📖 What is Evil Twin?
An Evil Twin is a fraudulent Wi-Fi access point that appears to be a legitimate one, designed to trick users into connecting to it. Once connected, the attacker can intercept traffic, steal credentials, or perform man-in-the-middle attacks.
"Look for keywords like 'SSID spoofing' or 'rogue access point' in exam questions to identify this specific wireless attack."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Evil Twin?
- ▸ SSID Spoofing involves cloning the Service Set Identifier of a trusted network, tricking devices that automatically connect to known networks into joining the attacker's AP.
- ▸ Captive Portals are frequently used as the second stage, presenting a fake authentication page to harvest usernames, passwords, or sensitive corporate credentials from victims.
- ▸ Deauthentication attacks are often paired with Evil Twins to force clients to disconnect from the legitimate AP, making them more likely to roam to the attacker's signal.
- ▸ The Evil Twin acts as a Man-in-the-Middle (MITM), allowing the attacker to intercept, analyze, and potentially modify all traffic passing between the client and the internet.
- ▸ Specialized hardware like the WiFi Pineapple is used to automate the discovery of nearby SSIDs and the deployment of fraudulent clones for efficient data capture.
🎯 How does Evil Twin appear on the PT0-002 Exam?
A scenario might describe a penetration tester using deauthentication frames to kick users off a corporate Wi-Fi network, followed by the deployment of a spoofed SSID to capture credentials.
You may be asked to identify the specific attack when a user is prompted with a fake login page after connecting to a network that looks identical to a public hotspot.
Expect questions that require you to distinguish between a Rogue AP, which is simply unauthorized, and an Evil Twin, which is specifically designed to impersonate a legitimate network.
❓ Frequently Asked Questions
How does an Evil Twin differ from a standard Rogue Access Point?
A Rogue AP is any unauthorized wireless device connected to a network. An Evil Twin is a malicious Rogue AP that specifically spoofs a legitimate SSID to trick users into connecting.
Why are deauthentication packets critical for an Evil Twin attack?
Since devices prefer the strongest signal or existing connections, attackers send deauthentication frames to force the victim to disconnect from the real AP, prompting them to reconnect to the stronger Evil Twin.