MITM/Wireless: Difference between revisions

From charlesreid1
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
==Overview of Wifi Networks==
Man in the middle attacks on wireless networks.


Let's talk for a moment about how wifi networks work.
=How Wireless Networks Work=


===Basic Wifi Network Architecture===
Wireless networks (Wi-Fi) operate on a shared radio medium governed by the 802.11 protocol suite. Unlike wired networks where each host has a dedicated physical connection to a switch port, wireless clients share the same airspace — every station within range can hear every transmission on a given channel.


The basic architecture is a single gateway node on a local wireless network, with multiple clients connected through wireless connections. As the clients generate web/other traffic, that traffic is passed between the router and the client in the form of packets. Each packet is transmitted as a radio signal. The packets have a header, which (like the envelope of a letter) contains publicly-readable routing information. The packets also have a payload, which is encrypted (more on that in a moment).
== Association and Authentication ==


===What Eavesdroppers Can See===
A client joins a wireless network through a multi-step process:


TLDR: Layer 1 and Layer 2 are completely visible to an eavesdropper
# '''Probing''': The client broadcasts ''probe request'' frames asking for known SSIDs. The access point (AP) replies with ''probe response'' frames.
# '''Authentication''': A lightweight 802.11 authentication exchange (distinct from WPA/WPA2 authentication — this is a legacy handshake that is essentially a no-op for open networks and a formality for encrypted networks).
# '''Association''': The client sends an ''association request''; the AP responds with an ''association response''. The client is now a station on the BSS (Basic Service Set).
# '''Key exchange''': For WPA/WPA2 networks, the 4-way handshake negotiates encryption keys using the pre-shared key (PSK). For WPA3, Simultaneous Authentication of Equals (SAE) replaces the PSK-based handshake.


If I were a nefarious eavesdropper and I moved in next door, I would be perfectly capable of using a radio antenna to see all of those packets being transmitted. I could read the headers, which contain publicly-readable routing information, and get MAC addresses of nearby devices and a picture of which devices are talking to which.
== The Trust Problem ==


This is quite a bit of information - MAC addresses are tied to manufacturers, equipment can be used to triangulate positions, and you can get a very clear picture of which clients are talking to which devices and where simply by using publicly-broadcast information.
802.11 management frames — probes, beacons, authentication, and association — are '''unauthenticated and unencrypted''' by default. Any device can transmit a beacon claiming to be any SSID. Any device can respond to any probe request. Any device can send deauthentication frames to any station, using only the MAC address of the AP as the spoofed source.  


This information is obtained by putting the wireless card into "monitor mode." Normally, when a wireless card receives a packet, a microprocessor on board the network card determines whether the packet is intended for the host machine, or for someone else. If intended for someone else, it throws away the packet and the CPU never sees it. In monitor mode, no packets are thrown away, so the wireless card is constantly passing packets it sees on to the CPU, which can then process the packet and aggregate data about wireless network traffic.
This is the root vulnerability that makes wireless MITM attacks possible — and it exists at Layer 2, below the IP/ARP layers that wired MITM attacks must contend with.


===What Eavesdroppers Cannot See===
== Shared Medium, Shared Pain ==


TLDR: Layer 3 and up are completely invisible to an eavesdropper
On a wireless network, the AP broadcasts all frames to all associated stations. Each client's Wi-Fi card is supposed to discard frames not addressed to its MAC. However:


However, an eavesdropper listening to those packets does not get any information about network schema, IP addresses, port numbers, protocols, and so on. All of that information is contained in the packet payload, which is encrypted. Only clients on a particular wireless network, who have the correct WPA passphrase, are able to decrypt packet traffic for that network and see which IP address/port/etc traffic is intended for.
* An attacker can place a wireless card in '''monitor mode''', which disables MAC filtering and passes all observed frames to the CPU. This reveals Layer 1–2 information (MAC addresses, signal strength, probe requests) but '''not''' Layer 3+ payloads — those remain encrypted under the WPA session keys.
* An attacker who knows the network passphrase and captures the 4-way handshake can derive the session keys and decrypt all traffic for that session.
* An attacker already associated with the same AP as the target can use a monitor-mode virtual interface (monitor vif) to capture frames addressed to other stations, though this is lossy and unreliable compared to a true MITM position.


Obtaining this information would require an attacker to move from Layer 1 and Layer 2 (physical device and MAC addresses) to Layer 3 and Layer 4 (Network and Transport protcols). And that requires the eavesdropper to actually join the network. (Hence the way an attack chain works is by starting from physical layers and working on up through the OSI layers.)
Because the medium is shared, wireless MITM attacks operate primarily at '''Layer 2 (802.11 frames)''' rather than Layer 3 (ARP), though ARP spoofing remains useful post-association for controlling traffic flow through the attacker's relay.


===What Network Neighbors Can See===
=Classic Approaches (2000s)=


TLDR: Layer 1 and Layer 2 are completely visible to a network neighbor. Layer 3 is partially visible.
These techniques flourished when WEP was common, WPA2-PSK was emerging, client OSes broadcasted probe requests aggressively, and 802.11w (Protected Management Frames) did not exist.


