Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We are working on an activity to train staff about security. Is there any way to spoof the company's guest router and ask staff to provide login credentials (as public wifi does) and when they do that, we will have a list of their passwords. so, they can understand that public wifi is not secure enough.
Is there something around it?
This is a colossally bad idea.
But the technical answer is to perform an Evil Twin attack and simply stand up a new access point with the same name and run Evil Twin software to capture passwords.
But here is why you should not do this:
You are not teaching them anything except to not trust you.
You are hosting a legitimate network, then setting up a fake network to capture their credentials. Why capture credentials? A simple landing page on the Evil Twin that educates staff on why they should not have connected to the wrong wifi access point and how to tell the difference would be better. And capturing credentials carries a number of legal risks.
Second, the security of the company access points is up to the company. If you want to secure your people on your networks, don't dig a pit then push them in then blame them for falling. Instead, secure your networks.
If you want to teach your people about the dangers of open wifi points, run a demo, make a video, educate don't entrap.
Yeah - this is a good idea.
https://shop.hak5.org/products/wifi-pineapple
But don't shame your staff - use it for training, but not to trick them normally.
It’s a good defcon-style exercise. https://www.zdnet.com/article/defcon-2007-wall-of-sheep-shame/
I don’t see the value in impersonating your guest wifi but setting up a test wifi to show people what can happen is interesting.
I also train people to never trust wifi including that provided by our company. But to trust https.
