Evil Twin / KARMA / Mana

Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires.

Quick Workflow

1. Discover target ESSID(s) clients are looking for (PNL — Preferred Network List)
2. Stand up rogue AP advertising matching ESSID(s)
3. (Optional) Deauth clients off legitimate AP to push them toward yours
4. Run captive portal / transparent MITM
5. Capture creds, deliver payload, or harvest sessions

Variants