Now, suppose the nefarious eavesdropper is not a stranger who moves in next door, but your coworker in the next cubicle over. How is information on a wifi network protected among the clients on that network?
== Evil Twin ==


When a router broadcasts packets, the packets contain header information about the destination of that packet. Those packets are broadcast publicly, so everyone can see them, and wireless cards are simply expected to drop packets that are not intended for them. Just as a wifi card will drop any packets coming from wifi networks it is not associated with, a wifi card will also drop any packets coming from the AP that aren't intended for it.
{{Main|MITM/Evil Twin}}


In theory, then, the nefarious coworker who is a network neighbor can either receive and process packets between you and the AP, but with encrypted payloads; or they can receive packets with unencrypted payloads, but their network cards will drop the packets.
The original wireless MITM attack. The attacker creates a rogue access point broadcasting the same SSID as a legitimate network. If the attacker's signal is stronger, or if the legitimate AP is temporarily unavailable, clients may associate with the rogue AP instead.


===What Network Neighbors Can't See===
The classic Evil Twin requires the attacker to know the target SSID in advance. It is a '''targeted''' attack — one SSID, one impersonation. The attacker provides DHCP, DNS, and gateway services to the victim, gaining full control of the network layer.


TLDR: Layer 3 is partially visible, but error-prone. Requires good equipment.
<pre>
Legitimate AP        Rogue AP (Evil Twin)
    |                    |
    |    (deauth)        |
    X <------------------ |  ← Attacker deauths client from legitimate AP
    |                    |
                          | ← Client reconnects to rogue AP
                          |
                    [Attacker relays traffic to internet]
</pre>


Your nefarious coworker, who is also a network neighbor, has a wifi card and is attempting to eavesdrop on your traffic. In theory, the coworker should not be able to see any frames passing between you and the AP - the network card will drop any packets not intended for it.
=== Classic Tools ===


Theoretically, though, it should be possible to turn on a pseudo "monitor mode" for receiving all frames for all clients on a local network. After all, if you've got the network key, that traffic should be passing by in the clear.
* '''airbase-ng''' (part of [[aircrack-ng]]): Creates a rogue AP from a single wireless interface. <code>airbase-ng -e "LegitWiFi" -c 6 wlan0mon</code>
* '''aireplay-ng''': Sends deauthentication frames to kick clients off the legitimate AP.


Monitoring packets at Layer 3, however, is not as simple as monitoring packets at Layer 1 and 2. At higher layers, there are additional layers of encapsulation and encryption, and contents and order of packets becomes more important. Missing or garbled packets can be problematic, and if you're eavesdropping, there's no way to ask the AP to re-transmit packets or data that you missed, as only the client can do that.
== Deauthentication Attack ==


===What Network Neighbors Shouldn't But Could Easily See===
{{Main|Kali/Wireless Reboot}}


TLDR: Layer 3 is partially visible. Requires good equipment.
A deauthentication attack is not a MITM attack on its own — it is the '''enabling technique''' for wireless MITM. The attacker spoofs 802.11 deauthentication frames with the MAC address of the legitimate AP, targeting a specific client or all clients on the network. The client disconnects and begins scanning for a network to rejoin. If a rogue AP with the same SSID is available (and has a stronger signal), the client associates with the attacker.


To truly eavesdrop on someone else on the same network, an attacker either needs to carry out the attack at Layer 3 and 4 (e.g., a network-level ARP spoofing attack) or an interface that can fetch raw 802.11 frames, and do the best it can to decode them.
Because deauthentication frames are management frames, they are '''unauthenticated''' (prior to 802.11w). The attacker only needs the AP's MAC address, which is visible to any monitor-mode interface.


On modern linux systems, and cf80211-based drivers, the 802.11 network card is presented as a wiphy. This is not a network interface, and will not allow you to capture frames - it is a virtual network interface (vif) container. Each different part can assume different modes (managed station, AP, IBSS station, mesh point). usually there is one vif container per network card/per wiphy, but additional vifs may be present.
Classic tool: <code>aireplay-ng -0 0 -a [AP_MAC] -c [CLIENT_MAC] wlan0mon</code> sends continuous deauths.


A monitor vif, which is one type of vif, is a network interface that is an 802.11-with-radiotap device. It will receive as much of the 802.11 frames as it can from the wifi card, and provide those packets to the CPU/kernel. These interfaces allow receiving frames from other stations associated with the same AP. (It can also allow capturing frames from other APs.)
== KARMA ==


Most linux drivers should support monitor vifs. If the driver does it not is probably because the network card is a full MAC wifi interface, and does not provide the vif functionality.
{{Main|Karma}}


==Why You ARP Spoof on Wifi==
KARMA, developed by Dino dai Zovi and Shane Macaulay (~2004–2005), weaponizes the client's own '''probe requests'''. Instead of impersonating a single known SSID (Evil Twin), KARMA listens for probe requests from nearby devices — which broadcast the names of every network they've ever connected to — and responds to '''all of them''', instantly impersonating whatever network each device is looking for.


