offensive-evil-twin

# Evil Twin / KARMA / Mana Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires. ## Quick Workflow 1. Discover target ESSID(s) clients are looking for (PNL — Preferred Network List) 2. Stand up rogue AP advertising matching ESSID(s) 3. (Optional) Deauth clients off legitimate AP to push them toward yours 4. Run captive portal / transparent MITM 5. Capture creds, deliver payload, or harvest sessions --- ## Variants | Variant | Mechanic | Use Case | |---|---|---| | **Evil Twin** | Same ESSID + BSSID as legit AP | Open or PSK-known networks (ISP cafe Wi-Fi, public guest) | | **KARMA** | Respond "yes" to every probe request | Clients with broad PNLs (most older devices) | | **Mana** | Respond selectively to probes per-client | KARMA-aware MAC randomization defenses | | **Known Beacons** | Beacon a list of likely-known ESSIDs | Wide-net attraction without seeing probes first | | **Captive Portal** | Force splash page on association | Phishing, payload delivery | ## Open / PSK-Known Evil Twin Use when you know (or have cracked) the PSK. ```bash # wifiphisher — opinionated automation including portal templates sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd # airgeddon (interactive menu, good for one-off) sudo airgeddon # → Evil Twin attacks menu → Captive...