# Wireless Evil Twin

> Stand up a rogue/evil-twin access point to harvest credentials — WPA2-Enterprise PEAP-MSCHAPv2 challenge/response and captive-portal capture. Load on an authorized wireless engagement targeting WPA-Enterprise (802.1X) or a portal-based network. Signals: PEAP/EAP/802.1X, RADIUS, "enterprise Wi-Fi", eaphammer/hostapd-wpe in play, a captive portal, corporate SSID with per-user logins.

- Skill: `noorqureshi/wireless-evil-twin` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/wireless-evil-twin`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/wireless-evil-twin/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/wireless-evil-twin

---


# Evil-twin / rogue AP (enterprise credential harvesting)

## When it applies
An authorized assessment of a WPA2-**Enterprise** (802.1X) network, or a captive-portal Wi-Fi, where
clients can be lured to a look-alike AP. `pentest`-only, in-scope SSIDs recorded in `scope.txt`, and
coordinated so you only capture *test/consenting* users' credentials per RoE.

## Why it works
WPA2-Enterprise authenticates users to a RADIUS server, but many clients don't properly validate the
RADIUS server's certificate. A rogue AP advertising the same SSID can complete enough of the
PEAP-MSCHAPv2 exchange to capture each user's username + MSCHAPv2 challenge/response, which cracks
offline to the domain password. Captive portals simply hand you the credentials the user types.

## Method
1. **Profile the target** (`wireless-wpa2-attacks` recon): SSID, the EAP type (PEAP/EAP-TTLS), and
   whether clients validate the server cert (they often don't).
2. **Stand up the evil twin.** `eaphammer` (or `hostapd-wpe`):
   `eaphammer --cert-wizard` then
   `eaphammer -i wlan0 --essid <SSID> --creds` — advertises the SSID and runs a rogue RADIUS that
   logs credentials.
3. **Lure clients** — same SSID (and, per RoE, a stronger signal / brief targeted deauth of the real
   AP to prompt roaming). Keep disruption minimal and in-scope.
4. **Capture & crack** the PEAP-MSCHAPv2 username + challenge/response:
   `hashcat -m 5500 netntlm.txt wordlist` (or `asleap`) → domain password.
5. **Captive-portal variant** — clone the portal page on the rogue AP to capture typed creds
   directly; disclose per the SE guardrails in `social-eng-methodology`.
6. **Pivot** — validated creds feed `network-password-spraying`, VPN/OWA access, and AD work.

## Gotchas
- **You're capturing real people's credentials** — this is human-adjacent: only in-scope SSIDs,
  coordinate with the client, minimize capture, and protect/destroy what you collect per RoE (treat
  like `social-eng` data discipline).
- **Cert validation defeats it** — clients that properly pin/validate the RADIUS cert won't leak;
  that's the positive finding (report "clients validate the server cert").
- **Deauth/luring can be disruptive and out of RoE** — confirm before forcing roaming.
- **MSCHAPv2 capture format** must match hashcat `-m 5500` exactly — use the tool's emitted format.
- **Legal line** — capturing enterprise creds without explicit authorization is illegal; stop if
  scope is unclear (`tradecraft-scope-roe`).

## Verify success
Captured PEAP-MSCHAPv2 credentials that crack to a working domain password (or portal creds that
authenticate) — for in-scope, authorized users only, with a "clients don't validate the RADIUS cert"
root cause for the report.

## References
`eaphammer` / `hostapd-wpe` docs; hashcat mode 5500; PEAP-MSCHAPv2 weaknesses. Data discipline:
`social-eng-methodology`; follow-on: `network-password-spraying`.