Manna from Heaven: Improving the State of Wireless Rogue AP Attacks
summary
Toolkit called Mana modifies patched hostapd to emulate broadcast and directed probe responses, harvests per-MAC preferred-network lists, and replays thousands of ESSIDs in loud mode; it captures WPA/WPA2/EAP handshakes, sends hashes to cloud crackers and auto-crack WPA captures to join networks, runs a no-upstream captive portal with SSLsplit plus an HSTS bypass via DNS proxy, can push a rogue CA to mobile devices, and exposes credentials into per-user Firefox profiles — released on GitHub and proven at large events.
AI-written summary · about
chapters (21)
- 0:00Introduction to Wi-Fi hacking
- 1:34Evolution of Wi-Fi attacks
- 5:15Modern Wi-Fi security challenges
- 6:42Introducing the Mana toolkit
- 8:20Understanding Wi-Fi management
- 10:51Fixing the Karma attack
- 12:47Demonstrating the Mana fix
- 14:26Tracking and profiling with drones
- 17:56Bypassing MAC randomization
- 21:02Broadcasting network lists
- 22:18Attacking secure networks
- 23:50Automating EAP cracking
- 25:39Securing credentials demonstration
- 27:15Man-in-the-middle attacks
- 30:47Captive portal exploitation
- 32:09Bypassing HSTS
- 34:24HSTS bypass demonstration
- 36:51FireLham session hijacking
- 37:52Demonstrating FireLham
- 38:50Data collection and closing
- 42:13Tool availability and Q&A
related talks
33mWi-Fi Brokering
40mRogue One: A Wifi Story
52mWi-Fi Hacking for Web Pentesters
59mD1T1 - Real World Attacks Against Secure Elements
47mKey Reinstallation Attacks: Breaking the WPA2 Protocol
40mSweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks
27mWIFI-Important Remote Attack Surface: Threat is Expanding
22mWhat really happens when you connect to public Wi-Fi?