Let's summarize.  
This is a '''mass-capture''' attack. At a busy airport or conference, dozens of devices can be ensnared simultaneously with zero prior knowledge of their preferred networks.


The motivating question here is: why do you need to ARP spoof on a wifi network? If you and the sheep are both on the same network, and you're both on wifi, and all packets are being broadcast by the AP, why can't you just read all the sheep's traffic in the clear?
=== KARMA Mechanism ===


The reason you need to ARP spoof is because it is the only reliable way of tapping/controlling the communication channel. Normally, 802.11 frames from the AP not intended for you are dropped. While you can disable that behavior, it's also more difficult to process 802.11 frames at Layer 3 without controlling the communication channel (noise/error/etc).
# Attacker places a wireless card in monitor mode and passively captures all probe requests.
# For each probe request received, the attacker's rogue AP immediately transmits a matching beacon frame.
# The client, recognizing a "known" network, automatically associates.
# The attacker provides DHCP/DNS/gateway services.


Vacuuming up raw 802.11 frames to eavesdrop on network neighbors is possible, but will lead to information loss. It is not as effective as a true MITM attack at Layer 3.
Classic tool: '''hostapd-karma''', a modified version of the standard hostapd daemon.
 
== ARP Spoofing on Wireless ==
 
{{Main|MITM/ARP Poisoning}}
 
Once an attacker has joined the same wireless network as the target (whether legitimately or via Evil Twin/KARMA), ARP spoofing works identically to wired ARP spoofing. The shared wireless medium makes it theoretically possible to capture frames addressed to other stations using monitor mode, but this is lossy and unreliable — ARP spoofing ensures the attacker '''controls''' the traffic flow rather than passively sampling it.
 
See [[MITM/Wired]] and [[MITM/ARP Poisoning]] for the full ARP spoofing playbook. Tools: [[arpspoof]], [[Ettercap]], [[Bettercap]].
 
=Modern Approaches (2010s–Present)=
 
Modern wireless MITM is defined by purpose-built hardware platforms, sophisticated probe-response frameworks that defeat passive-scanning countermeasures, and attacks targeting the WPA3 transition.
 
== WiFi Pineapple ==
 
{{Main|Wifi Pineapple}}
 
The [[Wifi Pineapple]] is a dedicated hardware platform by Hak5 that transformed wireless MITM from a multi-tool command-line exercise into a point-and-click operation. Originally released in 2008, it has evolved through seven major hardware revisions (Mark I through Mark VII).
 
The Pineapple integrates KARMA, deauthentication, SSL stripping, captive-portal phishing, and credential harvesting into a single pocket-sized device with a web-based interface. It is the most recognizable wireless penetration testing tool in existence.
 
=== PineAP Suite ===
 
Starting with the Mark V (2014), the Pineapple's attack framework evolved into '''PineAP''', a modular suite that subsumes and extends KARMA:
 
* '''Log Probes''' — Continuously sniffs and logs all probe requests from nearby clients.
* '''PineAP Daemon''' — Responds to probe requests as classic KARMA did, with refined targeting controls.
* '''Dogma''' — Aggressively broadcasts beacons for all previously-seen SSIDs (loud mode).
* '''Beacon Response''' — Responds individually to probes with matching beacons.
* '''Capture''' — Harvests WPA handshake frames for offline cracking.
 
The Pineapple's combination of KARMA, [[SSLStrip]], and a captive-portal engine makes it a complete rogue-AP platform. For full details, see the [[Wifi Pineapple]] page.
 
== MANA (Modified Advanced Next-generation Attack) ==
 
MANA, presented at DEF CON 22 (2014) by Dominic White and Ian de Villiers, extends KARMA to defeat modern OS countermeasures that reduced directed probe request verbosity (iOS, Android, Windows all moved toward passive scanning):
 
* '''Loud Mode''': The rogue AP actively broadcasts beacons for every SSID it has ever seen in any probe request — no client probing needed.
* '''Stealth Mode''': Selectively responds only to SSIDs previously captured, reducing noise and evading WIDS.
* '''EAP Credential Harvesting''': Via the Wireless Pwnage Edition (WPE), captures credentials from devices configured for WPA2-Enterprise networks.
* '''Snoopy''': Device fingerprinting and tracking.
 
Implementation: [https://github.com/sensepost/hostapd-mana hostapd-mana]
 
== Bettercap (WiFi Module) ==
 
{{Main|Bettercap}}
 
Bettercap's WiFi module brings modern, modular MITM to wireless. Capabilities include:
 
* Rogue AP creation with WPA/WPA2 support
* Deauthentication attacks
* PMKID capture for WPA3-incompatible cracking
* Clientless monitoring (passive traffic analysis without joining the network)
* Integrated HTTP/HTTPS proxy for traffic manipulation post-association
 
Example: <code>sudo bettercap -eval "set wifi.interface wlan0; wifi.recon on; wifi.deauth *"</code>
 
== PMKID Attack ==
 
Discovered in 2018 by Jens "atom" Steube (hashcat developer), the PMKID attack exploits a feature of WPA/WPA2 Roaming. When a client attempts to connect, many APs include a '''PMKID''' (Pairwise Master Key Identifier) in the EAPOL frame from the first message of the 4-way handshake — '''before''' the handshake completes. The PMKID is derived from the PMK (which is derived from the passphrase), the AP MAC, the client MAC, and a salt.
 
