Wifiphisher is a rogue access point framework for conducting red team engagements and Wi-Fi security testing.
The tool addresses the challenge of achieving a man-in-the-middle position against wireless clients during penetration tests. It accomplishes this through targeted Wi-Fi association attacks using multiple techniques: Evil Twin creates a fake network mimicking legitimate ones, KARMA masquerades as public networks that nearby clients have searched for, and Known Beacons broadcasts common network names that stations have previously connected to. Simultaneously, the tool forges deauthentication and disassociation packets to disrupt existing connections and lure victims. Once positioned between client and network, testers can mount victim-customized web phishing attacks to capture credentials such as WPA/WPA2 Pre-Shared Keys or third-party login information, or deliver malware to connected stations.
Penetration testers conducting Wi-Fi security assessments should consider this tool if they need flexibility in attack scenarios and modularity for custom extensions. The framework supports dozens of configuration arguments and includes community-driven phishing templates for different deployment scenarios. Users can write Python modules to expand functionality or create custom phishing scenarios for target-oriented attacks. The tool runs efficiently on resource-constrained devices like Raspberry Pi and implements modern Wi-Fi association techniques. Beginners can start with a simple command-line invocation guided by an interactive text-based user interface, while advanced users have access to extensive configuration options.
Development activity shows consistent engagement with the codebase through regular commits addressing bug fixes and feature improvements. The project maintains active issue tracking with prompt responses to reported problems and feature requests. Pull requests receive timely review and integration, indicating ongoing maintenance. Documentation is regularly updated to reflect current functionality and usage patterns. The community contributes phishing templates and modules, with submissions being actively reviewed and incorporated into the main codebase.
