Ethical › Module 16 › Lesson 2
Rogue AP as a Trust Trick
Lookalike names — recognize, do not run one in public.
Visual · rogue_ap_lookalike
A rogue AP is a lookalike SSID that borrows trust. Recognize it. Do not stand one up in a café, campus, hotel, or hallway. Home lab SSID only.
Opening
A rogue access point is a trust trick with a radio. Naming the trick is literacy. Running one in public is a crime, not a homework twin.
Lesson 1 named SSID as a label and WPA2/WPA3 as the lock. People still join networks the way they authenticate brands: they tap a familiar string. A rogue AP is an unauthorized radio that borrows a trusted or lookalike name so devices associate with the wrong door — the same family as a phishing display name in Topic 5 and Module 9. You will recognize the trick. You will not get a recipe for standing one up in a café, campus, airport, or hallway. This is original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. No evil-twin cookbook. No public hostapd twin. No CoffeeShop_Free next to a real café. Next hardens YOUR home lab. Here you write a recognition card, refuse line, and lock rogue-ap-notes.txt. The only SSID you may configure in this module is one YOU administer.
1. A rogue AP is an unauthorized radio that borrows a trusted name
Phones remember SSIDs they liked. They probe. They auto-join. A rogue AP offers a string that looks like the hotel, school, café, or “Airport_WiFi,” and a human or a stack associates. The harm is misplaced trust — your session is on someone else’s radio. That sentence is enough. This course will not tell you which extra radio, mode, or portal to copy. Recognition is the skill. Construction in public is out.
“Evil twin” in casual talk is the same family: a lookalike of a network people already trust. Naming it is literacy, like naming pretext in Module 9. A how-to is a weapon. You will not get “just for ten minutes in the student union.” Ten minutes of an unauthorized public radio is still unauthorized. Skill, a course title, and CEH-shaped vocabulary do not create consent.
Command guide
Rogue AP borrows a trusted name — WHAT/WHY
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' rogue_ap: unauthorized radio borrowing a trusted name refuse: building a twin, cafe evil-twin kits EOF
2. Why lookalike names work — SSID as a brand, auto-join as a shortcut
Humans authenticate Wi-Fi like logos: the string matches a memory. Cryptography authenticates with WPA2/WPA3 (or 802.1X at work). A lookalike wins when you use the human method on a radio that does not prove identity. Topic 8 already said encryption to the wrong name is still the wrong name. An open lookalike is worse: no lock and a borrowed brand. Auto-join skips the human — the device remembered a string and does not know a new radio is offering it.
Defender mood: prefer networks you built; turn off auto-join for public names you do not control; treat brand-copy SSIDs as a stop. If you must use café Wi-Fi, prefer the name on a sign you can see, still treat the path as Lesson 1’s threat model, and still do not capture anyone else. If two names look alike, do not join either as homework. Ask staff, or use cellular. Curiosity is not a license to map the duplicate with attack tools.
3. Recognition signals — unexpected name, missing lock, surprise portal — still not a twin you build
Recognition cards: a brand-copy you did not expect; an “official” name that is open when the real one uses WPA2/WPA3; a portal that asks for a password, MFA, or seed (Topic 5 / Module 9 — do not type); a duplicate of YOUR home name you did not create. Stop signs, not a lab in proving the twin. If you see a duplicate of YOUR SSID, you still do not deauth, crack, or clone it. You change YOUR passphrase on gear you own (Lesson 3) and you stop associating with the stranger string.
What you will not write: antenna placement, broadcast power, portal HTML, deauth so clients leave the real AP. Those sentences would help someone run the trick in a café. If a sentence would help impersonate a public network, it does not belong in your notes. Empty “I would never” with a recipe underneath still fails. Classify the lure. Do not run it.
4. Public rogue AP is out — café, campus, hotel, hallway: do not run one
Standing up a lookalike in a place you do not administer is interfering with other people’s communications. In many places that is a crime. Calling it CEH, a CTF, “awareness,” or “I told them afterward” does not create consent. No café twin. No campus twin. No “Free_Airport.” No fake SSID for classmates to join. Module 1’s RoE named machines and files you own — not other people’s association lists. Recognition and refusal are the assignment.
If you later work in security, you still do not freelance a rogue AP in a mall “for a portfolio.” Authorized wireless testing, if it ever exists, lives in written scope that names the SSID, building, method, and stop rules. You do not have that writing for the café, dorm, or neighbor. “The exam domain includes wireless” is not that writing. Notes that describe a public twin you ran fail ethics even if you never captured a password.
5. What you record: lookalike as a trust trick, refuse line, locked notes — not a twin plan
A rogue-AP note is boring on purpose. Date (UTC). Rogue_AP_means: unauthorized radio that borrows a lookalike SSID. Why_it_works: brand matching and auto-join. Recognition: unexpected name, missing WPA, surprise portal, duplicate of MY SSID I did not create. Ethics: NEVER a café/campus/hotel/hallway twin; NEVER an evil-twin recipe; NEVER deauth to steal clients. Legal line: original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. Path: $HOME/cyberlium-lab/rogue-ap-notes.txt, chmod 600. World-readable 777 fails. Neighbor SSIDs as “practice twins” fail.
A useful feeling: “I cannot learn this without broadcasting.” That feeling is how people leave literacy. The skill is stopping. Lesson 3 lets you change settings on a router YOU own — the opposite of impersonating someone else’s AP. Lock the notes. Do not gist a twin diagram. Do not attach a pcap of the floor.
6. Wrong vs right: café evil twin vs a recognition card you refuse to run
Worked failure — same word “rogue AP,” opposite blast radius. Right never needs a public radio when a locked note can name the trick.
Wrong
Broadcast a lookalike in a café, campus, hotel, or hallway. Copy a portal. Deauth clients toward your radio. Call it awareness or CEH. Save a recipe with hostapd flags. Gist the SSID list. This course is not official CEH training and does not grade that hunt.
Right
Name a rogue AP as a lookalike trust trick. Write recognition signals and a refuse line. File $HOME/cyberlium-lab/rogue-ap-notes.txt, chmod 600. No public twin. No evil-twin recipe. No café. Next: Home Lab Hardening — strong router password, WPA3, guest isolation, updates on gear YOU own.
7. Hands-on: lock rogue-ap-notes.txt — recognition only, no public radio
On a computer you own, create cyberlium-lab if needed. Fill the template in YOUR words. Run the checker; it only reads YOUR file. chmod 600. Do not add a broadcast plan because the file felt short. Windows without chmod: WSL/Git Bash, or restrict the files in your profile.
Command guide
Recognition signals — WHAT/WHY then lock
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' signals: unexpected name ; missing lock ; surprise portal refuse: build a twin to demonstrate EOF
Mission: rogue-ap-notes.txt in cyberlium-lab (mode 600)
1) In your own words, define a rogue AP as a lookalike trust trick (borrowed SSID, auto-join) — no construction steps. 2) Fill $HOME/cyberlium-lab/rogue-ap-notes.txt; run the checker; chmod 600. 3) Ethics: recognize and refuse. No café/campus/hotel twin. No evil-twin recipe. This is not official EC-Council training.
Stuck? Ask Cyberlium AI Mentor
If “CEH wireless means I should stand up a café twin so it feels real” still feels true, ask for a hint — not a recipe. Try: "Hint only: why a rogue AP is a trust trick, why café/campus twins are out, why rogue-ap-notes.txt lives at $HOME/cyberlium-lab chmod 600, and why this is not official EC-Council training?" You still fill the file. No hostapd. No neighbor. No hallway radio.
You now treat a rogue AP as a lookalike that steals trust the way a phishing display name does — and you treat public twins, evil-twin recipes, and café radios as out of this course. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. Next — Home Lab Hardening — strong router password, WPA3, guest isolation, and updates on gear YOU own.
Knowledge Check
APPLY: A teammate wants to broadcast “Cafe_Free” next to a real shop “for CEH evil twin.” What is a rogue AP here, and what do you do?
Multiple choice
Knowledge Check
APPLY: True or False: Because this module maps to a CEH v13 wireless domain, you may run a campus lookalike AP, and “I was practicing” covers it.
True or False
Knowledge Check
APPLY: You are filling rogue-ap-notes.txt. Which pairing matches the lesson and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice