Fake AP

What is a fake access point?
Basically, a fake AP is an AP that looks normal to users and doesn't have encryption on it, so people can
connect without having to enter a key. It's an open network, and it should have an internet connection
to attract people to it. Why would we create a fake AP? Well, if we create one, we will attract a large
number of people to connect to the network and access the internet. They will log in to their accounts,
and we can use packet sniffing to capture anything that they log. (Z. Habih July 31,2018 ) Hackers need
impatient web users to pull off an evil twin attack. Unfortunately, plenty of us fall into this category.
When we go into a public space, such as a library or a coffee shop, we expect that establishment to offer
free and fast WiFi. In fact, reporters even rank businesses by their connection speeds.
But that speed and convenience come with a cost. Hackers can quickly take over a safe-seeming WiFi
connection and see (or steal) anything users do online.
An attack typically works like this:
Step 1: Set up an evil twin access point.

A hacker looks for a location with free, popular WiFi. The hacker takes note of the Service Set Identifier
(SSID) name. Then, the hacker uses a tool like a WiFi Pineapple to set up a new account with the same
SSID. Connected devices can't differentiate between legitimate connections and fake versions.
Step 2: Set up a fake captive portal.

Before you can sign in to most public WiFi accounts, you must fill in data on a generic login page. A
hacker will set up an exact copy of this page, hoping that they will trick the victim into offering
up authentication details. Once the hacker has those, they can log in to the network and control it.
Step 3: Encourage victims to connect to the evil twin WiFi.

The hacker moves close to victims and makes a stronger connection signal than the valid version. Anyone
new will only see the evil twin, and they will tap and log in. The hacker can kick off anyone currently
connected with a distributed denial of service (DDoS) attack, which temporarily takes the valid server
offline and prompts mass logins.
Step 4: The hacker steals the data.

Anyone who logs in connects via the hacker. This is a classic man-in-the-middle attack, which allows the
attacker to monitor anything that happens online. If the user logs into something sensitive (like a bank
account), the hacker can see all the login details and save them for later use.
Customer participation is critical in an evil twin WiFi attack. And unfortunately, only about half of all
consumers think they're responsible for securing their data on a public WiFi account. Most think the
companies that offer connections will protect them. The companies may disagree. (Okta February 14,
2023)
Scenario (fake AP)
Why would someone want to sit between customers and websites? Let's walk through two examples of
how hackers might use data like this.
Let's imagine a hacker sitting inside a connection at a local coffee shop:
The setup is successful. The hacker has created an evil twin network, and one person logs in.
The attack begins. The victim has no idea that the connection is not secure. They head to a banking page
and log in. They then agree to transfer $100 to a friend.
The hacker transforms the data. The hacker intercepts the request and changes the recipient to an
account that they own. The bank processes the transaction and sends a receipt. The hacker changes that
receipt, so the victim thinks the back just completed the original work.
Let's imagine another version of this same attack.
The setup is successful. The hacker has created an evil twin network, along with a phishing site.
The connection initiates. The victim must log in to this phishing site to gain access. The person might
believe they're logging into a common site, like Facebook or Google. But instead, they're connecting with
a hacker.
The hacker steals the target data. The hacker can see the victim's login data and save it. The hacker can
use that login to steal funds, or the hacker can sell credentials to buyers on the black market.
The hacker releases the victim. The hacker disconnects the victim. The next login is valid, and the victim
has no idea anything went wrong.
An attack like this can be remarkably profitable. And it's almost impossible for victims to spot the
problems as they unfold. (Okta February 14, 2023)
Tcpdump
Tcpdump is a command line utility that allows you to capture and analyze network traffic going through
your system. It is often used to help troubleshoot network issues, as well as a security tool. A powerful
and versatile tool that includes many options and filters, tcpdump can be used in a variety of cases. Since
it's a command line tool, it is ideal to run in remote servers or devices for which a GUI is not available, to
collect data that can be analyzed later. It can also be launched in the background or as a scheduled job
using tools like cron. (Ricardo G. September 1, 2020)
1. BASIC COMMUNICATION
Just see what’s going on, by looking at all interfaces.
# tcpdump -i any
2. SPECIFIC INTERFACE
Basic view of what’s happening on a particular interface.
# tcpdump -i eth0
3. RAW OUTPUT VIEW
Verbose output, with no resolution of hostnames or port numbers, absolute sequence numbers, and
human-readable timestamps.
# tcpdump -ttttnnvvS
4. FIND TRAFFIC BY IP
One of the most common queries, this will show you traffic from 1.2.3.4, whether it’s the source or the
destination.
# tcpdump host 1.2.3.4
5. SEEING MORE OF THE PACKET WITH HEX OUTPUT
Hex output is useful when you want to see the content of the packets in question, and it’s often best
used when you’re isolating a few candidates for closer scrutiny.
# tcpdump -nnvXSs 0 -c1 icmp (The Geek Diary 2023)
Scenario (tcpdump)
Save Capture Data to a File
If you want to save the capture data for reference purposes, tcpdump is there to help you out. Just pass
the -w flag with the default command to write the output to a file instead of displaying it on the screen.
tcpdump --interface any -c 10 -w data.pcap
The .pcap file extension stands for packet capture data. You can also issue the aforementioned command
in verbose mode using the -v flag.
tcpdump --interface any -c 10 -w data.pcap -v
To read a .pcap file using tcpdump, use the -r flag followed by the file path. The -r stands for Read.
tcpdump -r data.pcap
You can also filter network packets from the packet data saved in the file.
tcpdump -r data.pcap port 80 (Deepesh S. April 12, 2021)

HTTPeek displays all images, urls, cookies, and post data sent in plaintext by clients connected to the Wifi
Pineapple.
Features:
Display images, urls, cookies, and post data on a web page.
Start/Stop capturing
Start/Stop live updating (n3wbie September 16,2020)

Learn Ethical Hacking from Scratch: Your Stepping Stone to Penetration Testing book by Zaid Sabih
https://www.okta.com/identity-101/evil-twin-attack/
https://opensource.com/article/18/10/introduction-tcpdump
https://www.thegeekdiary.com/18-practical-tcpdump-command-examples-a-network-sniffer-tool-
primer/
https://www.makeuseof.com/tcpdump-examples/
https://forums.hak5.org/topic/53111-module-httpeek/

Fake AP

Uploaded by

Copyright:

Available Formats

Fake AP

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Fake AP

Uploaded by

Copyright:

Available Formats

What is a fake access point?

An attack typically works like this:

Step 1: Set up an evil twin access point.

Step 2: Set up a fake captive portal.

Step 3: Encourage victims to connect to the evil twin WiFi.

Step 4: The hacker steals the data.

Scenario (fake AP)

Let's imagine another version of this same attack.

Just see what’s going on, by looking at all interfaces.

Basic view of what’s happening on a particular interface.

3. RAW OUTPUT VIEW

# tcpdump host 1.2.3.4

5. SEEING MORE OF THE PACKET WITH HEX OUTPUT

# tcpdump -nnvXSs 0 -c1 icmp (The Geek Diary 2023)

Save Capture Data to a File

tcpdump --interface any -c 10 -w data.pcap -v

tcpdump -r data.pcap port 80 (Deepesh S. April 12, 2021)

Display images, urls, cookies, and post data on a web page.

Start/Stop live updating (n3wbie September 16,2020)

You might also like