OSWP · Module 11

Rogue Access Points

Stand up evil twin and KARMA rogue APs with hostapd-mana, force clients to associate, and intercept their traffic.

~2 h 2 resources Last updated September 27, 2026

A rogue access point impersonates a legitimate network to lure clients into connecting to attacker-controlled infrastructure. PEN-210 covers standing up evil twins and KARMA-style rogue APs, forcing clients off the real network, and intercepting their traffic once they associate. These attacks target the client rather than the AP, exploiting the fact that devices trust an SSID by name and will happily reconnect to a spoofed one.

Evil Twin Access Points

An evil twin clones a target AP's ESSID (and often its BSSID and channel) so clients cannot tell the difference. Using hostapd-mana with a DHCP server (dnsmasq) creates the fake AP; deauthenticating clients from the legitimate AP with aireplay-ng pushes them onto the twin. With IP forwarding enabled, all victim traffic flows through your machine for interception.

KARMA Attacks

KARMA abuses the preferred-network-list behavior of clients that actively probe for networks they have joined before. hostapd-mana answers those probes for any requested SSID, so a client looking for a trusted network associates to the rogue AP automatically, no deauthentication needed. After association, traffic interception proceeds as with an evil twin.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Mark Evil Twin AP with hostapd-mana and Aireplay-ng as done

Guide 2 min read
Evil Twin AP with hostapd-mana and Aireplay-ng
Focus on #Gather Target AP Information #Create the hostapd-mana Configuration #Set Up DHCP with dnsmasq #Start the Evil Twin AP with hostapd-mana #Deauthenticate Clients from the Legitimate AP #Enable IP Forwarding for Traffic Interception
Mark KARMA Known-Network Attack with hostapd-mana as done

Guide 6 min read
KARMA Known-Network Attack with hostapd-mana
Focus on #How the KARMA Attack Works #Setting Up hostapd-mana for KARMA #DHCP and Network Setup #Launching KARMA with hostapd-mana #Traffic Interception After Association #WiFi-Pumpkin3 as Alternative