Top Related Projects
The Rogue Access Point Framework
This is a multi-use bash script for Linux systems to audit wireless networks.
DEPRECATED, wifipumpkin3 -> https://github.com/P0cL4bs/wifipumpkin3
Targeted evil twin attacks against WPA2-Enterprise networks. Indirect wireless pivots using hostile portal attacks.
*DEPRECATED* mana toolkit for wifi rogue AP attacks and MitM
Rewrite of the popular wireless network auditor, "wifite"
Quick Overview
Fluxion is an open-source security auditing and social engineering tool designed for testing WiFi network security. It creates a fake access point to capture WPA/WPA2 passwords and performs man-in-the-middle attacks. Fluxion is intended for educational purposes and security testing with proper authorization.
Pros
- User-friendly interface with automated attack processes
- Supports multiple languages and customizable attack scenarios
- Regularly updated with new features and improvements
- Effective for demonstrating WiFi security vulnerabilities
Cons
- Potential for misuse in unauthorized network attacks
- Requires root privileges and specific hardware compatibility
- May trigger antivirus software as a potential threat
- Limited to WiFi security testing, not a comprehensive security suite
Getting Started
To get started with Fluxion:
-
Clone the repository:
git clone https://github.com/FluxionNetwork/fluxion.git
-
Navigate to the Fluxion directory:
cd fluxion
-
Run the installation script:
sudo ./fluxion.sh -i
-
Launch Fluxion:
sudo ./fluxion.sh
Note: Ensure you have the necessary dependencies installed and are using a compatible wireless adapter. Always obtain proper authorization before testing on any network.
Competitor Comparisons
The Rogue Access Point Framework
Pros of wifiphisher
- More active development and maintenance
- Broader range of attack scenarios and customization options
- Better documentation and community support
Cons of wifiphisher
- Steeper learning curve for beginners
- Requires more system resources to run effectively
- Less focus on automated credential harvesting
Code comparison
wifiphisher:
def start(self):
"""
Start the engine.
"""
self.network_manager.start()
self.template_manager.start()
self.phishing_http_server.start()
self.phishing_manager.start()
fluxion:
startEvilTwin() {
if [ "$FLUXIONAPServiceEnable" = "true" ]; then
startNetworkManager
startAccessPoint
startDHCPService
fi
}
The code snippets show different approaches to starting services. wifiphisher uses a more modular, object-oriented Python structure, while fluxion employs a bash script with conditional statements for service initialization.
Both tools are designed for Wi-Fi security testing, but wifiphisher offers more flexibility and features at the cost of complexity. Fluxion focuses on simplicity and ease of use, particularly for automated evil twin attacks and credential harvesting.
This is a multi-use bash script for Linux systems to audit wireless networks.
Pros of airgeddon
- More comprehensive set of wireless attack tools and techniques
- Regular updates and active development
- Extensive documentation and user guides
Cons of airgeddon
- Steeper learning curve due to more complex features
- Requires more system resources to run effectively
Code Comparison
airgeddon:
#!/usr/bin/env bash
#Title........: airgeddon.sh
#Description..: This is a multi-use bash script for Linux systems to audit wireless networks.
#Author.......: v1s1t0r
#Version......: 10.40
#Usage........: bash airgeddon.sh
fluxion:
#!/usr/bin/env bash
# FLUXION 3 (rev. 3)
# Fluxion is the future of MITM WPA attacks
# By: vk496
# Modded: deltax
Both projects are written in Bash and focus on wireless network auditing. airgeddon appears to have a more detailed header with version information and usage instructions, while fluxion's header is more concise.
airgeddon offers a wider range of features and attack vectors, making it more versatile but potentially more complex for beginners. fluxion, on the other hand, specializes in MITM WPA attacks, which may make it more accessible for users focusing on this specific technique.
Both projects are actively maintained, but airgeddon seems to have more frequent updates and a larger community of contributors. This could lead to better long-term support and feature development for airgeddon.
DEPRECATED, wifipumpkin3 -> https://github.com/P0cL4bs/wifipumpkin3
Pros of WiFi-Pumpkin-deprecated
- More comprehensive suite of tools for wireless network attacks and analysis
- Includes a graphical user interface for easier use
- Supports a wider range of attack vectors and network manipulation techniques
Cons of WiFi-Pumpkin-deprecated
- No longer actively maintained, potentially leading to security vulnerabilities
- May have compatibility issues with newer systems and hardware
- Less focused on social engineering aspects compared to Fluxion
Code Comparison
WiFi-Pumpkin-deprecated:
class PumpkinProxy(ProxyPlugin):
name = "PumpkinProxy"
descr = "Intercepting HTTP data"
def request(self, flow):
# Custom request handling
Fluxion:
handshake_capture() {
xterm -hold -e airodump-ng --bssid "$bssid" -c "$channel" -w "$tmp_dir/capture" "$interface" &
airodump_pid=$!
}
The code snippets highlight the different approaches:
- WiFi-Pumpkin-deprecated uses Python for its core functionality, including a proxy plugin system.
