Importent Notice: Wifiphisher is a highly aggressive Wi-Fi phishing framework that may be illegal depending on usage context. Unauthorized use to attack network infrastructure violates laws in most regions. Always comply with local legal requirements!

Wifiphisher is an aggressive wireless Access Point (AP) framwork designed for Wi-Fi security testing. Penetration testers can leverage it to execute targeted Wi-Fi association attacks, seamless achieving Man-in-the-Middle (MITM) positions with connected wireless clients. It enables customization of phishing scenarios to capture credentials (e.g., third-party login details or WPA/WPA2 pre-shared keys) or deliver malware to victim devices.

Key Features

• Robust Performance: Runs for extended periods on Raspberry Pi, supporting modern Wi-Fi phishing techniques like Evil Twin, KARMA, and Known Beacons.
• High Flexibility: Offers dozens of parameters and a set of community-driven phishing templates for diverse deployment scenarios.
• Modular Design: Users can write Python modules (simple or complex) to extend functionality or create custom phishing schemes for targeted attacks.
• User-Friendly: Advanced users access rich features, while beginners start quickly with ./bin/wifiphisher. An interactive text UI guides through attack setup.
• Cutting-Edge Research Integration: First tool to combine innovations like Known Beacons and Lure10 attacks from Wi-Fi security research.
• Free and Open Source: GPLv3 licensed, with full source code available for download.

How It Works

Wi-Fi phishing with Wifiphisher involves two core steps:

1. Infiltration: Gain MITM access by tricking clients into unknowingly associating. Techniques include:
   • Evil Twin: Creates fake APs mimicking legitimate networks.
   • KARMA: Disguises as public networks actively searched by nearby devices.
   • Known Beacons: Broadcasts ESSIDs from a dictionary of previously connected networks. During this phase, it continuously sends Deauthenticate/Disassociate packets to disrupt existing trusted connections, forcing clients to switch to the fake AP.
2. Phishing Execution: Once MITM is established, conduct attacks like data sniffing, vulnerability scanning, or targeted web phishing. For example, extract info from beacon frames and HTTP User-Agent headers to mimic Windows web-based network managers for PSK capture.

Running Requirements

• Linux System: Supports multiple Linux distributions; Kali Linux is officially recommended and tested for new features.
• Wireless Adapter: Requires a Wi-Fi adapter with AP and monitor modes, injection capability, and netlink-supported drivers.

Installation

git clone https://gitee.com/mirrors/Wifiphisher.git  # Clone latest source
cd Wifiphisher                                     # Enter project directory
sudo python3 setup.py install                      # Install dependencies

Alternatively, download precompiled releases from https://github.com/wifiphisher/wifiphisher/releases

Usage Examples

• Run without parameters for interactive mode (select target network and phishing scheme):

  wifiphisher
  

• Use specific network interfaces, a firmware upgrade phishing scheme, and capture handshake:

  wifiphisher -aI wlan0 -jI wlan4 -p firmware-upgrade --handshake-capture handshake.pcap
  

  This command uses wlan0 as the fake AP, wlan4 for DoS attacks, manually selects the target network, and captures the WPA handshake in handshake.pcap to verify PSK correctness.

• Target a specific ESSID with a plugin update scheme and predefined PSK:

  wifiphisher --essid CONFERENCE_WIFI -p plugin_update -pK s3cr3tp4ssw0rd
  

  Useful for networks with publicized PSKs (e.g., conference Wi-Fi), this executes a plugin update scenario to deliver malicious executables.

• Create an open AP with OAuth login scheme and Known Beacons:

  wifiphisher --essid "FREE WI-FI" -p oauth-login -kB
  

  Ideal for public venue victims, this generates an open fake AP and uses OAuth login phishing to capture social network credentials.

Interface Screenshots

Wifiphisher provides a clean interactive UI with views like target AP selection, successful attack dashboards, fake router configuration pages, OAuth login interfaces, and web-based network management imitations.