# Offensive Evil Twin

Evil Twin / KARMA / Mana access point methodology, rogue AP construction with...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-evil-twin -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-evil-twin -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-evil-twin -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-evil-twin -g -a gemini-cli -y`

## Description

Evil Twin / KARMA / Mana access point methodology, rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Evil Twin / KARMA / Mana

Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires.

## Quick Workflow

1. Discover target ESSID(s) clients are looking for (PNL, Preferred Network List)
2. Stand up rogue AP advertising matching ESSID(s)
3. (Optional) Deauth clients off legitimate AP to push them toward yours
4. Run captive portal / transparent MITM
5. Capture creds, deliver payload, or harvest sessions

---

## Variants

| Variant | Mechanic | Use Case |
|---|---|---|
| **Evil Twin** | Same ESSID + BSSID as legit AP | Open or PSK-known networks (ISP cafe Wi-Fi, public guest) |
| **KARMA** | Respond "yes" to every probe request | Clients with broad PNLs (most older devices) |
| **Mana** | Respond selectively to probes per-client | KARMA-aware MAC randomization defenses |
| **Known Beacons** | Beacon a list of likely-known ESSIDs | Wide-net attraction without seeing probes first |
| **Captive Portal** | Force splash page on association | Phishing, payload delivery |

## Open / PSK-Known Evil Twin

Use when you know (or have cracked) the PSK.

```bash
# wifiphisher, opinionated automation including portal templates
sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd

# airgeddon (interactive menu, good for one-off)
sudo airgeddon
# → Evil Twin attacks menu → Captive Portal

# Manual: hostapd + dnsmasq + iptables redirect
cat > /tmp/hostapd.conf <<EOF
interface=wlan0
driver=nl80211
ssid=CorpWiFi
hw_mode=g
channel=6
auth_algs=1
wpa=2
wpa_passphrase=KnownPSK
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF
sudo hostapd /tmp/hostapd.conf &

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/wireless/offensive-evil-twin/SKILL.md