An attacker can request the PMKID from an AP without any clients present, capture it, and attempt to crack it offline. This is faster than capturing a full 4-way handshake because:
* No client needs to be connected or deauthenticated.
* Only a single frame from the AP is required.
 
Tool: hcxdumptool + hashcat (hash mode 22000).
 
== WPA3 Transition Mode Attacks ==
 
WPA3 mandates SAE (Simultaneous Authentication of Equals), which is resistant to offline dictionary attacks. However, WPA3 networks commonly operate in '''Transition Mode''', where both WPA2-PSK and WPA3-SAE are accepted on the same SSID to support legacy clients.
 
An attacker can:
# Set up a rogue AP broadcasting the target SSID with '''WPA2-only''' support (no WPA3).
# Deauthenticate clients from the legitimate AP.
# Clients reconnect to the rogue AP using WPA2.
# Capture the WPA2 4-way handshake and crack the passphrase offline.
 
This is a '''downgrade attack''' that bypasses WPA3's protections entirely when transition mode is enabled. Tools: airbase-ng, hostapd-wpe, WiFi Pineapple.
 
== Rogue AP with Captive Portal ==
 
A modern evolution of the Evil Twin that adds a '''captive portal''' — a fake login page that mimics the legitimate network's splash screen, a social media login, or a corporate SSO page. When the victim connects, they are presented with the portal and prompted for credentials.
 
Tools: '''wifiphisher''' (automated phishing scenarios), '''Fluxion''' (captive portal + deauth, uses social engineering to obtain the Wi-Fi password itself).
 
== Multi-Channel MITM ==
 
Modern wireless attackers with dual-radio setups (like the WiFi Pineapple Mark VII or a laptop with two wireless adapters) can operate on two channels simultaneously:
 
* '''Radio 1''': Connects to the legitimate AP as a client (upstream internet).
* '''Radio 2''': Hosts the rogue AP for victims (downstream).
 
This eliminates the need for a separate upstream connection (Ethernet, cellular) and makes the attack fully self-contained.
 
=Defenses=
 
== Client-Side ==
 
* '''Disable auto-connect for open networks''': The single most effective OS-level defense against KARMA and Evil Twin. On iOS, Android, Windows, and macOS, toggle "Auto-Join" or "Connect Automatically" off for untrusted networks.
* '''Audit your Preferred Network List (PNL)''': Remove SSIDs for public or one-time networks you no longer use. Every SSID in your PNL is a potential target for KARMA.
* '''Use a VPN''': An always-on VPN encrypts all traffic before it reaches the attacker's gateway. Even if the device connects to a rogue AP, the attacker sees only encrypted tunnel traffic.
* '''Prefer WPA3''': WPA3's SAE handshake resists offline dictionary attacks and makes rogue AP impersonation harder (the rogue AP must know the password to complete the handshake).
* '''Enable MAC address randomization''': Default on modern iOS and Android; reduces tracking across probe requests.
* '''Disable Wi-Fi when not in use''': Stops probe request broadcasting.
 
== Enterprise ==
 
* '''802.1X / WPA2-Enterprise / WPA3-Enterprise''': Requires RADIUS authentication with server certificates. A rogue AP cannot present a valid certificate and the client will refuse to connect.
* '''802.11w (Protected Management Frames)''': Authenticates deauthentication and disassociation frames, neutralizing deauth-based attacks. Required for WPA3 certification; optional for WPA2. Supported on most modern APs and clients.
* '''Wireless Intrusion Detection Systems (WIDS)''': Monitors for rogue AP signatures — a single device responding to probes for multiple SSIDs, unexpected deauthentication floods, or association events on unknown BSSIDs. Platforms: Cisco CleanAir, Aruba RFProtect, Aircrack-ng + custom rules.
* '''MDM Wi-Fi profiles''': Restrict managed devices to pre-configured, verified networks only. Disable auto-join for all other SSIDs.
* '''Disable WPA3 Transition Mode''': If all clients support WPA3, disable transition mode to eliminate the downgrade attack vector.
 
== Network Monitoring ==
 
* '''Kismet''': Wireless network detector and sniffer that can identify rogue APs by fingerprinting beacon patterns and probe response behavior.
* '''ARPWatch''': Detects ARP table changes that indicate ARP spoofing post-association.
 
