Skip to main content
added 7 characters in body
Source Link
schroeder
  • 132.2k
  • 55
  • 307
  • 348

There are different typetypes of attacks for rougerogue or malicious APs, most common ones are to sniff and stolesteal data. If that is the case:

I don't recommend the use of a VPN (at least not standalone) as you don't know (I guess) the attacker capabilities, they could set up the connection with SSL StripSSLStrip or exploit a vulnerability of your VPN to still see and inject traffic. If you must (I don't see why you will do this), you can consider usign TOR thruusing Tor through a second router with WDS and DNS properly set up, to connect to the malicious router. TORTor will protect you from sniffing even at a LAN level, plus a VPN will do the trick.

Of course it will worth to know more details about the malicious router beforehand, you can accomplish this using DNS probes, doing a port scan to the gateway while connected directly to the attacker, verify how the connection goes after you connect to the malicious router using traceroute to determine how is the AP configured, try to figure out if he useuses the real MAC and if he does you can figure out the device he is using to outsmart the attacker.

There are different type of attacks for rouge or malicious APs, most common ones are to sniff and stole data. If that is the case:

I don't recommend the use a VPN (at least not standalone) as you don't know (I guess) the attacker capabilities, they could set up the connection with SSL Strip or exploit a vulnerability of your VPN to still see and inject traffic. If you must (I don't see why you will do this), you can consider usign TOR thru a second router with WDS and DNS properly set up, to connect to the malicious router. TOR will protect you from sniffing even at a LAN level, plus a VPN will do the trick.

Of course it will worth to know more details about the malicious router beforehand, you can accomplish this using DNS probes, doing a port scan to the gateway while connected directly to the attacker, verify how the connection goes after you connect to the malicious router using traceroute to determine how is the AP configured, try to figure out if he use the real MAC and if he does you can figure out the device he is using to outsmart the attacker.

There are different types of attacks for rogue or malicious APs, most common ones are to sniff and steal data. If that is the case:

I don't recommend the use of a VPN (at least not standalone) as you don't know (I guess) the attacker capabilities, they could set up the connection with SSLStrip or exploit a vulnerability of your VPN to still see and inject traffic. If you must (I don't see why you will do this), you can consider using Tor through a second router with WDS and DNS properly set up, to connect to the malicious router. Tor will protect you from sniffing even at a LAN level, plus a VPN will do the trick.

Of course it will worth to know more details about the malicious router beforehand, you can accomplish this using DNS probes, doing a port scan to the gateway while connected directly to the attacker, verify how the connection goes after you connect to the malicious router using traceroute to determine how is the AP configured, try to figure out if he uses the real MAC and if he does you can figure out the device he is using to outsmart the attacker.

Source Link

There are different type of attacks for rouge or malicious APs, most common ones are to sniff and stole data. If that is the case:

I don't recommend the use a VPN (at least not standalone) as you don't know (I guess) the attacker capabilities, they could set up the connection with SSL Strip or exploit a vulnerability of your VPN to still see and inject traffic. If you must (I don't see why you will do this), you can consider usign TOR thru a second router with WDS and DNS properly set up, to connect to the malicious router. TOR will protect you from sniffing even at a LAN level, plus a VPN will do the trick.

Of course it will worth to know more details about the malicious router beforehand, you can accomplish this using DNS probes, doing a port scan to the gateway while connected directly to the attacker, verify how the connection goes after you connect to the malicious router using traceroute to determine how is the AP configured, try to figure out if he use the real MAC and if he does you can figure out the device he is using to outsmart the attacker.