Evil-Twin WiFi Capture

Scope

My own home lab access point, WPA2-PSK, on hardware I own and administer. Two goals: crack a deliberately weak test passphrase from a captured handshake, and see what a rogue AP with the same SSID could actually get away with against my own client devices. AWUS036ACH for monitor mode, WiFi Pineapple for the evil-twin side.

Recon

Put the AWUS036ACH into monitor mode and swept for the target BSSID and channel:

airmon-ng start wlan1
airodump-ng wlan1mon

Locked onto the AP’s BSSID and channel, then narrowed the capture to just that network and started listening for a handshake:

airodump-ng -c 6 --bssid F4:28:53:1A:2C:9E -w capture wlan1mon

Exploitation

Handshake capture. Rather than wait for a client to reconnect naturally, sent a burst of deauth frames at an already-associated test device to force a reassociation:

aireplay-ng -0 5 -a F4:28:53:1A:2C:9E wlan1mon

Reassociation triggered the WPA handshake, which airodump-ng picked up in the running capture. Confirmed it was captured cleanly before moving on:

aircrack-ng capture-01.cap

Cracked the (deliberately weak, test-only) passphrase against rockyou.txt:

aircrack-ng -w rockyou.txt -b F4:28:53:1A:2C:9E capture-01.cap

Evil twin. Configured the WiFi Pineapple to broadcast an AP with the identical SSID and a stronger signal, no encryption, sitting between my test client and the internet. Test devices with the network saved reconnected to it automatically with no prompt, no certificate warning, nothing that would tip off a normal user.

Impact

Two separate weaknesses, both real: a crackable passphrase turns a captured handshake into a working key in the time it takes a wordlist to run, and client devices trust an SSID string more than they trust anything about the network actually presenting it. An evil twin in a cafe or an office lobby would catch anyone whose device remembers the real network’s name.

Remediation

• Move to WPA3-SAE on hardware that supports it — it’s not vulnerable to this style of offline handshake crack.
• Enable 802.11w (Management Frame Protection) so deauth frames are rejected outright.
• Disable auto-reconnect for open or previously-seen SSIDs where the client can be configured to require confirmation.
• User-facing: an evil twin is invisible without inspecting BSSID/signal anomalies, so this is a control problem, not a training problem — MFP and SAE close it structurally.