=Nutshell: Classic vs. Modern=
 
{| class="wikitable"
|-
! Aspect !! Classic (2000s) !! Modern (2010s–Present)
|-
| '''Network baseline''' || WEP common; WPA2-PSK emerging; open networks widespread || WPA2-PSK dominant; WPA3 rising; 802.11w adoption
|-
| '''Primary attack''' || Evil Twin (single SSID); KARMA (probe-response) || PineAP/Dogma (beacon-flood + probe-response); downgrade attacks
|-
| '''Enabling technique''' || Deauthentication (aireplay-ng) || Deauthentication; PMKID capture; transition-mode downgrade
|-
| '''Hardware''' || Laptop + single wireless card || WiFi Pineapple; dual-radio setups; purpose-built platforms
|-
| '''Key tools''' || airbase-ng, aireplay-ng, hostapd-karma, Ettercap || WiFi Pineapple (PineAP), Bettercap, MANA, hcxdumptool, wifiphisher
|-
| '''Traffic visibility''' || HTTP plaintext dominant; SSL sparse || HTTPS dominant (95%+); VPN usage increasing
|-
| '''SSL attack''' || SSLStrip (basic downgrade) || SSLStrip+; captive portal credential harvesting; HSTS-aware interception
|-
| '''Probe defense''' || None — clients broadcast all SSIDs || Passive scanning (iOS 14+, Android 10+); MAC randomization
|-
| '''Frame protection''' || None — all management frames unauthenticated || 802.11w (Protected Management Frames); WPA3 SAE
|-
| '''Client OS hardening''' || Auto-connect on by default; unlimited probe broadcast || Reduced probe verbosity; per-network auto-join toggles; DoH/DoT
|-
| '''Detection''' || Manual Kismet inspection; signal strength triangulation || WIDS (Cisco, Aruba); beacon-rate anomaly detection; SIEM integration
|-
| '''Scale''' || Targeted (one SSID at a time) or broadcast-range KARMA || Mass-capture with targeted SSID dictionaries; multi-channel simultaneous
|}
 
=Related Pages=
 
* [[MITM/Wired]] — Man in the middle on wired networks, with the same classic/modern structure
* [[Karma]] — Deep dive on the KARMA attack mechanism and tools
* [[Wireless Pineapple]] — The Hak5 hardware platform for wireless penetration testing
* [[MITM/Evil Twin]] — Walkthrough of a classic Evil Twin attack with Ettercap
* [[MITM/ARP Poisoning]] — ARP spoofing fundamentals (applicable post-association on wireless)
* [[SSLStrip]] — Downgrading HTTPS to HTTP during MITM
* [[Bettercap]] — Modern MITM framework with WiFi module
* [[Kali/Wireless Reboot]] — Practical wireless attack workflows on Kali


=Links=
=Links=


http://networkengineering.stackexchange.com/questions/3774/using-wireless-cards-in-promiscuous-mode
* Hak5 WiFi Pineapple documentation: https://documentation.hak5.org/
* hostapd-mana (SensePost): https://github.com/sensepost/hostapd-mana
* wifiphisher project: https://wifiphisher.org/
* PMKID attack (hashcat forums): https://hashcat.net/forum/thread-7717.html
* 802.11w / Protected Management Frames: IEEE 802.11w-2009


==Flags==
=Flags=


{{MITMFlag}}
{{MITMFlag}}


{{WirelessFlag}}
{{WirelessFlag}}

Latest revision as of 14:32, 19 June 2026

Man in the middle attacks on wireless networks.

How Wireless Networks Work

Wireless networks (Wi-Fi) operate on a shared radio medium governed by the 802.11 protocol suite. Unlike wired networks where each host has a dedicated physical connection to a switch port, wireless clients share the same airspace — every station within range can hear every transmission on a given channel.

Association and Authentication

A client joins a wireless network through a multi-step process:

  1. Probing: The client broadcasts probe request frames asking for known SSIDs. The access point (AP) replies with probe response frames.
  2. Authentication: A lightweight 802.11 authentication exchange (distinct from WPA/WPA2 authentication — this is a legacy handshake that is essentially a no-op for open networks and a formality for encrypted networks).
  3. Association: The client sends an association request; the AP responds with an association response. The client is now a station on the BSS (Basic Service Set).
  4. Key exchange: For WPA/WPA2 networks, the 4-way handshake negotiates encryption keys using the pre-shared key (PSK). For WPA3, Simultaneous Authentication of Equals (SAE) replaces the PSK-based handshake.

The Trust Problem

802.11 management frames — probes, beacons, authentication, and association — are unauthenticated and unencrypted by default. Any device can transmit a beacon claiming to be any SSID. Any device can respond to any probe request. Any device can send deauthentication frames to any station, using only the MAC address of the AP as the spoofed source.

This is the root vulnerability that makes wireless MITM attacks possible — and it exists at Layer 2, below the IP/ARP layers that wired MITM attacks must contend with.

Shared Medium, Shared Pain

On a wireless network, the AP broadcasts all frames to all associated stations. Each client's Wi-Fi card is supposed to discard frames not addressed to its MAC. However:

  • An attacker can place a wireless card in monitor mode, which disables MAC filtering and passes all observed frames to the CPU. This reveals Layer 1–2 information (MAC addresses, signal strength, probe requests) but not Layer 3+ payloads — those remain encrypted under the WPA session keys.
  • An attacker who knows the network passphrase and captures the 4-way handshake can derive the session keys and decrypt all traffic for that session.
  • An attacker already associated with the same AP as the target can use a monitor-mode virtual interface (monitor vif) to capture frames addressed to other stations, though this is lossy and unreliable compared to a true MITM position.

