1

Is the evil twin attack included in the sniffing category ?

I am really confused and i can't tell if it is.

Improve this question

2 Answers 2

Reset to default
2

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc.

It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.

Improve this answer
5
  • thanks bro. Our teacher told us to speak about a sniffing attack, you think i can do evil twin without a problem ?
    – Sidahmed
    Jan 21, 2016 at 21:41
  • I'd shy away from Evil Twin as sniffing, and talk about protocol analyzers instead. Here... technet.microsoft.com/en-us/library/cc959354.aspx and also here... en.wikipedia.org/wiki/Protocol_analyzer
    – Brad Bouchard
    Jan 21, 2016 at 21:44
  • @Sidahmed If your teacher wants you to do a sniffing attack, just get on the network and fire up Wireshark/tcpdump. If the point of the evil twin is to be a sniffer, you would have to run a tool like Wireshark or tcpdump anyway.
    – cremefraiche
    Jan 21, 2016 at 22:13
  • @Sidahmed No problem.
    – cremefraiche
    Jan 21, 2016 at 22:15
  • @cremefraiche They have to do with sniffing/protocol analyzer attacks which his teacher asked him to talk about. You can clearly see that from navigating to them. Also, I'm not sure what your answer added by way of value to the question as you've basically restated what I've already told him in my answer.
    – Brad Bouchard
    Jan 21, 2016 at 22:21
0

Attackers who set up Evil Twins (An Evil Twin is a rogue wireless access point set up to mimic legitimate company wireless access points; many times the SSID is duplicated to make it look like it's the official SSID of the company) usually use some sort of sniffer/protocol analyzer, but the Evil Twin in and of itself is hardware; a rogue AP.

To answer your specific question, about whether it's in the sniffing category, that depends on which book you read or who you're talking to that's doing the classifying. While the Evil Twin itself is not technically a sniffer (it's a rogue AP), there are other tools that would be used in conjunction with it that are in the "sniffing" category as you put it. These tools would include protocol analyzers and other sniffing tools like Wireshark and Nmap which would allow would-be attackers to sniff packets coming through the Evil Twin. The whole point of setting up an Evil Twin is to be able to sniff out, or peer into, the traffic that gets directed through the rogue AP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .