Evil Twin Named
Evil twin = rogue AP mimicking a trusted SSID — threat model only, no deploy against public.
Visual · t15_evil_twin_named
Evil twin = look-alike AP to trick clients. Original Cyberlium.
Naming the twin is defense homework — deploying one against strangers is a crime.
An evil twin broadcasts the same or similar ESSID as a legitimate network, often stronger signal or cloned captive portal, to lure clients to authenticate to attacker hardware. Attackers harvest credentials or capture handshakes. Cyberlium teaches the threat model, client-validation gaps, and blue-team detection — NOT captive-portal kits, NOT twin APs pointed at coffee shops, NOT 'free Wi-Fi' traps for the public.
1. Threat model
Clone ESSID/BSSID confusion, rogue DHCP/DNS, fake portal pages.
Clients auto-reconnect to familiar SSID names — human factor + legacy settings.
Command guide
Try these commands — Threat model
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evil twin overview — https://www.wi-fi.org/discover-wi-fi/security MITRE T1557 — https://attack.mitre.org/techniques/T1557/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager
macOS: Use airport / System Settings
Windows: Use netsh wlan (built-in)
═══ LINUX / macOS ═══
Command — copy this
nmcli -f SSID,BSSID,SECURITY device wifi list 2>/dev/null | sort -u | head -20 grep never "$HOME/cyberlium-lab/t15-wifi/roe.txt" 2>/dev/null || echo 'REFUSE evil twin on café/public nets'
Primary tools to practice this lesson: nmcli, grep. Reference sites: Evil twin overview (https://www.wi-fi.org/discover-wi-fi/security); MITRE T1557 (https://attack.mitre.org/techniques/T1557/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Attacker goals
Capture PSK handshakes or enterprise creds on rogue AP.
MITM traffic after association — defender sees cert warnings if HTTPS holds.
3. Course boundary
No evil-twin deploy kits on public or neighbor airspace.
Lab discusses detection and client hardening on YOUR isolated $LAB_SSID twin demo only if brief explicitly allows isolated VLAN — never strangers.
4. What you ship: evil twin threat model
Define evil twin. Name attacker goals. NEVER deploy against public/strangers.
5. What you record before the next lesson
Threat model paragraph.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Spin up twin 'FreeAirportWiFi' at the mall to 'research.'
- Right: Name evil twin threat. Next: rogue AP detection.
Mission: evil twin threat sheet
1) Define evil twin in one paragraph. 2) Name two attacker goals. 3) Write NEVER deploy against public/strangers.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Evil twin vs rogue AP difference?”
APPLY: Evil twin mimics:
APPLY: True or False: Public evil twin labs are in scope.
APPLY: HTTPS with valid certs:
Rogue AP Detection
Part of Wireless Hacking — Evil Twin and Rogue AP Literacy.
Never Strangers
Part of Wireless Hacking — Evil Twin and Rogue AP Literacy.
Rogue Lab
Part of Wireless Hacking — Evil Twin and Rogue AP Literacy.