Rogue Lab
Detection notes only — survey YOUR lab AP; compare baseline; NO deploy against public nets.
Visual · t15_rogue_lab
Lab: rogue detection notes on $LAB_SSID. Original Cyberlium.
You are playing blue team on your bench — not red team at the mall.
On YOUR lab: record baseline survey of $LAB_SSID (BSSID, channel, security, signal). Power a second lab radio or document a simulated rogue entry in notes — how WIDS would flag duplicate SSID or unexpected wired MAC. Write containment steps. NO scripts to spawn twins on public channels, NO captive portal kits, NO testing against networks you do not own.
1. Baseline survey
Document authorized $LAB_SSID BSSID, channel, cipher, approximate RSSI at bench.
Save redacted screenshot or text — not neighbor ESSIDs.
Command guide
Try these commands — Baseline survey
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Rogue AP detect — https://www.wi-fi.org/discover-wi-fi/security Wireshark — https://www.wireshark.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager sudo apt install tcpdump
macOS: Use airport / System Settings
Windows: Use netsh wlan (built-in) Use Wireshark or install via WSL
═══ LINUX / macOS ═══
Command — copy this
nmcli -f SSID,BSSID,SECURITY,SIGNAL device wifi list 2>/dev/null | head -20 sudo tcpdump -i any -c 5 'wlan type mgt subtype beacon' 2>/dev/null || tcpdump -i any -c 3 -n 2>/dev/null | head -3
Primary tools to practice this lesson: nmcli, tcpdump. Reference sites: Rogue AP detect (https://www.wi-fi.org/discover-wi-fi/security); Wireshark (https://www.wireshark.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Simulated rogue finding
Describe how duplicate SSID or rogue BSSID would appear in controller/WIDS logs.
If brief allows second lab AP on isolated VLAN, compare — still $LAB_SSID scope only.
3. No deploy rule
This lab ships detection notes — not hostapd evil twin configs for public spaces.
Teardown: remove lab radios from monitor; no beacons left running.
4. What you ship: rogue detection lab notes
Baseline survey + simulated rogue alert + containment steps.
5. What you record before the next lesson
Detection lab notes path.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run evil twin portal script against campus Wi-Fi.
- Right: Detection notes on lab AP. Next: quiz.
Mission: rogue detection lab
1) Baseline survey $LAB_SSID. 2) Write rogue alert narrative (duplicate SSID scenario). 3) List containment steps — no public deploy.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Sample WIDS rogue alert fields?”
APPLY: Rogue lab ships:
APPLY: True or False: Evil twin deploy on café is homework.
APPLY: Baseline includes: