Evil Twin and Captive Portal Attacks
Set up a rogue AP to perform evil twin attacks and credential harvesting via fake captive portals.
Evil Twin and Captive Portal Attacks is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Evil Twin Overview
An evil twin is a rogue access point broadcasting the same SSID as a legitimate network. Clients connecting to it send all traffic through the attacker, enabling credential harvesting, traffic interception, and phishing.
How Clients Choose APs
Wi-Fi clients connect to the known SSID with the strongest signal and matching security parameters. By broadcasting at higher power (or deauthing clients from the legitimate AP), an evil twin can attract connections.
Creating a Rogue AP with Hostapd
Hostapd creates a software access point. Combined with DHCP (dnsmasq) and iptables NAT, it provides a functional access point that routes traffic and enables interception.
# hostapd.conf:
interface=wlan0
driver=nl80211
ssid=TargetNetwork
channel=6
hw_mode=g
# Start AP
hostapd hostapd.conf
# Start DHCP
dnsmasq --interface=wlan0 \
--dhcp-range=192.168.10.100,192.168.10.200,12hUsing airbase-ng
airbase-ng (part of aircrack-ng suite) creates rogue APs directly from monitor mode interface — simpler for basic evil twin setups.
# Create open evil twin
airbase-ng -e "TargetNetwork" -c 6 wlan0mon
# Create WPA2 evil twin (same key as legitimate)
airbase-ng -e "TargetNetwork" -z 4 -W 1 -c 6 wlan0monCaptive Portal Attack
A captive portal is a web page that intercepts all HTTP traffic and presents a login page — commonly seen in hotels/airports. Attackers create rogue captive portals that harvest credentials or Wi-Fi passwords.
Wi-Fi Phishing with WiFi-Pumpkin / Wifiphisher
Automated tools create complete evil twin environments with captive portals designed to look like legitimate router configuration pages or ISP login pages.
# Wifiphisher
sudo wifiphisher --essid "TargetNetwork"
# Phishing scenarios:
# - Router firmware upgrade page (harvests Wi-Fi PSK)
# - OAuth login (harvests credentials)
# - Browser plugin update (delivers malware)SSL Stripping
Evil twin attacks traditionally relied on SSL stripping (sslstrip) to downgrade HTTPS to HTTP. Modern HSTS and HSTS preloading largely defeated this — but unvisited or non-HSTS sites remain vulnerable.
# Historical sslstrip approach:
# iptables REDIRECT port 80
# sslstrip intercepts and downgrades HTTPS to HTTP
# Modern defense: HSTS preload list
# Sites listed are HTTPS-only in browsers
# Cannot be strippedCapturing Credentials via Evil Twin
With a rogue AP and Wireshark or Bettercap, capture all cleartext HTTP credentials, DNS queries revealing visited sites, and unencrypted application protocols (FTP, SMTP, POP3).
# Bettercap for MitM
bettercap -iface wlan0
# In bettercap console:
net.probe on
net.sniff on
https.proxy on
arp.spoof onDeauth Support for Evil Twin
Force clients to your evil twin by continuously sending deauth frames to disconnect them from the legitimate AP. They reconnect to the strongest signal — your rogue AP.
Detecting Evil Twin Attacks
Defenders detect evil twins via: WIDS (Wireless Intrusion Detection Systems) checking for duplicate SSIDs on different BSSIDs, signal anomalies, and clients using certificate-based WPA2-Enterprise (immune to PSK evil twins).
Defenses
Prevent evil twin: use WPA2/WPA3-Enterprise (EAP-TLS) — even connecting to a rogue AP requires a valid certificate; enable 802.11w PMF; use a corporate VPN that auto-connects when off trusted networks; deploy WIDS for AP monitoring.
Quick Check
Why does WPA2-Enterprise with EAP-TLS prevent evil twin credential harvesting?
Summary: Evil Twin and Captive Portal
Evil twin attacks exploit clients trusting SSIDs over cryptographic identity. A rogue AP with a matching name can intercept traffic, harvest credentials via captive portals, and perform MitM attacks. Defense requires mutual authentication (EAP-TLS certificates), corporate VPNs, and WIDS monitoring — not just strong Wi-Fi passwords.
Frequently asked questions
Is the “Evil Twin and Captive Portal Attacks” lesson free?
Yes — the full text of “Evil Twin and Captive Portal Attacks” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Evil Twin and Captive Portal Attacks”?
Set up a rogue AP to perform evil twin attacks and credential harvesting via fake captive portals. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Evil Twin and Captive Portal Attacks” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- 802.11 Security Protocols: WEP, WPA2, WPA3
- WPA2 Handshake Capture and Cracking
- Evil Twin and Captive Portal Attacks
- Enterprise Wi-Fi: EAP and RADIUS