Greek creates the Wifiphisher tool!

Wifiphisher: A Greek security programmer released a tool that can make obtaining passwords from a WiFi network easier. How? Let's see the tool from the beginning.

Wifiphisher tool that quickly mounts automated phishing attacks against WPA networks in order to obtain the secret passphrase. It is a social engineering attack tool that unlike other methods does not involve any brute forcing. It is an easy way to obtain WPA passwords.

The new tool runs on Kali Linux and is distributed under the MIT license.

From the victim's perspective, the attack occurs in three phases:

• The victim stops connecting to their access point. Wifiphisher reaches all devices connected to a wifi by sending deauth packets to the client from the access point, from the access point to the client, and to the broadcast address.
• The victim connects to a malicious access point. Wifiphisher sniffs the router login page and copies the settings of the target access point. It then creates a malicious wireless access point modeled after the target page. It also sets up a NAT/DHCP server and forwards the correct ports. As a result, due to the interference, clients will start connecting to the malicious access point. After this phase, the victim is MiTMed (man-in-the-middle).
• The victim is taken to a realistic router configuration page. Wifiphisher uses a minimal web server that responds to HTTP and HTTPS requests. Once the victim requests a page on the Internet, the new phisher will respond with a realistic fake page asking for a WPA password confirmation due to a router firmware upgrade.

The developer of the tool is George Hadjisofroniou and it is intended for penetration testing purposes.

Source: secnews.gr