TL;DR: Wi-Fi spoofing is not a encryption attack. It is an identity attack: the attacker clones an SSID, uses a second BSSID, advertises a stronger signal and — if needed — sends deauthentication frames so clients reconnect to the twin. A captive portal then asks for the password users already know. WPA3 with PMF, 802.1X with certificate validation, auto-join off and duplicate-SSID monitoring are what turn a convincing twin into a failed attack.
The scenario
A site has two networks: a corporate SSID with WPA2-Enterprise and a guest SSID with a captive portal. Employees' phones and laptops remember both. Near reception, the corporate signal is weak; the guest signal is strong. Nobody thinks about it — that is the point.
An attacker with a second radio and a laptop sits in the car park. They do not need to crack WPA2. They need the client to make a choice — and then they need the user to type a password.
This article describes mechanics and defense. It is not a guide to attacking networks you do not own. Every active test belongs in an isolated lab or a written engagement with a scope. I removed all identifying network names and values.
The pattern
An SSID is a name, not an identity
A beacon frame is a public advertisement. It carries the SSID, the BSSID (the radio's MAC), the channel and the security parameters. Clients store a profile per SSID: "this is my network, this is how I authenticate."
The SSID can be duplicated by anyone. The BSSID is a MAC address and can be cloned. The security parameters can be copied — or downgraded. Nothing in WPA2 proves to the client that the AP is the one it expects. That is what WPA3 and 802.1X add.
Clients choose by signal, security and memory
When a saved network is in range, the client decides whether to join. The inputs are roughly:
- is the SSID in my profile list?
- does the security match what I stored?
- how strong is the signal?
- is this the BSSID I last used?
A twin wins on the third input: put the radio closer, or crank the transmit power, and the client sees a better version of the network it already trusts. Some clients roam to the strongest BSSID automatically. Others need a nudge.
Deauth is the nudge
Management frames — deauthentication and disassociation — are not encrypted in WPA2. An attacker can forge them and disconnect clients from the real AP. The clients reconnect, and now the stronger twin is the best candidate. This is why PMF (802.11w) matters: it signs management frames, so a forged deauth is rejected. WPA3 mandates PMF; WPA2 does not.
Deauth is also a blunt instrument. It is visible, it disrupts, and it is unnecessary if the twin already has the stronger signal. The quiet version is simply: better signal, same name, wait.
The captive portal does the rest
The twin answers DHCP and DNS. It hands out its own gateway and resolver, and every name resolves to a local portal. The portal looks like the guest login users have seen a hundred times: "Session expired, please sign in again."
The user types the corporate password. The attacker now has a credential to replay against SSO, VPN or mail. Even without a portal, the twin can intercept DNS and plaintext HTTP, serve a malicious profile, or use the client as a foothold into the corporate LAN.
What spoofing is not
- It is not WPA2 cracking. The attacker does not recover the PSK.
- It is not a router exploit. The router is fine; the client is being convinced.
- It is not defeated by a longer password. The user gives the password to the portal voluntarily.
- It is not always loud. The strongest version is a silent twin with a better signal and no deauth at all.
Detection signals that actually work
| Signal | Why it matters | What to do |
|---|---|---|
| Duplicate SSID with a new BSSID | The classic twin signature | Alert; compare against the authorised BSSID inventory |
| Security downgrade (WPA2 to OPEN) | A client should never accept it for a saved profile | Treat as critical; block auto-join |
| Same SSID on an unexpected channel | The real AP did not move | Investigate; correlate with AP inventory |
| RSSI jump from -70 to -35 dBm | Physically implausible without a new radio nearby | Triangulate; check for a rogue device |
| DHCP or DNS change on a known SSID | Rogue gateway or resolver | Compare against the expected DHCP options |
| Certificate errors on internal names | Interception or a portal | Do not click through; report |
| Captive portal on a corporate SSID | Corporate networks do not normally portal | Treat as hostile until proven otherwise |
A WIDS does this continuously. A laptop can spot-check it during an incident, but manual scanning is not a control.
Defense: identity, not just encryption
- WPA3-SAE with PMF. Signed management frames stop the deauth nudge; SAE removes the offline handshake attack surface.
- 802.1X with EAP-TLS. The client validates the AP's certificate. A cloned SSID without the private key cannot complete the handshake.
- Server certificate validation on clients. If the supplicant is configured to trust any certificate, 802.1X is decoration.
- Auto-join off for sensitive SSIDs. The client should not silently join a remembered corporate network in a public place.
- VPN or DNS over HTTPS on guest networks. Protects the traffic that still leaves the client after association.
- WIDS/WIPS and a BSSID inventory. You cannot alert on a twin if you do not know which BSSIDs are yours.
- Guest isolation and no WPS. A guest client should not reach the corporate VLAN; WPS should be off everywhere.
- User training that names the trick. "If the corporate Wi-Fi asks you to sign in again, stop and call IT" is a better control than another password rule.
The lab: simulate before you touch a radio
The Wi-Fi audit toolkit in this repo runs in simulation by default. WIFI_SIM=1 produces synthetic APs, clients, deauth counts and portal credentials; no radio is touched. That is enough to test the logic, the UI and the report — and it is the only responsible way to demo spoofing on a laptop.
Real radio work is Track B: a Linux host with a USB adapter that supports AP and monitor mode (or a Raspberry Pi), hostapd, dnsmasq and a captive portal. An M1 Mac cannot do monitor mode or frame injection on its internal Wi-Fi, and airport was removed from modern macOS. Simulation first, hardware second, scope always.
Closing
The twin does not need a vulnerability. It needs a client that trusts a name, a user who trusts a portal, and a network team that never inventoried its own BSSIDs.
The password was never the weak point. The identity check was.
Once an attacker gains access, they can perform the following actions:
All network names and values are synthetic. No radio transmission, no credential capture, no third-party testing. Active Wi-Fi testing requires written authorization and an isolated lab.