< Back to Projects

Wi-Fi Rogue Access Point (Evil Twin)

School - Bachelor 3 Solo Completed

Hands-on lab building a rogue access point / Evil Twin attack chain in a controlled lab environment: a fake access point impersonating a legitimate network, used to study Wi-Fi client behavior and traffic interception techniques - and, by extension, how to detect and defend against this exact attack.

Rogue access point attack flow Client connects to Evil Twin hostapd fake AP, same SSID dnsmasq DHCP/DNS to client iptables NAT forwarded / captured traffic
Client associates with the rogue AP, gets a lease from dnsmasq, and its traffic is routed through iptables NAT while being captured/observed.

Context

Bachelor 3 lab on Wi-Fi security, done solo, in an isolated lab network with no real victims involved - the goal was to understand exactly how an Evil Twin attack works end-to-end so it can be recognized and mitigated in a real environment (enterprise Wi-Fi hardening, client-side warnings, 802.1X).

What was built

  • Python automation scripts (Rogue_AP_evil_twins.py, RogueAP_final.py) that configure and launch a fake access point.
  • Fake AP served with hostapd, DHCP/DNS handled by dnsmasq, and traffic routed to the internet through iptables NAT rules.
  • Wireless interface switched to monitor mode with airmon-ng for network scanning and packet capture.
  • Real WPA handshakes captured with aircrack-ng, and a man-in-the-middle scenario demonstrated with airbase-ng.
  • Network captures kept as evidence (.cap files, Kismet .netxml/.csv exports).

Tech stack

Python hostapd dnsmasq aircrack-ng suite iptables Wi-Fi security

Status

Lab completed and submitted, entirely within a controlled, isolated environment.

< All projects