Introduction:
Evil Twin is one of most popular and interesting attacks when it comes to wireless/wifi penetration testing. As it say Evil Twin, it means exactly same, that creating a duplicate evil access point of the targeted access point. There are multiple tools available on the internet to achieve the evil twin, here let’s perform the Evil Twin attack using airgeddon.
How Evil Twin Attack Works:
Airgeddon Setup:
Airgeddon is an automated script which helps to perform different kind of wireless attacks like evil twin, attacks agist wep, wpa2/3 and wps. In the background it uses the different tools used to wireless pentesting such as aircrack-ng, reaver, etc.
Clone the airgeddon repo and install the dependencies using the command below
git clone https://github.com/v1s1t0r1sh3r3/airgeddon.git
cd airgeddon
sudo ./airgeddon.sh
It will show some packages are missing, make sure to install those packages automatically via airgeddon itself or manually.
Attack Scenario:
1. Connect the WiFi Adapter
Connect the wifi pentesting supported wifi adapter, now what does it mean? It means very simple that the wifi adapter which supports monitor mode + packet injection also make sure to check the standards. Some of the most popular wifi adapter used for wifi pentesting are tp-link TL-WN722N version1 and Alfa.
It will detect as an interface, select that adapter like it’s wlan0 in the image below.
2.Enable Monitor mode
First, enable the monitor mode of the interface/wifi adapter by select the option from the menu given in the image below. Note that, monitor mode can also be enable manually using aircrack-ng suites.
3.Capture the HandShake
Let’s capture the 4-way handshake, as this can be helpful in multiple ways as an attacker/pentester. First is that an can able perform brute force/directory based attack against the captured handshake locally. Secondly, it will also use to map the password entered by victim user at the time evil twin attack, which is to make sure that victim should provide the correct password to rouge access point.
Select the Capture Handshake option and it will check for all the available nearby targets/access points.
Select the specific target from the list, it’s 1. Pentestguy in the case below.
To capture the handshake it will deauth the client devices using different available tools, used mdk4 in the example given below. Free feel to try other options. Wait until the victim will reconnect, which will gives the handshake.
Make sure to store the captured handshake to specific location as later it will be require.
4.Evil Twin attacks using Airgeddon:
Go back to the main menu, and select the Evil Twin attacks menu option.
Then use the Evil Twin option with captive portal option, which required monitor mode enabled; note that as monitor is already enabled so no need to enable it again.
Again, it will search for nearby targets/access points.
Configure the previously captured handshake cap file plus the txt file path to store the password. Make sure to keep everything default it will be easy and fast.
Select language as per requirements, can also modify the advanced captive portal which will generate the targeted AP’s vendor logo, which will help to trick victim mind.
Now, wait for the victim to enter the correct password via captive portal, do not close any of the opened windows as it performed the required tasks for evil twin attack.
Once, victim provided the correct passphrase, it will pop up in the x-term window; where is mentioned Password captured successfully:
Conclusion:
This way you can setup the airgeddon tool and perform the evil-twin attack against the authorized target. Please note that this website don’t encourage to perform any unauthorized work or any illegal activities. Want to collaborate on real-world testing, tool development, or writing? Reach out via the Collaboration page. Thank you!!
