Wifiphisher – The Rogue Access Point Framework

Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks.

Wifiphisher can be further used to mount victim-customized web phishing attacks against the connected clients in order to capture credentials (e.g. from third party login pages or WPA/WPA2 Pre-Shared Keys) or infect the victim stations with malwares.

Wifiphisher is…

  • …powerful. Wifiphisher can run for hours inside a Raspberry Pi device executing all modern Wi-Fi association techniques (including “Evil Twin”, “KARMA” and “Known Beacons”).
  • …flexible. Supports dozens of arguments and comes with a set of community-driven phishing templates for different deployment scenarios.
  • …modular. Users can write simple or complicated modules in Python to expand the functionality of the tool or create custom phishing scenarios in order to conduct specific target-oriented attacks.
  • …easy to use. Advanced users can utilize the rich set of features that Wifiphisher offers but beginners may start out as simply as “./bin/wifiphisher”. The interactive Textual User Interface guides the tester through the build process of the attack.
  • …the result of an extensive research. Attacks like “Known Beacons” and “Lure10” as well as state-of-the-art phishing techniques, were disclosed by our developers, and Wifiphisher was the first tool to incorporate them.
  • …supported by an awesome community of developers and users.
  • …free. Wifiphisher is available for free download, and also comes with full source code that you may study, change, or distribute under the terms of the GPLv3 license.
Also read: WiFite2 – Automated Wireless Attack Tool

How it works

Wi-Fi phishing consists of two steps:

  1. The first step involves the process of associating with Wi-Fi clients unknowingly, or in other words, obtaining a man-in-the-middle (MITM) position. Wifiphisher uses a number of different techniques to achieve this including:
    • Evil Twin, where Wifiphisher creates a fake wireless network that looks similar to a legitimate network.
    • KARMA, where Wifiphisher masquerades as a public network searched for by nearby Wi-Fi clients.
    • Known Beacons, where Wifiphisher broadcasts a dictionary of common ESSIDs, that the around wireless stations have likely connected to in the past.

    At the same time, Wifiphisher keeps forging “Deauthenticate” or “Disassociate” packets to disrupt existing associations and eventually lure victims using the above techniques.


Performing MiTM attack

  1. (Optionally) There are a number of different attacks that can be carried out once Wifiphisher grants the penetration tester with a man-in-the-middle position. For example, the tester may perform data sniffing or scan the victim stations for vulnerabilities.Using Wifiphisher, advanced web phishing techniques are possible by gathering information from the target environment and victim user. For example, in one of our scenarios, Wifiphisher will extract information from the broadcasted beacon frames and the HTTP User-Agent header to display a web-based imitation of Windows network manager in order to capture the Pre-Shared Key.


Fake web-based network manager

Requirements

Following are the requirements for getting the most out of Wifiphisher:

  • A working Linux system. People have made Wifiphisher work on many distros, but Kali Linux is the officially supported distribution, thus all new features are primarily tested on this platform.
  • One wireless network adapter that supports AP & Monitor mode and is capable of injection. Drivers should support netlink.

Installation

To install the latest development version type the following commands:

git clone https://github.com/wifiphisher/wifiphisher.git # Download the latest revision
cd wifiphisher # Switch to tool's directory
sudo python setup.py install # Install any dependencies

Alternatively, you can download the latest stable version from the Releases page.

Also read: SigPloit – Telecom Signaling Exploitation Framework SS7, GTP, Diameter & SIP

Usage

Run the tool by typing wifiphisher or python bin/wifiphisher (from inside the tool’s directory).

By running the tool without any options, it will find the right interfaces and interactively ask the user to pick the ESSID of the target network (out of a list with all the ESSIDs in the around area) as well as a phishing scenario to perform. By default, the tool will perform both Evil Twin and KARMA attacks.


wifiphisher -aI wlan0 -jI wlan4 -p firmware-upgrade --handshake-capture handshake.pcap

Use wlan0 for spawning the rogue Access Point and wlan4 for DoS attacks. Select the target network manually from the list and perform the “Firmware Upgrade” scenario. Verify that the captured Pre-Shared Key is correct by checking it against the handshake in the handshake.pcap file.

Useful for manually selecting the wireless adapters. The “Firmware Upgrade” scenario is an easy way for obtaining the PSK from a password-protected network.


wifiphisher --essid CONFERENCE_WIFI -p plugin_update -pK s3cr3tp4ssw0rd

Automatically pick the right interfaces. Target the Wi-Fi with ESSID “CONFERENCE_WIFI” and perform the “Plugin Update” scenario. The Evil Twin will be password-protected with PSK “s3cr3tp4ssw0rd”.

