Capturing WPA2 Passwords Using Evil Twin Attacks with Wifiphisher

📘 Introduction

Traditional methods like WPA2 cracking require dictionary files and time-consuming brute-force attacks. Wifiphisher offers an alternative: social engineering through evil twin access points. In this educational post, we demonstrate how this attack method works with full command-line examples, allowing students and Red Team practitioners to replicate and study the technique in a controlled lab environment.

🛠️ Tools Required

• Kali Linux (latest recommended build)
• Two Wi-Fi adapters: One must support packet injection E.g., Alfa AWUS036H or adapters with Atheros/Realtek chipsets
• Wifiphisher (Python-based phishing automation tool)

📥 Step 1: Download and Prepare Wifiphisher

# Clone the repo directly from GitHub

git clone https://github.com/sophron/wifiphisher.git

# Navigate to the cloned directory

cd wifiphisher

Alternatively, unpack a downloaded tarball:

tar -xvzf /root/wifiphisher-1.1.tar.gz

cd wifiphisher-1.1

You should now see a Python script named wifiphisher.py.

🚀 Step 2: Execute the Script

python wifiphisher.py

On first launch, if hostapd is missing, you’ll be prompted to install it. Simply type “y” to proceed.

Once ready, running the script will:

• Launch web servers on ports 8080 and 443
• Scan for nearby Wi-Fi networks
• Present a list of targets with SSIDs and signal details

🎯 Step 3: Select Target and Begin Attack

After scanning completes:

1. Press Ctrl + C to stop scanning.
2. Enter the number associated with the target SSID (e.g., 12 for “TargetNet”).
3. The interface will begin de-authenticating the user.

The tool then clones the AP and presents a spoofed login webpage resembling a firmware update screen.

💾 Step 4: Simulated Credential Harvesting

Once the user reconnects:

• They are served a proxy-hosted page requesting re-authentication.
• Upon password submission, the credentials are shown in your terminal.

Example output:

[*] Captured password for SSID TargetNet: mysecurepassword123

Meanwhile, the user continues browsing as usual via your cloned AP, unaware of the interception.

🧪 Experiment Safely

Students can simulate this attack inside a virtual or air-gapped lab. Suggested additions:

• Run Wireshark in parallel to inspect captured frames.
• Test variations in spoofed landing page language.
• Explore custom phishing templates using HTML tweaks within wifiphisher/data/phishing-pages/.

🛡️ Ethical Use & Defensive Reflection

This walkthrough is intended for educational and defensive research only. Organizations should:

• Enforce WPA3 or FIDO2 authentication when possible
• Use network segmentation to isolate access points
• Monitor for de-authentication attacks using IDS/IPS solutions

📚 What’s Next?

XEye Academy will publish additional modules covering:

• Rogue AP detection techniques
• Device fingerprinting and MAC spoofing countermeasures
• Simulated phishing landing page creation in Python/Flask

Stay tuned and remember knowing the offensive path is the first step toward strong defense.