How I Stole Your Username & Password In Five Minutes Using WiFiPhisher.

Phishing is easily the most commonly used hack to gain a persons usernames and passwords. In this article I will show you how a hacker can easily get your private data in a "public" Wifi (I explain later why I wrote public in quotes) without you even noticing.

Disclaimer: Any actions and or activities related to this article is your responsibility. Hacking without any permission is illegal and could even land you in jail!

I'm a big fan of the Raspberry Pi, because it's so stealthy. With the right software, you could even control it with your smartphone. No one would ever notice that you are stealing credentials in a "public" Wifi with your smartphone.
But how is this done?

There are various tools outside that simplify phishing. In this case, we'll assume that we use a very simple, but powerful tool called wifiphisher. Check it out, it's an incredible tool!

In order to use wifiphisher, you'll need two network wireless adapters that support monitor mode and of course a linux based OS. Here's a list for the top wireless adapters: Buy the best wireless network adapter.

You are prepared for the next phase! Wifiphisher works in three steps:

• 1. Deauthentication of the victim from the access point.
• 2. Victim joins a rogue access point (or also called evil twin).
• 3. Victim is being served a realistic specially-customized phishing page.
     

In the first step, we continuously jam all of the target access point's wifi devices within range by forging “Deauthenticate” or “Disassociate” packets to disrupt existing associations.

Here's how it looks like when wifiphisher starts:

In the second step, wifiphisher sniffs the area and copies the target access point's settings.

Now it shows you the available wifi's:

Choose the wifi you want to. It's that simple. Just type in your settings and choose your customized phishing page. You can also create your own phishing page.

The page could look like this:

Now wait to see if a victim types in their credentials. The gained passwords will be shown to you in plain text! Wifiphisher was released back in 2015 and it's still being updated.

If everthing is set up, you are ready to goooooooo! Equipped with; your backpack, one Raspberry Pi, two wireless network adapters and wifiphisher, all the wifi passwords, facebook passwords and alot of other passwords aren't safe anymore!

Now to the quotes on the "public". You could also set up your own hotspot, remove the password so that everyone can join and hack it with wifiphisher. You can name your hotspot like:"FREE WIFI" or "Public WIFI", to trick victims to connect to your wifi. This is a bit stealthier than hacking a real public wifi. When a victim connects to the wifi and types in his facebook credentials, the data is sent unencrypted to your command line!

But this isn't the only thing wifiphisher can do... You can also use it to perform a MITM attack:

• Data sniffing
• Data modification
• Malware infection

The script is based on an idea from Dan McInerney back in 2015. Praise him for this incredible tool!

Happy legal hunting!

Main Image Credit : The awesome piece of artwork used to head this article is called 'Phishing' and it was created by graphic designer NowSourcing.