Evil-twin / rogue AP (enterprise credential harvesting)

When it applies

An authorized assessment of a WPA2-Enterprise (802.1X) network, or a captive-portal Wi-Fi, where clients can be lured to a look-alike AP. pentest-only, in-scope SSIDs recorded in scope.txt, and coordinated so you only capture test/consenting users' credentials per RoE.

Why it works

WPA2-Enterprise authenticates users to a RADIUS server, but many clients don't properly validate the RADIUS server's certificate. A rogue AP advertising the same SSID can complete enough of the PEAP-MSCHAPv2 exchange to capture each user's username + MSCHAPv2 challenge/response, which cracks offline to the domain password. Captive portals simply hand you the credentials the user types.

Method

1. Profile the target (wireless-wpa2-attacks recon): SSID, the EAP type (PEAP/EAP-TTLS), and whether clients validate the server cert (they often don't).
2. Stand up the evil twin. eaphammer (or hostapd-wpe): eaphammer --cert-wizard then eaphammer -i wlan0 --essid <SSID> --creds — advertises the SSID and runs a rogue RADIUS that logs credentials.
3. Lure clients — same SSID (and, per RoE, a stronger signal / brief targeted deauth of the real AP to prompt roaming). Keep disruption minimal and in-scope.
4. Capture & crack the PEAP-MSCHAPv2 username + challenge/response: hashcat -m 5500 netntlm.txt wordlist (or asleap) → domain password.
5. Captive-portal variant — clone the portal page on the rogue AP to capture typed creds directly; disclose per the SE guardrails in social-eng-methodology.
6. Pivot — validated creds feed network-password-spraying, VPN/OWA access, and AD work.

Gotchas

• You're capturing real people's credentials — this is human-adjacent: only in-scope SSIDs, coordinate with the client, minimize capture, and protect/destroy what you collect per RoE (treat like social-eng data discipline).
• Cert validation defeats it — clients that properly pin/validate the RADIUS cert won't leak; that's the positive finding (report "clients validate the server cert").
• Deauth/luring can be disruptive and out of RoE — confirm before forcing roaming.
• MSCHAPv2 capture format must match hashcat -m 5500 exactly — use the tool's emitted format.
• Legal line — capturing enterprise creds without explicit authorization is illegal; stop if scope is unclear (tradecraft-scope-roe).

Verify success

Captured PEAP-MSCHAPv2 credentials that crack to a working domain password (or portal creds that authenticate) — for in-scope, authorized users only, with a "clients don't validate the RADIUS cert" root cause for the report.

References

eaphammer / hostapd-wpe docs; hashcat mode 5500; PEAP-MSCHAPv2 weaknesses. Data discipline: social-eng-methodology; follow-on: network-password-spraying.