Typorithm · hard

Evil Twin & WPS

wifi-attackspentestevil-twinwpsrogue-ap

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Evil Twin & WPS

Wireless

A rogue or evil-twin access point mimics a legitimate SSID to capture credentials during an authorized red-team test. WPS PIN attacks (reaver) can recover the WPA key on vulnerable routers. The defenses are disabling WPS, using WPA2/3-Enterprise, and wireless intrusion detection for rogue APs.

An evil twin is a rogue access point that broadcasts the same SSID as the client's real network. Devices that auto-connect to the stronger or familiar signal can be lured into the attacker's AP, where credentials and traffic are captured. This is only done inside an authorized red-team engagement against networks the client owns.

WPS (Wi-Fi Protected Setup) adds a separate weakness: reaver -i wlan0mon -b AA:BB:CC brute-forces the AP's 8-digit WPS PIN. Because the PIN is checked in two halves and the last digit is a checksum, the effective space is tiny, so a vulnerable router yields its WPA passphrase in hours.

Both attacks have clear defenses. Disable WPS entirely, move to WPA2/3-Enterprise (802.1X) so there is no shared key or PIN to harvest, and deploy a wireless intrusion detection system that flags rogue APs broadcasting your SSIDs. Every finding in the report pairs the attack with the matching control.

Evil twin = rogue AP mimicking the client SSID.

reaver brute-forces a weak WPS PIN to recover the key.

Defenses: disable WPS, WPA2/3-Enterprise, rogue-AP detection.

# evil twin: rogue AP mimics the client SSID (authorized)
reaver -i wlan0mon -b AA:BB:CC
# WPS PIN brute force
# defense: WPA2/3-Enterprise + rogue-AP detection

Read the implementation

Connect each part of the code to the concept before you type.

1. Evil twin idea

A rogue AP broadcasts the client's own SSID to lure devices and capture credentials — done only inside an authorized red-team scope.

# evil twin: rogue AP mimics the client SSID (authorized)

2. WPS PIN attack

reaver brute-forces the WPS PIN of the in-scope AP; on vulnerable routers it recovers the WPA passphrase from the PIN.

reaver -i wlan0mon -b AA:BB:CC

3. Why WPS is weak

WPS's 8-digit PIN is validated in two halves, shrinking the search space so it can be brute-forced in hours.

# WPS PIN brute force

4. The defenses

Disabling WPS, moving to WPA2/3-Enterprise, and running wireless intrusion detection for rogue APs blocks both attacks.

# defense: WPA2/3-Enterprise + rogue-AP detection

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.