0

In a test environment, I am trying to spoof my basic router's Wi-Fi access point using the following:

The output of Terminal #1 is as follows:

root@kali:~# airmon-ng check kill

Killing these processes:

  PID Name
  524 wpa_supplicant

root@kali:~# ifconfig wlan0 down
root@kali:~# iwconfig wlan0 mode monitor
root@kali:~# ifconfig wlan0 up
root@kali:~# airbase-ng -a <BSSID obtained from airodump-ng output> --essid "<ESSID>" -c <channel obtained from airodump-ng output> wlan0
10:34:03  Created tap interface at0
10:34:03  Trying to set MTU on at0 to 1500
10:34:03  Trying to set MTU on wlan0 to 1800
10:34:03  Access Point with BSSID <BSSID obtained from airodump-ng output> started.
10:34:10  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:10  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:13  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"
10:34:18  Client <MAC address of client device> associated (unencrypted) to ESSID: "<ESSID>"

The output of Terminal #2 is as follows:

root@kali:~# brctl addbr evil
root@kali:~# brctl addif evil eth0
root@kali:~# brctl addif evil at0
root@kali:~# ifconfig at0 0.0.0.0 up
root@kali:~# ifconfig evil up
root@kali:~# dhclient evil
root@kali:~# aireplay-ng wlan0 -0 0 -a <BSSID obtained from airodump-ng output>
10:34:13  Waiting for beacon frame (BSSID: <BSSID obtained from airodump-ng output>) on channel <channel obtained from airodump-ng output>
NB: this attack is more effective when targeting
a connected wireless client (-c <client's mac>).
10:34:13  Sending DeAuth (code 7) to broadcast -- BSSID: [<BSSID obtained from airodump-ng output>]
10:34:14  Sending DeAuth (code 7) to broadcast -- BSSID: [<BSSID obtained from airodump-ng output>]
10:34:14  Sending DeAuth (code 7) to broadcast -- BSSID: [<BSSID obtained from airodump-ng output>]
10:34:15  Sending DeAuth (code 7) to broadcast -- BSSID: [<BSSID obtained from airodump-ng output>]
10:34:15  Sending DeAuth (code 7) to broadcast -- BSSID: [<BSSID obtained from airodump-ng output>]
10:34:16  Sending DeAuth (code 7) to broadcast -- BSSID: [<BSSID obtained from airodump-ng output>]
10:34:16  Sending DeAuth (code 7) to broadcast -- BSSID: [<BSSID obtained from airodump-ng output>]

The output of Terminal #3 after the above just to show the networking config is as follows:

root@kali:~# ifconfig
at0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::1e74:dff:fe7d:625  prefixlen 64  scopeid 0x20<link>
        ether <MAC address>  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 46  bytes 6439 (6.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.16.200.61  netmask 255.255.255.0  broadcast 172.16.200.255
        inet6 fe80::a00:27ff:fe95:8c5e  prefixlen 64  scopeid 0x20<link>
        ether <MAC address>  txqueuelen 1000  (Ethernet)
        RX packets 104  bytes 14909 (14.5 KiB)
        RX errors 0  dropped 2  overruns 0  frame 0
        TX packets 65  bytes 5781 (5.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

evil: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.16.200.61  netmask 255.255.255.0  broadcast 172.16.200.255
        inet6 fe80::a00:27ff:fe95:8c5e  prefixlen 64  scopeid 0x20<link>
        ether <MAC address>  txqueuelen 1000  (Ethernet)
        RX packets 27  bytes 4305 (4.2 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 12  bytes 1200 (1.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 20  bytes 1116 (1.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 20  bytes 1116 (1.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=867<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,ALLMULTI>  mtu 1800
        unspec 12-5B-99-52-3D-F4-30-3A-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 62315  bytes 63045743 (60.1 MiB)
        RX errors 0  dropped 61  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

root@kali:~# iwconfig
evil      no wireless extensions.

lo        no wireless extensions.

wlan0     IEEE 802.11  Mode:Monitor  Frequency:2.462 GHz  Tx-Power=20 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

eth0      no wireless extensions.

at0       no wireless extensions.

root@kali:~#

Attempting to use any given smartphone to join this AP simply fails. On iPhone, "Unable to join the network" is reported.

I've tried everything that I've found on Google - ensuring dnsmasq is installed, configured as a DHCP server, and running; setting an IP address in the same DHCP subnet on at0 (if I recall correctly); using NAT rules and IP forwarding instead of a bridge, disabling monitor mode before broadcasting, etc. Nothing has worked yet.

I'm fairly new to this so I'm probably missing something obvious but help would be appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.