In this article, you’ll learn how to capture Facebook passwords using a captive portal page.
For those who don’t know, a captive portal is a customized login page that is displayed to newly connected users of a Wi-Fi network before they are granted access to the network.
Captive portals are typically used by business centers, airports, coffee shops, and other places that offer free Wi-Fi hotspots for Internet users.
Users can freely connect to these networks without a password and will often be directed to a login page where a password is required before being allowed to browse the web.
The danger in using these types of networks is that an attacker can create a fake network with the same login page and steal login credentials. To demonstrate the attack, I will use Wifiphisher.
Install Wifiphisher
To install the tool, open a Linux terminal and type:
apt install wifiphisher
This command should install Wifiphisher on your system. At this point, you can start the evil access point with the captive portal page by using the following command.
wifiphisher --essid “FREE WiFi” -p oauth-login –nD
--essid “FREE WiFi” is the wireless network name.
-p oauth-login is the captive portal page asking for Facebook credentials to provide internet access to the users.
-nD this option will skip the deauthentication phase.
Now the attack is running. If someone connects to my fake AP (FREE-WiFi) and opens his browser, he will get a phishing page saying “Get connected to the Internet for free” as shown in the image below.
This is a great option for public places like Starbucks or the library. Since people are always looking for “FREE” Internet.
Now If the victim enters their password, it will be captured on Wifiphisher as shown below.
Here you can see the email “jack@gmail.com” and the password ”Letmein123”.
Conclusion
Using public Wi-Fi networks makes you vulnerable to this kind of attack. So avoid providing any sensitive information like login credentials while using a public Wi-Fi network. This tool is for educational purposes only, and not for causing malicious or damaging attacks.
Tags: ethical hacking, cybersecurity, penetration testing, web hacking, network security, wifi hacking, linux security, hacking basics.