1

Is the evil twin attack included in the sniffing category ?

I am really confused and i can't tell if it is.

2

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc.

It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.

  • thanks bro. Our teacher told us to speak about a sniffing attack, you think i can do evil twin without a problem ? – Sidahmed Jan 21 '16 at 21:41
  • I'd shy away from Evil Twin as sniffing, and talk about protocol analyzers instead. Here... technet.microsoft.com/en-us/library/cc959354.aspx and also here... en.wikipedia.org/wiki/Protocol_analyzer – Brad Bouchard Jan 21 '16 at 21:44
  • @Sidahmed If your teacher wants you to do a sniffing attack, just get on the network and fire up Wireshark/tcpdump. If the point of the evil twin is to be a sniffer, you would have to run a tool like Wireshark or tcpdump anyway. – cremefraiche Jan 21 '16 at 22:13
  • @BradBouchard I'm not sure what you think those links have to do with the question or answer. He just wants to know if an evil twin attack is considered a sniffing attack. While it doesn't inherently involve sniffing, the definition from certification bodies states that sniffing is the end goal. – cremefraiche Jan 21 '16 at 22:15
  • @Sidahmed No problem. – cremefraiche Jan 21 '16 at 22:15
0

Attackers who set up Evil Twins (An Evil Twin is a rogue wireless access point set up to mimic legitimate company wireless access points; many times the SSID is duplicated to make it look like it's the official SSID of the company) usually use some sort of sniffer/protocol analyzer, but the Evil Twin in and of itself is hardware; a rogue AP.

To answer your specific question, about whether it's in the sniffing category, that depends on which book you read or who you're talking to that's doing the classifying. While the Evil Twin itself is not technically a sniffer (it's a rogue AP), there are other tools that would be used in conjunction with it that are in the "sniffing" category as you put it. These tools would include protocol analyzers and other sniffing tools like Wireshark and Nmap which would allow would-be attackers to sniff packets coming through the Evil Twin. The whole point of setting up an Evil Twin is to be able to sniff out, or peer into, the traffic that gets directed through the rogue AP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.