hostapd-mana
Overview
A featureful rogue access point first presented at Defcon 22 by Dominic White (@singe) & Ian de Villiers @ sensepost ([email protected])
Documentation
Check the wiki for information of getting and using hostapd-mana.
Features
- KARMA/MANA Mode - respond to any device looking for an SSID as that network (probe response)
- MANA Loud - re-broadcast probe responses for SSIDs learned from other devices
- Taxonomy Signatures - Capture partial and full taxonomy signatures for pre-assoc/assoc stations for deanonymisation of random MACs
- SSID allow list - Only allow certain SSIDs to be rebroadcast
- MANA MAC ACLs - proportionality options to define flexible ACLs to only respond to specific stations, manufacturers or random/non-random MACs
- WPE EAP Credential Capture - Capture recoverable credential material from over 16 different EAP modes
- EAP-TLS - Accept any client certificate for stations that don't perform proper server cert validation
- EAP Sycophant - Relay inner PEAP using the sycophant supplicant to get a dual client association and association to target network without cracking password
- EAP Success - Send EAP Success even when EAP fails, some supplicants will forget the EAP auth failed and join anyway
- WPA2 Half-Handshake Capture - Capture WPA2 half-handshakes (in hashcat mode 22000) for unseen networks (with MANA mode)
License
The patches included in hostapd-mana by SensePost are licensed under the BSD license. Permissions beyond the scope of this license may be available at http://sensepost.com/contact us/. hostapd's code retains it's original license available in COPYING.