Evil Twin AP with hostapd-mana and Aireplay-ng

An evil twin AP impersonates a legitimate access point by broadcasting the same SSID and BSSID on a stronger or equivalent signal. Clients that disconnect from the legitimate AP and reconnect to the evil twin send their traffic through the attacker's system. Combined with a captive portal or transparent proxy, this enables credential capture, traffic interception, and SSL stripping against connected clients.

This page covers setting up the evil twin AP itself and forcing clients onto it. Captive portal credential harvesting is covered on the next page.

Gather Target AP Information

Before setting up the evil twin, collect the exact SSID, BSSID, channel, and encryption type from the target:

Create the hostapd-mana Configuration

For a WPA2 Personal evil twin, configure hostapd-mana to broadcast the same SSID on the target channel. Use a second wireless interface (wlan1) for the AP so wlan0 remains free for deauthentication:

mana_loud=1 enables loud mode which actively probes for clients searching for the target SSID, improving the chance clients connect to the evil twin over the legitimate AP. The wpa_passphrase here is a placeholder — if the goal is to capture the actual WPA handshake for cracking rather than traffic interception, the client will fail to authenticate but still produce a capturable handshake attempt.

For an open evil twin that accepts all connections without a passphrase:

Set Up DHCP with dnsmasq

Clients need an IP address after connecting. Assign a static IP to the AP interface first, then run dnsmasq to serve DHCP:

Start the Evil Twin AP

Deauthenticate Clients from the Legitimate AP

Use the first adapter in monitor mode to force clients off the legitimate AP and onto your evil twin:

Stop the deauth once clients start connecting to the evil twin. Continuous deauth prevents reconnection entirely — send a burst then stop and observe.

Enable IP Forwarding for Traffic Interception

To pass connected client traffic through to the internet while intercepting it:

Replace eth0 with your internet-connected interface. Once IP forwarding is active, connected clients have internet access through your machine and all their traffic passes through it. Use Wireshark, tshark, or bettercap on wlan1 to capture and analyse the traffic.