Evil Twin
Definition
A rogue AP broadcasting the same ESSID as a legitimate network at a stronger signal, so clients with cached profiles auto-associate. Often paired with a captive portal that phishes the corporate or hotel password.
- Attack type
- Rogue wireless access point
- Technique
- Same ESSID as a legitimate network, broadcast at stronger signal
- Trigger
- Client devices auto-associate to cached network profiles
- Common payload
- Captive portal that phishes login credentials
Common questions
Why do client devices connect to the evil twin instead of the real network?+
Most devices auto-connect to any access point matching a previously saved network name and do not verify the access point's identity beyond that name, so a stronger rogue signal with the same ESSID wins the association.
How is an evil twin different from a standard rogue access point?+
A generic rogue AP just provides unauthorised network access. An evil twin specifically impersonates a known, trusted network to trick clients into connecting automatically, which makes it far more effective for credential theft or traffic interception.
Related terms
- 4-Way Handshake
- The WPA/WPA2 key-establishment exchange between client and AP. Captured frames let an offline dictionary attack recover a weak PSK. WPA3 replaces this...
- BSSID / ESSID
- BSSID is the MAC address of the access point (or virtual AP). ESSID is the human-readable network name broadcast in beacons. Multiple...
- IMSI Catcher
- A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones...
- KRACK
- Key Reinstallation Attack, CVE-2017-13077, disclosed by Mathy Vanhoef in 2017. By replaying message 3 of the 4-way handshake, the client is forced...
- PMKID Attack
- A 2018 technique by Jens Steube (hashcat author) that derives the Pairwise Master Key Identifier from a single EAPOL frame the AP...