    bash
    sudo setoolkit

    Then:

    • Select Social Engineering Attacks
    • Choose Wireless Access Point Attack
    • Set up a fake login page that looks like a typical Wi-Fi authentication page.

    When users enter their Wi-Fi password, it gets stored in logs.

    Step 6: Sniff Network Traffic (Optional)

    If you want to go beyond just stealing Wi-Fi credentials and actually intercept data, you can run a Man-in-the-Middle (MITM) attack.

    Install Bettercap:

    bash
    sudo apt install bettercap

    Then run:

    bash
    sudo bettercap -iface wlan0
    • This allows you to capture login details, session cookies, and unencrypted data.

    Step 7: Stop the Attack & Use the Captured Password

    Once you’ve obtained the real Wi-Fi password, you can stop the Evil Twin attack:

    bash
    sudo airmon-ng stop wlan0mon

    Then, connect to the real network using the stolen credentials.

    How to Defend Against Evil Twin Attacks

    Now that you understand how this attack works, here’s how to protect yourself:

    • Avoid public Wi-Fi networks that don’t require a password.
    • Use VPNs to encrypt your traffic.
    • Enable WPA3 security on your router (Evil Twin attacks are less effective).
    • Use multi-factor authentication (MFA) for sensitive logins.
    • Check for duplicate SSIDs before connecting to a network.

    Final Thoughts

    The Evil Twin Attack is a powerful technique used in penetration testing and ethical hacking to demonstrate Wi-Fi security flaws. It’s a great learning experience for pentesters, but it should only be used for authorized security testing.

    If you’re in a cybersecurity program or preparing for a Certified Ethical Hacker (CEH) exam, mastering this technique is a valuable skill. However, never use it for illegal activities—hacking without permission is a crime.

    What method do you find most interesting? Have you tried setting up an Evil Twin before? Let me know in the comments!

#EvilTwinAttack #WiFiHacking #PenTesting #CyberSecurity #EthicalHacking

    Leave Your Comment Here

    This site uses Akismet to reduce spam. Learn how your comment data is processed.

    HACKING TOOLS

    INVESTIGATOR- RECON TOOL