Because the medium is shared, wireless MITM attacks operate primarily at Layer 2 (802.11 frames) rather than Layer 3 (ARP), though ARP spoofing remains useful post-association for controlling traffic flow through the attacker's relay.

Classic Approaches (2000s)

These techniques flourished when WEP was common, WPA2-PSK was emerging, client OSes broadcasted probe requests aggressively, and 802.11w (Protected Management Frames) did not exist.

Evil Twin

Main article: MITM/Evil Twin

The original wireless MITM attack. The attacker creates a rogue access point broadcasting the same SSID as a legitimate network. If the attacker's signal is stronger, or if the legitimate AP is temporarily unavailable, clients may associate with the rogue AP instead.

The classic Evil Twin requires the attacker to know the target SSID in advance. It is a targeted attack — one SSID, one impersonation. The attacker provides DHCP, DNS, and gateway services to the victim, gaining full control of the network layer. 

Legitimate AP        Rogue AP (Evil Twin)
     |                     |
     |     (deauth)        |
     X <------------------ |  ← Attacker deauths client from legitimate AP
     |                     |
                           | ← Client reconnects to rogue AP
                           |
                     [Attacker relays traffic to internet]

Classic Tools

  • airbase-ng (part of aircrack-ng): Creates a rogue AP from a single wireless interface. airbase-ng -e "LegitWiFi" -c 6 wlan0mon
  • aireplay-ng: Sends deauthentication frames to kick clients off the legitimate AP.

Deauthentication Attack

Main article: Kali/Wireless Reboot

A deauthentication attack is not a MITM attack on its own — it is the enabling technique for wireless MITM. The attacker spoofs 802.11 deauthentication frames with the MAC address of the legitimate AP, targeting a specific client or all clients on the network. The client disconnects and begins scanning for a network to rejoin. If a rogue AP with the same SSID is available (and has a stronger signal), the client associates with the attacker.

Because deauthentication frames are management frames, they are unauthenticated (prior to 802.11w). The attacker only needs the AP's MAC address, which is visible to any monitor-mode interface.

Classic tool: aireplay-ng -0 0 -a [AP_MAC] -c [CLIENT_MAC] wlan0mon sends continuous deauths.

KARMA

Main article: Karma

KARMA, developed by Dino dai Zovi and Shane Macaulay (~2004–2005), weaponizes the client's own probe requests. Instead of impersonating a single known SSID (Evil Twin), KARMA listens for probe requests from nearby devices — which broadcast the names of every network they've ever connected to — and responds to all of them, instantly impersonating whatever network each device is looking for.

This is a mass-capture attack. At a busy airport or conference, dozens of devices can be ensnared simultaneously with zero prior knowledge of their preferred networks.

KARMA Mechanism

  1. Attacker places a wireless card in monitor mode and passively captures all probe requests.
  2. For each probe request received, the attacker's rogue AP immediately transmits a matching beacon frame.
  3. The client, recognizing a "known" network, automatically associates.
  4. The attacker provides DHCP/DNS/gateway services.

Classic tool: hostapd-karma, a modified version of the standard hostapd daemon.

ARP Spoofing on Wireless

Main article: MITM/ARP Poisoning

Once an attacker has joined the same wireless network as the target (whether legitimately or via Evil Twin/KARMA), ARP spoofing works identically to wired ARP spoofing. The shared wireless medium makes it theoretically possible to capture frames addressed to other stations using monitor mode, but this is lossy and unreliable — ARP spoofing ensures the attacker controls the traffic flow rather than passively sampling it.

See MITM/Wired and MITM/ARP Poisoning for the full ARP spoofing playbook. Tools: arpspoof, Ettercap, Bettercap.

Modern Approaches (2010s–Present)

Modern wireless MITM is defined by purpose-built hardware platforms, sophisticated probe-response frameworks that defeat passive-scanning countermeasures, and attacks targeting the WPA3 transition.

WiFi Pineapple

Main article: Wifi Pineapple

The Wifi Pineapple is a dedicated hardware platform by Hak5 that transformed wireless MITM from a multi-tool command-line exercise into a point-and-click operation. Originally released in 2008, it has evolved through seven major hardware revisions (Mark I through Mark VII).

The Pineapple integrates KARMA, deauthentication, SSL stripping, captive-portal phishing, and credential harvesting into a single pocket-sized device with a web-based interface. It is the most recognizable wireless penetration testing tool in existence.

PineAP Suite

Starting with the Mark V (2014), the Pineapple's attack framework evolved into PineAP, a modular suite that subsumes and extends KARMA:

  • Log Probes — Continuously sniffs and logs all probe requests from nearby clients.
  • PineAP Daemon — Responds to probe requests as classic KARMA did, with refined targeting controls.
  • Dogma — Aggressively broadcasts beacons for all previously-seen SSIDs (loud mode).
  • Beacon Response — Responds individually to probes with matching beacons.
  • Capture — Harvests WPA handshake frames for offline cracking.

