# Rogue Access Points

> Stand up evil twin and KARMA rogue APs with hostapd-mana, force clients to associate, and intercept their traffic.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/rogue-access-points
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

A rogue access point impersonates a legitimate network to lure clients into connecting to attacker-controlled infrastructure. PEN-210 covers standing up evil twins and KARMA-style rogue APs, forcing clients off the real network, and intercepting their traffic once they associate. These attacks target the client rather than the AP, exploiting the fact that devices trust an SSID by name and will happily reconnect to a spoofed one.

## Evil Twin Access Points

An evil twin clones a target AP's ESSID (and often its BSSID and channel) so clients cannot tell the difference. Using hostapd-mana with a DHCP server (dnsmasq) creates the fake AP; deauthenticating clients from the legitimate AP with aireplay-ng pushes them onto the twin. With IP forwarding enabled, all victim traffic flows through your machine for interception.

## KARMA Attacks

KARMA abuses the preferred-network-list behavior of clients that actively probe for networks they have joined before. hostapd-mana answers those probes for any requested SSID, so a client looking for a trusted network associates to the rogue AP automatically, no deauthentication needed. After association, traffic interception proceeds as with an evil twin.

## Study material

- [Evil Twin AP with hostapd-mana and Aireplay-ng](https://hackindex.io/platforms/wireless/exploitation/evil-twin-ap-with-hostapd-mana-and-aireplay-ng.md) (read, core)
- [KARMA Known-Network Attack with hostapd-mana](https://hackindex.io/platforms/wireless/exploitation/karma-known-network-attack.md) (read, core)