offensive-evil-twin
Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.
npx skills add SnailSploit/Claude-Red --skill offensive-evil-twin --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Evil Twin / KARMA / Mana Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires. ## Quick Workflow 1. Discover target ESSID(s) clients are looking for (PNL — Preferred Network List) 2. Stand up rogue AP advertising matching ESSID(s) 3. (Optional) Deauth clients off legitimate AP to push them toward yours 4. Run captive portal / transparent MITM 5. Capture creds, deliver payload, or harvest sessions --- ## Variants | Variant | Mechanic | Use Case | |---|---|---| | **Evil Twin** | Same ESSID + BSSID as legit AP | Open or PSK-known networks (ISP cafe Wi-Fi, public guest) | | **KARMA** | Respond "yes" to every probe request | Clients with broad PNLs (most older devices) | | **Mana** | Respond selectively to probes per-client | KARMA-aware MAC randomization defenses | | **Known Beacons** | Beacon a list of likely-known ESSIDs | Wide-net attraction without seeing probes first | | **Captive Portal** | Force splash page on association | Phishing, payload delivery | ## Open / PSK-Known Evil
- Quick Workflow
- Variants
- Open / PSK-Known Evil Twin
- KARMA — Universal Probe Response
- Mana — Selective Per-Client Response
- Known Beacons Attack
- Deauth Coercion
- Captive Portal / Credential Capture
- Post-Association MITM
- MAC Randomization Defeat
- Detection Considerations
- Engagement Cheatsheet
- Key References
wifiphisher — opinionated automation including portal templates sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd airgeddon (interactive menu, good for one-off) sudo airgeddon cat > /tmp/hostapd.conf <<EOF sudo hostapd /tmp/hostapd.conf & DHCP/DNS via dnsmasq cat > /tmp/dnsmasq.conf <<EOF sudo dnsmasq -C /tmp/dnsmasq.conf -d hostapd-mana with KARMA mode enabled (mana_mode=1)
What does the offensive-evil-twin skill do?
Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.
How do I install it?
Run `npx skills add SnailSploit/Claude-Red --skill offensive-evil-twin --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From SnailSploit/Claude-Red, a repository with 2,808 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.