The Pineapple's combination of KARMA, SSLStrip, and a captive-portal engine makes it a complete rogue-AP platform. For full details, see the Wifi Pineapple page.

MANA (Modified Advanced Next-generation Attack)

MANA, presented at DEF CON 22 (2014) by Dominic White and Ian de Villiers, extends KARMA to defeat modern OS countermeasures that reduced directed probe request verbosity (iOS, Android, Windows all moved toward passive scanning):

  • Loud Mode: The rogue AP actively broadcasts beacons for every SSID it has ever seen in any probe request — no client probing needed.
  • Stealth Mode: Selectively responds only to SSIDs previously captured, reducing noise and evading WIDS.
  • EAP Credential Harvesting: Via the Wireless Pwnage Edition (WPE), captures credentials from devices configured for WPA2-Enterprise networks.
  • Snoopy: Device fingerprinting and tracking.

Implementation: hostapd-mana

Bettercap (WiFi Module)

Main article: Bettercap

Bettercap's WiFi module brings modern, modular MITM to wireless. Capabilities include:

  • Rogue AP creation with WPA/WPA2 support
  • Deauthentication attacks
  • PMKID capture for WPA3-incompatible cracking
  • Clientless monitoring (passive traffic analysis without joining the network)
  • Integrated HTTP/HTTPS proxy for traffic manipulation post-association

Example: sudo bettercap -eval "set wifi.interface wlan0; wifi.recon on; wifi.deauth *"

PMKID Attack

Discovered in 2018 by Jens "atom" Steube (hashcat developer), the PMKID attack exploits a feature of WPA/WPA2 Roaming. When a client attempts to connect, many APs include a PMKID (Pairwise Master Key Identifier) in the EAPOL frame from the first message of the 4-way handshake — before the handshake completes. The PMKID is derived from the PMK (which is derived from the passphrase), the AP MAC, the client MAC, and a salt.

An attacker can request the PMKID from an AP without any clients present, capture it, and attempt to crack it offline. This is faster than capturing a full 4-way handshake because:

  • No client needs to be connected or deauthenticated.
  • Only a single frame from the AP is required.

Tool: hcxdumptool + hashcat (hash mode 22000).

WPA3 Transition Mode Attacks

WPA3 mandates SAE (Simultaneous Authentication of Equals), which is resistant to offline dictionary attacks. However, WPA3 networks commonly operate in Transition Mode, where both WPA2-PSK and WPA3-SAE are accepted on the same SSID to support legacy clients.

An attacker can:

  1. Set up a rogue AP broadcasting the target SSID with WPA2-only support (no WPA3).
  2. Deauthenticate clients from the legitimate AP.
  3. Clients reconnect to the rogue AP using WPA2.
  4. Capture the WPA2 4-way handshake and crack the passphrase offline.

This is a downgrade attack that bypasses WPA3's protections entirely when transition mode is enabled. Tools: airbase-ng, hostapd-wpe, WiFi Pineapple.

Rogue AP with Captive Portal

A modern evolution of the Evil Twin that adds a captive portal — a fake login page that mimics the legitimate network's splash screen, a social media login, or a corporate SSO page. When the victim connects, they are presented with the portal and prompted for credentials.

Tools: wifiphisher (automated phishing scenarios), Fluxion (captive portal + deauth, uses social engineering to obtain the Wi-Fi password itself).

Multi-Channel MITM

Modern wireless attackers with dual-radio setups (like the WiFi Pineapple Mark VII or a laptop with two wireless adapters) can operate on two channels simultaneously:

  • Radio 1: Connects to the legitimate AP as a client (upstream internet).
  • Radio 2: Hosts the rogue AP for victims (downstream).

This eliminates the need for a separate upstream connection (Ethernet, cellular) and makes the attack fully self-contained.

Defenses

Client-Side

  • Disable auto-connect for open networks: The single most effective OS-level defense against KARMA and Evil Twin. On iOS, Android, Windows, and macOS, toggle "Auto-Join" or "Connect Automatically" off for untrusted networks.
  • Audit your Preferred Network List (PNL): Remove SSIDs for public or one-time networks you no longer use. Every SSID in your PNL is a potential target for KARMA.
  • Use a VPN: An always-on VPN encrypts all traffic before it reaches the attacker's gateway. Even if the device connects to a rogue AP, the attacker sees only encrypted tunnel traffic.
  • Prefer WPA3: WPA3's SAE handshake resists offline dictionary attacks and makes rogue AP impersonation harder (the rogue AP must know the password to complete the handshake).
  • Enable MAC address randomization: Default on modern iOS and Android; reduces tracking across probe requests.
  • Disable Wi-Fi when not in use: Stops probe request broadcasting.

