How WifiPhisher Works ?

WifiPhisher

Wifiphisher can be run with or without any parameters or options. To run the tool without setting any parameters, simply type wifiphisher or python bin/wifiphisher in the terminal.

The tool searches for the corresponding Wi-Fi interface and opens in GUI mode.

Once the GUI is open, the tool searches for available Wi-Fi networks (ESSID) in the vicinity. The target ESSID can be selected using the up / down arrow keys.

As mentioned earlier, the tool is capable of performing all modern MITM WiFi attacks. KARMA and Evil Twin are Wifiphisher’s default attack modes.

Evil Twin attack can be performed by running the tool with the following command parameters.

wifiphisher -aI wlan0 -jI wlan1 -p firmware-upgrade --handshake-capture handshake.pcap

The above command uses the wlan0 interface as a rogue access point that victims can connect to. Wlan1 with the –jI flag is used to launch a denial of service (DoS) attack. A DoS attack prevents users from connecting to a real access point.

A firmware update option is displayed for users to enter a Wi-Fi key to connect and update (fake) firmware. The handshake argument to the command verifies the authenticity of the user-supplied key.

Wifiphisher isn’t limited to stealing WiFi credentials. It can be used to inject malicious code/malware into the victim’s machine using a plugin update script.

wifiphisher --essid Office_Wifi -p plugin_update -pK <Pre-shared Key>

The above command sends the plugin update parameter to an ESSID named Office_Wifi. In this scenario, the attacker knows the Wi-Fi key (preshared key).

Victims performing the plugin update task are actually downloading malicious code onto their machines. The code could be malware or a shell that could provide an attacker with remote access.

Likewise, Wifiphisher can also be used to steal the credentials of social media users.

wifiphisher --noextensions --essid "Free wifi" -p oauth-login -kB

The above command asks users to connect to the free Wi-Fi ESSID by entering their social account credentials such as FB.

Hope you learn something from this tutorial.