A human is the weakest link in cyber security and tools like Wifiphisher cement the fact. This tool exploits this weak link by launching a social-engineering attack leading the user to a phishing page and then you can get the users password or install your stuff.
What is Wifiphisher?
Wifiphisher is an open source security tool, coded in Python that helps you execute speedy and automated phishing attacks against wireless/WiFi networks to discover credentials and install malware. Since this method does not include brute forcing for credentials, it is an easy way for obtaining credentials, install backdoors or WPA/WPA2 pre-shared keys. How does it do this?
- Wifiphisher de-authenticates the user from their legitimate access point by continuously transmitting “deauthenticate” or “disassociate” packets to try and tear down existing associations.
- It then allows the user to authenticate to your evil twin, which is a sniffed identical copy of their access point waiting for the user to connect and all HTTP requests from the user are forwarded to an attacker-controlled phishing page.
- Wifiphisher then offer a phished webpage to the user on a man-in-the-middle kind of proxy. It can be a webpage that will notify the user that an firmware upgrade was completed and will ask them to authenticate again or will present your malware.
- At this point, either the malware will have executed, or the WiFi password is passed on to you, while the user will continue browsing the web not knowing what happened!
Wifiphisher supported phishing scenarios:
Wifiphisher supports community-built templates for different phishing scenarios. Currently, the following phishing scenarios are in place:
- Firmware Upgrade Page: A router configuration page without logos or brands asking for WPA/WPA2 password due to a firmware upgrade. It is mobile-friendly.
- OAuth Login Page: A free Wi-Fi Service asking for Facebook credentials to authenticate using OAuth.
- Browser Plugin Update: A generic browser plugin update page that can be used to serve payloads to the victims.
- Network Manager Connect: Imitates the behavior of the network manager. This template shows Chrome’s “Connection Failed” page and displays a network manager window through the page asking for the pre-shared key. Currently, the network managers of Windows and MAC OS are supported.
- For specific target-oriented attacks, custom scenarios may be necessary. Creating such custom phishing scenarios is easy. Refer here for more customizations.
This open source Python script works on operating systems such as Kali Linux, Ubuntu, Arch Linux and is licensed under the GPL license. You also need a wireless network adapter that supports Monitor mode and is capable of injection.
Download Wifiphisher v1.2 here.