Enterprise

  • 802.1X / WPA2-Enterprise / WPA3-Enterprise: Requires RADIUS authentication with server certificates. A rogue AP cannot present a valid certificate and the client will refuse to connect.
  • 802.11w (Protected Management Frames): Authenticates deauthentication and disassociation frames, neutralizing deauth-based attacks. Required for WPA3 certification; optional for WPA2. Supported on most modern APs and clients.
  • Wireless Intrusion Detection Systems (WIDS): Monitors for rogue AP signatures — a single device responding to probes for multiple SSIDs, unexpected deauthentication floods, or association events on unknown BSSIDs. Platforms: Cisco CleanAir, Aruba RFProtect, Aircrack-ng + custom rules.
  • MDM Wi-Fi profiles: Restrict managed devices to pre-configured, verified networks only. Disable auto-join for all other SSIDs.
  • Disable WPA3 Transition Mode: If all clients support WPA3, disable transition mode to eliminate the downgrade attack vector.

Network Monitoring

  • Kismet: Wireless network detector and sniffer that can identify rogue APs by fingerprinting beacon patterns and probe response behavior.
  • ARPWatch: Detects ARP table changes that indicate ARP spoofing post-association.

Nutshell: Classic vs. Modern

Aspect Classic (2000s) Modern (2010s–Present)
Network baseline WEP common; WPA2-PSK emerging; open networks widespread WPA2-PSK dominant; WPA3 rising; 802.11w adoption
Primary attack Evil Twin (single SSID); KARMA (probe-response) PineAP/Dogma (beacon-flood + probe-response); downgrade attacks
Enabling technique Deauthentication (aireplay-ng) Deauthentication; PMKID capture; transition-mode downgrade
Hardware Laptop + single wireless card WiFi Pineapple; dual-radio setups; purpose-built platforms
Key tools airbase-ng, aireplay-ng, hostapd-karma, Ettercap WiFi Pineapple (PineAP), Bettercap, MANA, hcxdumptool, wifiphisher
Traffic visibility HTTP plaintext dominant; SSL sparse HTTPS dominant (95%+); VPN usage increasing
SSL attack SSLStrip (basic downgrade) SSLStrip+; captive portal credential harvesting; HSTS-aware interception
Probe defense None — clients broadcast all SSIDs Passive scanning (iOS 14+, Android 10+); MAC randomization
Frame protection None — all management frames unauthenticated 802.11w (Protected Management Frames); WPA3 SAE
Client OS hardening Auto-connect on by default; unlimited probe broadcast Reduced probe verbosity; per-network auto-join toggles; DoH/DoT
Detection Manual Kismet inspection; signal strength triangulation WIDS (Cisco, Aruba); beacon-rate anomaly detection; SIEM integration
Scale Targeted (one SSID at a time) or broadcast-range KARMA Mass-capture with targeted SSID dictionaries; multi-channel simultaneous

Related Pages

  • MITM/Wired — Man in the middle on wired networks, with the same classic/modern structure
  • Karma — Deep dive on the KARMA attack mechanism and tools
  • Wireless Pineapple — The Hak5 hardware platform for wireless penetration testing
  • MITM/Evil Twin — Walkthrough of a classic Evil Twin attack with Ettercap
  • MITM/ARP Poisoning — ARP spoofing fundamentals (applicable post-association on wireless)
  • SSLStrip — Downgrading HTTPS to HTTP during MITM
  • Bettercap — Modern MITM framework with WiFi module
  • Kali/Wireless Reboot — Practical wireless attack workflows on Kali

Links

Flags


Defcon.png
monkey in the middle attacks
in which an attacker tricks two parties into thinking they're communicating with each other, but both are communicating with the attacker.

MITM

Wireless Attacks: MITM/Wireless

Wired Attacks: MITM/Wired


Layer 1 and 2 MITM Attacks:

MITM/Layer 1 and 2

Network Tap: MITM/Wired/Network Tap

Evil Twin Attack: Evil Twin  · MITM/Evil Twin


Layer 3 and 4 MITM Attacks:

MITM/Layer 3 and 4

Traffic Sniffing: MITM/Sniffing

ARP Poisoning: MITM/ARP Poisoning

Traffic Injection/Modification: MITM/Traffic Injection

DNS Attacks: MITM/DNS  · Bettercap/Failed DNS Spoofing Attack  · Bettercap/Failed DNS Spoofing Attack 2

DHCP Attacks: MITM/DHCP

WPAD MITM Attack: MITM/WPAD

Port Stealing: MITM/Port Stealing

Rushing Attack: MITM/Rushing Attack

Attacking HTTPS: MITM/HTTPS


Layer 5 MITM Attacks:

Session Hijacking: MITM/Session Hijacking


Toolz:

Ettercap  · Bettercap  · MITMf  · EvilFOCA

Wireshark  · Aircrack

Dsniff  · Arpspoof  · Dnsspoof

SSLSniff  · SSLStrip  · Frankencert

Driftnet  · Karma


MITM Labs: {{MITMLabs}}


Category:MITM  · Category:Attacks  · Category:Kali Attack Layers

Template:MITMLabs  · Template:MITMFlag

Flags  · Template:MITMFlag  · e






Defcon.png
Wireless
all things wireless.

Wireless  · Category:Wireless


Software:

Scapy


Flags  · Template:WirelessFlag  · e



Retrieved from "https://charlesreid1.com/w/index.php?title=MITM/Wireless&oldid=30671"