TUTORIALS Wifiphisher
Evil twins & honeypots
Nate Drake demonstrates how easy it is to set up rogue wireless networks to trick users into connecting. Penetration testers beware!
OUR EXPERT
Nate Drake is a technology journalist specialising in cybersecurity. His latest hacking attempt backfired spectacularly, when he accidentally reprogrammed his smart toaster to burn bread to cinders. The fire rises.
If you’re serious about becoming a penetration tester or want to test the security of your own I systems, you should practise red team testing. This cybersecurity practice involves simulating real-world cyberattacks against an organisation’s system to check how well protected it is. These attacks are as real as possible, so use similar tools and equipment to those deployed by cybercriminals.
The difference is that you do it with the permission of the network owner to find ways to fix flaws in their security setup – not exploit them for your own gain.
Wifiphisher offers an excellent way to do this, as it can set up rogue access points. Bad actors often use these honeypot networks to convince unsuspecting users to connect, so their credentials can be harvested. In this guide, we’ll explore how to set up and use Wifiphisher to run penetration tests on your networks.
To use Wifiphisher’s most basic features, you need a wireless adaptor that supports AP (Access Point) mode. The Panda N600 USB Wi-Fi adaptor that we reviewed in LXF327 is perfect for this purpose.
Although Wifiphisher can run on most versions of Linux, it’s optimised for Kali, so we recommend you set this up in a dedicated virtual machine first