Wifiphisher is an effective rogue Access Point framework used by hundreds of Wi-Fi hackers everyday. It is free and open source software currently available for Linux.
Wifiphisher is a security tool that performs Wi-Fi automatic association attacks to force wireless clients to unknowingly connect to an attacker-controlled Access Point. It is a rogue Access Point framework that can be used to mount automated victim-customized phishing attacks against WiFi clients in order to obtain credentials.
After achieving a man-in-the-middle position using Wi-Fi automatic association techniques (including “KARMA” and “Known Beacons” attacks), Wifiphisher by default redirects all HTTP requests to an attacker-controlled phishing page.
How it works:
- Victim is being deauthenticated from her access point. Wifiphisher continuously jams all of the target access point’s wifi devices within range by forging “Deauthenticate” or “Disassociate” packets to disrupt existing associations.
- Victim joins a rogue access point. Wifiphisher sniffs the area and copies the target access point’s settings. It then creates a rogue wireless access point that is modeled by the target. It also sets up a NAT/DHCP server and forwards the right ports. Consequently, because of the deauth attack and the automatic association techniques, clients will eventually start connecting to the rogue access point. After this phase, the victim is MiTMed.
- Victim is being served a realistic specially-customized phishing page. Wifiphisher employs a minimal web server that responds to HTTP & HTTPS requests. As soon as the victim requests a page from the Internet, wifiphisher will respond with a realistic fake page that asks for credentials or serves malwares. This page will be specifically crafted for the victim. For example, a router config-looking page will contain the brand of the victim’s vendor. The tool supports community-built templates for different phishing scenarios.
With that being said, it’s time to give it a try. This example will be using Kali Linux. You can install Wifiphisher using the following:
git clone https://github.com/wifiphisher/wifiphisher.git
sudo python setup.py install
Usage of the tool (from the GitHub page):
wifiphisher -aI wlan0 -jI wlan4 -p firmware-upgrade –handshake-capture handshake.pcap
The above command will use wlan0 for spawning the rogue Access Point and wlan4 for DoS attacks. Select the target network manually from the list and perform the “Firmware Upgrade” scenario. Verify that the captured Pre-Shared Key is correct by checking it against the handshake in the handshake.pcap file.
Useful for manually selecting the wireless adapters. The “Firmware Upgrade” scenario is an easy way for obtaining the PSK from a password-protected network.
wifiphisher –essid CONFERENCE_WIFI -p plugin_update -pK s3cr3tp4ssw0rd
This command using the plugin_update will automatically pick the right interfaces. Target the Wi-Fi with ESSID “CONFERENCE_WIFI” and perform the “Plugin Update” scenario. The Evil Twin will be password-protected with PSK “s3cr3tp4ssw0rd”.
Useful against networks with disclosed PSKs (e.g. in conferences). The “Plugin Update” scenario provides an easy way for getting the victims to download malicious executables (e.g. malware containing a reverse shell payload).
wifiphisher –noextensions –essid “FREE WI-FI” -p oauth-login -kB
Do not load any extensions. Simply spawn an open Wi-Fi network with ESSID “FREE WI-FI” and perform the “OAuth Login” scenario. Use the “Known Beacons” Wi-Fi automatic association technique.
Useful against victims in public areas. The “OAuth Login” scenario provides a simple way for capturing credentials from social networks, like Facebook.
As you can see this tool can be invaluable when accessing wireless networks. If successful this proves a much cleaner and quicker way of gaining access to a network. Once you know the password, you could then proceed to use the plugin_update attack and deliver a payload to clients trying to connect to the network.