Setting Up and Running the Rogue AP
The last item on our list is the rogue AP configuration file.
We will run the AP with hostapd, which can be installed with apt.
We will be creating an 802.11n AP,
with the exact same SSID and channel as the AP we are targeting,
but we won’t be using any encryption.
Now that we have put all the pieces together,
let’s run hostapd and get some credentials.
We will run hostapd in the background with -B since it also logs in syslog.
Let’s open two terminal windows inspect the logs and check connections.
The first one will show us hostapd and udhcpd logs.
We will stand by and keep watching for new logs using tail -f.
The second part of the command, after the pipe,
will only show us logs from udhcpd and hostapd.
We find a station associated,
and its IP address,
from dnsmasq.
In the second terminal, we will monitor incoming Apache logs.
The output shows that a device was redirected back to the index page,
and that it gave the correct passphrase.
We can now search the temp directory for passphrase.txt,
and display its contents.
Excellent. We’ve captured the passphrase.