Fluxion
Fluxion
Fluxion
Fluxion is a wifi Security analysis tool that can be used for WPA
and WPA2 hacking or other wifi attacks using the MITM (Man In
the Middle Attack) techniques. It is the future of wifi hacking and a
combination of technical and social engineering techniques that
force users to send WiFi passwords to attackers in plain text. In
short words, It’s a social engineering framework using the
following process
How to Use Fluxion for WPA /
WPA2 Hacking
● Scan the networks.
● Capture a handshake (can’t be used without a valid handshake,
it’s necessary to verify the password)
● Use WEB Interface *
● Launch a FakeAP instance to imitate the original access point
● Spawns an MDK3 process, which deauthenticates all users
connected to the target network, so they can be lured to connect
to the FakeAP and enter the WPA password.
● A fake DNS server is launched in order to capture all DNS
requests and redirect them to the host running the script
● A captive portal is launched in order to serve a page, which
prompts the user to enter their WPA password
● Each submitted password is verified by the handshake captured
earlier
● The attack will automatically terminate, as soon as a correct
password is submitted
Scan Wi-Fi Hotspot by Fluxion
When fluxion runs the first time, the first option is language
selection. So select your language by typing the number mentioned
next to the language on the screen, Press enter to proceed.
Select Channel: Channel selection is important, if you know the
target AP’s channel, you may enter 2 to narrow the scan to desired
channel. Otherwise, select option 1 to scan all channels and scan all
networks nearby you and take a little bit of time.
Choose Target WiFi Hotspot
When the scanning will be completed, all available access points
will be displayed on the screen. Every AP has a number next to it.
The selected target must have connected clients. This attack will not
work without any client. Select the Access point by entering the
number mentioned next to it.
Capture Handshakes
Handshakes are used by AP and clients at the time of establishing a
connection. Three methods are available to start getting a
handshake. The most powerful method is “airplay-ng de-
authentication (aggressive), use it. If not captured, use another
method. In the next screen, you can check the status of handshakes
by selecting the first option check handshake.
Create the Fake Login Page
Select option 1 for “Web Interface,” and social engineering tool will
be used. Select language and go ahead.
This is the final step to fire the attack, Press enter to launch the
attack. Multiple windows will be created to clone the version their
wireless network alongside jamming the normal access point and
the user will connect with a fake AP (unencrypted)
Now you have to just enter correct password and the fluxion will
capture it and will save it in the attacks>Net logs file.