Useful against networks with disclosed PSKs (e.g. in conferences). The “Plugin Update” scenario provides an easy way for getting the victims to download malicious executables (e.g. malwares containing a reverse shell payload).


wifiphisher --essid "FREE WI-FI" -p oauth-login -kB

Simply spawn an open Wi-Fi network with ESSID “FREE WI-FI” and perform the “OAuth Login” scenario. Furthermore, mount the “Known Beacons” Wi-Fi automatic association technique.

Useful against victims in public areas. The “OAuth Login” scenario provides a simple way for capturing credentials from social networks, like Facebook.

Following are all the options along with their descriptions (also available with wifiphisher -h):

Short formLong formExplanation
-h–helpshow this help message and exit
-i INTERFACE–interface INTERFACEManually choose an interface that supports both AP and monitor modes for spawning the rogue AP as well as mounting additional Wi-Fi attacks from Extensions (i.e. deauth). Example: -i wlan1
-eI EXTENSIONSINTERFACE–extensionsinterface EXTENSIONSINTERFACEManually choose an interface that supports monitor mode for running the extensions. Example: -eI wlan1
-aI APINTERFACE–apinterface APINTERFACEManually choose an interface that supports AP mode for spawning an AP. Example: -aI wlan0
-kN–keepnetworkmanagerDo not kill NetworkManager.
-nE–noextensionsDo not load any extensions.
-e ESSID–essid ESSIDEnter the ESSID of the rogue Access Point. This option will skip Access Point selection phase. Example: –essid ‘Free WiFi’
-pPD PHISHING_PAGES_DIRECTORY–phishing-pages-directory PHISHING_PAGES_DIRECTORYSearch for phishing pages in this location
-p PHISHINGSCENARIO–phishingscenario PHISHINGSCENARIOChoose the phishing scenario to run.This option will skip the scenario selection phase. Example: -p firmware_upgrade
-pK PRESHAREDKEY–presharedkey PRESHAREDKEYAdd WPA/WPA2 protection on the rogue Access Point. Example: -pK s3cr3tp4ssw0rd
-qS–quitonsuccessStop the script after successfully retrieving one pair of credentials.
-lC–lure10-captureCapture the BSSIDs of the APs that are discovered during AP selection phase. This option is part of Lure10 attack.
-lE LURE10_EXPLOIT–lure10-exploit LURE10_EXPLOITFool the Windows Location Service of nearby Windows users to believe it is within an area that was previously captured with –lure10-capture. Part of the Lure10 attack.
-iAM–mac-ap-interfaceSpecify the MAC address of the AP interface. Example: -iAM 38:EC:11:00:00:00
-iEM–mac-extensions-interfaceSpecify the MAC address of the extensions interface. Example: -iEM E8:2A:EA:00:00:00
-iNM–no-mac-randomizationDo not change any MAC address.
-hC–handshake-captureCapture of the WPA/WPA2 handshakes for verifying passphrase. Example: -hC capture.pcap
-dE ESSID–deauth-essid ESSIDDeauth all the BSSIDs in the WLAN with that ESSID.
-dC CHANNELS–deauth-channels CHANNELSChannels to deauth. Example: –deauth-channels 1,3,7
–loggingEnable logging. Output will be saved to wifiphisher.log file.
-lP LOGPATH–logpath LOGPATHDetermine the full path of the logfile.
-cP CREDENTIAL_LOG_PATH–credential-log-path CREDENTIAL_LOG_PATHDetermine the full path of the file that will store any captured credentials
-cM–channel-monitorMonitor if the target access point changes the channel.
–payload-pathEnable the payload path. Intended for use with scenarios that serve payloads.
-wP–wps-pbcMonitor if the button on a WPS-PBC Registrar side is pressed.
-wAI–wpspbc-assoc-interfaceThe WLAN interface used for associating to the WPS AccessPoint.
-kB–known-beaconsPerform the known beacons Wi-Fi automatic association technique.
-fH–force-hostapdForce the usage of hostapd installed in the system.
–dnsmasq-conf DNSMASQ_CONFDetermine the full path of dnmasq.conf file.
-dK–disable-karmaDisables KARMA attack.
-pE–phishing-essidDetermine the ESSID you want to use for the phishing page.

Screenshots


Targeting an access point


A successful attack


Fake router configuration page


Fake OAuth Login Page

Leave a Reply

Your email address will not be published. Required fields are marked *