💻 Wi-Fi-Exploitation-using-Evil-Twin-MITM-Attacks

📄 Project Description

This project demonstrates the ethical exploitation of Wi-Fi networks through a structured simulation of pre-connection, connection, and post-connection attack phases. It focuses on understanding and executing Evil Twin Attacks and Man-in-the-Middle (MITM) attacks (especially ARP spoofing) in a controlled lab environment using Kali Linux.

The simulation begins with scanning and capturing beacon frames via an external wireless adapter in monitor mode using tools like airmon-ng and airodump-ng. Then, an Evil Twin (fake access point) is created using Airgeddon, tricking users into connecting to a rogue network.

Once connected, MITM techniques such as ARP spoofing are executed using Bettercap to intercept and analyze network traffic. Tools like Ettercap, Wireshark, and Bettercap help observe packet-level data flow and simulate real-world cyberattacks.

---

🛠️ Tools & Technologies Used

• Kali Linux (VMware Workstation recommended)
• External Wireless Adapter (with Monitor Mode support — e.g., ALFA AWUS036ACS)
• Aircrack-ng Suite:
  • airmon-ng
  • airodump-ng
  • aireplay-ng
• Airgeddon (for Evil Twin attack automation)
• Ettercap / Bettercap (for MITM)
• Wireshark (for packet analysis)

---

🔧 Pre-Connection Setup

To simulate Wi-Fi attacks, ensure your system and environment are properly configured:

🔌Hardware Requirements External Wi-Fi Adapter with Monitor Mode support Example: ALFA Network AWUS036ACS (Dual-Band AC600)

💻 Virtual Environment Install Kali Linux using VMware or any other virtualization tool Plug in your external Wi-Fi adapter and connect it to the VM

🛠️ Enable Monitor Mode Run the following commands to enable monitor mode on your wireless adapter:

iwconfig
ifconfig wlan0 down
airmon-ng check kill
iwconfig wlan0 mode monitor      # OR use: airmon-ng start wlan0
ifconfig wlan0 up

📡 Scan Networks (Packet Sniffing) Use airodump-ng (from Aircrack-ng suite) to detect nearby Wi-Fi networks:

airodump-ng wlan0

This will help you identify: BSSID (MAC address of the AP) Channel Encryption type Connected clients

---

🎭 Connection Phase

In this phase, we create a rogue Access Point (AP) that mimics a legitimate Wi-Fi network to trick users into connecting.

🚀 Launch Airgeddon Use Airgeddon – a powerful automated tool for Evil Twin attacks.

apt install airgeddon

🔧 Configure Settings Follow the interactive terminal menus in Airgeddon:

• Select your monitor-mode interface (e.g., wlan0mon)

• Choose Evil Twin Attack from the attack options

• Select the target AP (SSID and BSSID) you want to clone

• Provide the channel and interface for deauthentication

Airgeddon will automatically:

• Clone the SSID

• Set up a rogue AP

• Start a DHCP server

• Create a fake login portal (for credential capture)

⚠️ Deauthentication

The tool will perform a deauthentication attack to disconnect users from the real AP, pushing them to connect to the rogue one.

🔁 Fake AP Creation & Credential Capture

• A clone hotspot (rogue AP) is created with the same name (SSID) as the original network.
• When a victim tries to reconnect, their device may automatically connect to this fake AP.
• Upon connecting, the device is redirected to a fake login portal that mimics the router login page.
• The user is tricked into entering their Wi-Fi password, which is then captured by the attacker.

---

🔗 Post-Connection Phase – MITM (Man-in-the-Middle) Attack

Once the target device connects to the rogue access point (Evil Twin), you can perform Man-in-the-Middle (MITM) attacks to intercept and manipulate network traffic.

🛠 Setup IP Forwarding Enable IP forwarding to allow traffic to pass through your machine:

echo 1 > /proc/sys/net/ipv4/ip_forward

🧑‍💻 Launch Bettercap (MITM Tool) Bettercap is a powerful network attack and monitoring framework.

sudo bettercap -iface wlan0

Once inside the Bettercap console, run:

net.probe on
net.recon on
set arp.spoof.targets <victim_ip>
arp.spoof on

This will start **ARP spoofing** and place you between the target and the router.

📡 Capture and Analyze Traffic Monitor traffic directly inside Bettercap

Launch a packet sniffer like Wireshark to inspect data:

sudo wireshark

Look for **credentials**, **cookies**, or **HTTP/HTTPS** requests in real-time.

---

📸 For a clearer understanding of each step, please refer to the reference images available in the screenshots directory.