Lion Cipher Lab
Understand and detect evil-twin and rogue access point attacks
- SOC Analyst / Blue Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
The 'evil twin' is one of the most approachable attacks in the world: an attacker stands up a Wi-Fi network with the same name as a real one — the airport's, the hotel's, the office's — and waits for devices to connect to their box instead. From that seat in the middle they can watch where you go, push fake sign-in pages, and try to harvest passwords. It is cheap, common, and it targets a habit almost everyone has: tapping the familiar network name without checking. The good news for a defender is that the attack leaves a visible fingerprint in the air — the same network name coming from two…
What you'll learn
- defining SSID, BSSID, and access point in plain language
- explaining how an evil twin and a rogue AP work
- observing your own Wi-Fi airspace read-only with a phone analyzer app
- reading airodump-ng output in monitor mode on your own adapter
- spotting one SSID advertised by two different BSSIDs (the duplicate-network tell)
- recognizing captive-portal phishing that asks for passwords or downloads
- understanding what a deauth (disconnect) attack is and why it herds you onto a fake AP
- hardening: verify networks, use a VPN, prefer WPA3 or certificate-based enterprise auth, disable auto-join
Steps in this lab
- The words first: SSID, BSSID, and access point
- What an evil twin and a rogue AP actually are
- The deauth nudge: how you get herded onto the fake
- Observe your own airspace #1: the phone analyzer (no special gear)
- Observe your own airspace #2: airodump-ng in read-only monitor mode (optional)
- Recognize captive-portal phishing
- Harden so the twin has nothing to grab
- What success looks like