less relevant here, though still of some concern. This may be less of an issue now, but
there was a time when employees would install their own APs at their companies
because the company didn’t offer WiFi. A potentially insecure AP was then bridged to
the corporate network, which might have allowed an attacker access to the corporate
network.
Rogue APs are a common problem because it’s so easy to create a wireless network
with an AP advertising an SSID. This may be a well-known AP. Because there is noth‐
ing that necessarily makes one clearer than another, it’s easy to stand up a rogue AP to
attack clients. This isn’t useful in and of itself, necessarily, from the standpoint of
security testing. It’s easy enough to determine that people, given the right location for
your rogue AP, will mistakenly attach to your network. Once they have done that, you
can collect information from them. This may provide you a way to gain access to the
legitimate network by collecting credentials that you can then use against the legiti‐
mate network.
Hosting an Access Point
Before we get into more traditional attacks, we should look at just using Linux—
specifically, Kali—to host an AP. This requires a couple of things. The first is a wire‐
less interface. Fortunately, we have one of those. We’ll also need the ability to feed
network addresses to our clients and then route the traffic that’s coming in. We can
do all of this with Kali Linux. First, we need to set up a configuration for
hostapd
. Kali
doesn’t include one by default, but there is an extensively documented sample in
/usr/
share/docs/hostapd
. To get an AP up and running, we’ll use a simple configuration,
which you can see in
Example 7-10
. We’ll be putting this into
/etc/hostapd
, but it
doesn’t much matter where it is because you tell
hostapd
where the configuration
file is.
Example 7-10. hostapd.conf
# hostapd.conf for demonstration purposes
interface
=
wlan0
bridge
=
br0
driver
=
nl80211
logger_syslog
=
1
logger_syslog_level
=
2
ssid
=
FreeWiFi
channel
=
2
ignore_broadcast_ssid
=
0
wep_default_key
=
0
wep_key0
=
abcdef0123
wep_key1
=
01010101010101010101010101
