DDos Frameworks information gathering tool Vulnerability scanner

Wifiphisher: Phishing Attack Against WiFi

Written by Mubassir patel



Wifiphisher is a security tool that mounts automated victim-customized phishing attacks against WiFi clients in order to obtain credentials or infect the victims with malware. Wifiphisher is primarily a social engineering attack that unlike other methods it does not include any brute forcing. It is an easy way for obtaining credentials from captive portals. we can also hack WPA password using evil twin attack using eviltwin tool.

How it works

After achieving a man-in-the-middle position using the Evil Twin or KARMA attack, Wifiphisher redirects all HTTP requests to an attacker-controlled phishing page.

From the victim’s perspective, the attack makes use in three phases:

  1. A client being authenticated from her access point.
  2.  Wifiphisher sniffs the area and copies the target access point’s settings. It then creates a rogue wireless access point that is modeled by the target. It also sets up a NAT/DHCP server and forwards the right ports. Consequently, because of the jamming, clients will eventually start connecting to the rogue access point.
  3. A victim is being served a realistic specially-customized phishing page. Wifiphisher employs a minimal web server that responds to HTTP & HTTPS requests. As soon as the victim requests a page from the Internet, wifiphisher will respond with a realistic fake page that asks for credentials or serves malware.


Following are the requirements for getting the most out of Wifiphisher:

  • Kali Linux
  • One wireless network adapter that supports AP & Monitor mode and is capable of injection. For advanced mode, you need two cards; one that supports AP mode and another that supports Monitor mode. Drivers should support netlink.


To install the latest development version type the following commands:

git clone https://github.com/wifiphisher/wifiphisher.git # Download the latest revision
cd wifiphisher # Switch to tool's directory
sudo python setup.py install # Install any dependencies (Currently, hostapd, dnsmasq, PyRIC, blessings)


Run the tool by typing wifiphisher or python bin/wifiphisher (from inside the tool’s directory).

By running the tool without any options, it will find the right interfaces and interactively ask the user to pick the ESSID of the target network (out of a list with all the ESSIDs in the around area) as well as a phishing scenario to perform. By default, the tool will perform both Evil Twin and KARMA attacks.

wifiphisher  firmware Upgrade

wifiphisher -aI wlan0 -jI wlan4 -p firmware-upgrade --handshake_capture handshake.pcap

Use wlan0 for spawning the rogue Access Point and wlan4 for DoS attacks. Select the target network manually from the list and perform the “Firmware Upgrade” scenario. Verify that the captured Pre-Shared Key is correct by checking it against the handshake in the handshake.pcap file.

Useful for manually selecting the wireless adapters. The “Firmware Upgrade” scenario is an easy way for obtaining the PSK from a password-protected network.

wifiphisher --essid CONFERENCE_WIFI -p plugin_update -pK s3cr3tp4ssw0rd

Automatically pick the right interfaces. Target the Wi-Fi with ESSID “CONFERENCE_WIFI” and perform the “Plugin Update” scenario.  PSK “s3cr3tp4ssw0rd”.

wifiphisher --nojamming --essid "FREE WI-FI" -p oauth-login

Do not target any network. Simply spawn an open Wi-Fi network with ESSID “FREE WI-FI” and perform the “OAuth Login” scenario.

Simple Explanation:

Short form Long form Explanation
-h –help show this help message and exit
-jI JAMMINGINTERFACE –jamminginterface JAMMINGINTERFACE Manually choose an interface that supports monitor mode for deauthenticating the victims. Example: -jI wlan1
-aI APINTERFACE –apinterface APINTERFACE  supports AP mode for spawning an AP. Example: -aI wlan0
-nJ –nojamming Skip the deauthentication phase. When this option is used, only one wireless interface is required
-e ESSID –essid ESSID Enter the ESSID of the rogue Access Point. This option will skip Access Point selection phase. Example: –essid ‘Free WiFi’
-p PHISHINGSCENARIO –phishingscenario PHISHINGSCENARIO Choose the phishing scenario to run.This option will skip the scenario selection phase. Example: -p firmware_upgrade
-pK PRESHAREDKEY –presharedkey PRESHAREDKEY Add WPA/WPA2 protection on the rogue Access Point. Example: -pK s3cr3tp4ssw0rd
-qS –quitonsuccess Stop the script after successfully retrieving one pair of credentials.
-lC –lure10-capture Capture the BSSIDs of the APs that are discovered during AP selection phase. This option is part of a Lure10 attack.
-lE LURE10_EXPLOIT –lure10-exploit LURE10_EXPLOIT Fool the Windows Location Service of nearby Windows users to believe it is within an area that was previously captured with –lure10-capture. Part of the Lure10 attack.
-iAM –mac-ap-interface Specify the MAC address of the AP interface. Example: -iAM 38:EC:11:00:00:00
-iDM –mac-deauth-interface jamming interface. Example: -iDM E8:2A:EA:00:00:00
-iNM –no-mac-randomization Do not change any MAC address.
-hC –handshake-capture Capture of the WPA/WPA2 handshakes for verifying passphrase. Example: -hC capture.pcap
-dE –deauth-essid Deauth all the BSSIDs having same ESSID from AP selection or the ESSID given by -e option.
–logging  logging.
–payload-path Enable the payload path. Intended for use with scenarios that serve payloads.


Targeting an access point



About the author

Mubassir patel

Mubassir is a founder and developer of this site. He is a computer science engineer. He has a very deep interest in ethical hacking, penetration testing, website development and including all technology topic.

Leave a Comment