I'm having a hard time to understand the difference between a rogue AP and an evil twin? I've spend some time searching for it but I don't understand it fully I think. Is it pretty much the same thing except the AP is a physical device that needs to be plugged in physical (Ethernet cable and port) into a existing network and the evil twin can be a computer or raspberry pi, only using Wi-Fi to connect to its victim and a legitimate AP? Is this somewhat correct or have i misunderstood it?
Yeah, but an Evil Twin is a kind of Rogue AP.
The most common Rogue AP is an ilegitimate AP that is plugged in a network to create a bypass from outside into the legitime network.
An Evil Twin is a copy of a legitimate AP. The target is different. It tries to hook clients to connect to the fake network to steal information, but is a kind of Rogue AP too. A lot of people is wrong about this. They think an Evil Twin is not a Rogue AP but it is too. Look at the definition on Wikipedia: Rogue AP. You can read there "... it is tagged as rogue access point of the second kind, which is often called an Evil Twin".
The Evil Twin has too "good" or "positive" usage. It can be used during a pentesting over a corporate network to measure the "security education" or better said, the user's security awareness. To see how many bite the lure.
You are correct
A rogue access point is specifically an AP inside a network not administered by the network owner, giving it unwanted access to network.
An evil twin is a copy of a legitimate access point not necessarily giving it access to a specific network or even to internet. The wireless mode of these connections are ad-hoc, you can have an evil twin of your home network on a public park, just for the purpose of connecting your device to that network to do... evil things?
I'll try to explain it my way, the way I understand it:
1) Rouge Access point
It is an AP of your device, which you use to perform a MiTM attack, to redirect traffic from targeted persons to the router through your device. As you are already inside their network, you don't need to advertise your AP as a decoy for others to connect to.
2) Evil twin
As opposed to the rogue AP, here the main directive is to get others to connect to your local network through your AP. Not their network but your network. So you make your AP visible to others and try to clone it as much as possible to look like it's their network in order to trick people associating with it. Usually, this is an open network because if the attacker had password, he would go with option 1.
See the difference between the two? For the latter you are the king and owner as opposed to former where you are just a pawn among pawns on a chessboard.
There is also a 3rd option where similarly to 2nd an AP is set up as a bait for people to connect to but is not targeted to specific organization or people. Its purpose is to catch anyone trying to utilize free access to internet, hence the term phishing. It is also an open network just like evil twin. You'll know when you see one...