- Fluxion primarily uses Bash scripting for its operations, focusing on command-line tools.
Both projects aim to provide tools for wireless network security testing, but WiFi-Pumpkin-deprecated offers a more extensive toolkit with a GUI, while Fluxion specializes in social engineering attacks using a command-line interface.
Targeted evil twin attacks against WPA2-Enterprise networks. Indirect wireless pivots using hostile portal attacks.
Pros of eaphammer
- More focused on enterprise wireless network attacks and assessments
- Supports advanced features like hostile portal attacks and indirect wireless pivots
- Actively maintained with regular updates and improvements
Cons of eaphammer
- Steeper learning curve due to more complex features
- Requires more setup and dependencies compared to Fluxion
- Less user-friendly for beginners in wireless security testing
Code Comparison
eaphammer:
def hostile_portal():
print("[*] Launching Hostile Portal attack...")
# Complex code for advanced wireless attack
# ...
Fluxion:
function fake_ap() {
echo "Creating fake access point..."
# Simpler code for basic wireless attack
# ...
}
Summary
eaphammer is a more advanced tool focused on enterprise wireless security testing, offering sophisticated features but with a steeper learning curve. Fluxion, on the other hand, is more user-friendly and easier to set up, making it suitable for beginners. eaphammer's code tends to be more complex, reflecting its advanced capabilities, while Fluxion's code is generally simpler and more straightforward. Both tools have their place in wireless security testing, depending on the user's skill level and specific requirements.
*DEPRECATED* mana toolkit for wifi rogue AP attacks and MitM
Pros of mana
- More comprehensive toolkit for WiFi auditing and attacks
- Supports a wider range of attack vectors and scenarios
- Actively maintained with regular updates
Cons of mana
- Steeper learning curve due to more complex features
- Requires more advanced networking knowledge to use effectively
- May be overkill for simpler penetration testing tasks
Code Comparison
mana:
def start_ap():
os.system("airmon-ng start wlan0")
os.system("airbase-ng -e 'Free WiFi' -c 6 wlan0mon")
fluxion:
function startAP() {
xterm -hold -e "airbase-ng -c $channel --essid '$essid' -W 1 $interface" &
sleep 2
}
Key Differences
- mana offers a more extensive set of tools for various WiFi-related attacks and auditing
- fluxion focuses primarily on social engineering attacks against WPA/WPA2 networks
- mana requires more setup and configuration, while fluxion aims for a more streamlined user experience
- fluxion's interface is more user-friendly for beginners in penetration testing
- mana provides more flexibility for advanced users and complex scenarios
Rewrite of the popular wireless network auditor, "wifite"
Pros of wifite2
- More comprehensive and automated tool for wireless auditing
- Supports a wider range of attack methods and wireless protocols
- Actively maintained with regular updates and bug fixes
Cons of wifite2
- Requires more technical knowledge to use effectively
- May be considered more intrusive and potentially illegal in some contexts
- Lacks the social engineering aspect present in Fluxion
Code Comparison
wifite2:
def crack_handshake(handshake, wordlist):
cmd = [
'aircrack-ng',
'-w', wordlist,
'-b', handshake.bssid,
handshake.capfile
]
proc = Process(cmd)
return proc.stdout()
Fluxion:
function unset_interface() {
if [ "$WIFI_MONITOR" ]
then
${AIRMON} stop "$WIFI_MONITOR" > /dev/null 2>&1
WIFI_MONITOR=""
fi
}
The code snippets show different approaches:
- wifite2 uses Python for core functionality, including external tool execution
- Fluxion primarily uses Bash scripting for system interactions and tool management
Both tools aim to audit wireless networks, but wifite2 focuses on automated attacks, while Fluxion emphasizes social engineering techniques. wifite2 is more feature-rich and actively maintained, but Fluxion offers a unique approach to obtaining network credentials through user deception.
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
Fluxion is the future of MITM WPA attacks
Fluxion is a security auditing and social-engineering research tool. It is a remake of linset by vk496 with (hopefully) fewer bugs and more functionality. The script attempts to retrieve the WPA/WPA2 key from a target access point by means of a social engineering (phishing) attack. It's compatible with the latest release of Kali (rolling). Fluxion's attacks' setup is mostly manual, but experimental auto-mode handles some of the attacks' setup parameters. Read the FAQ before requesting issues.
If you need quick help, fluxion is also available on gitter. You can talk with us on Gitter or on Discord.
Installation
Read here before you do the following steps.
Download the latest revision
git clone git@github.com:FluxionNetwork/fluxion.git
# Or if you prefer https
git clone https://www.github.com/FluxionNetwork/fluxion.git
Switch to tool's directory
cd fluxion
Run fluxion (missing dependencies will be auto-installed)
./fluxion.sh
Fluxion is also available in arch
cd bin/arch
makepkg
or using the blackarch repo
pacman -S fluxion
:scroll: Changelog
Fluxion gets weekly updates with new features, improvements, and bugfixes. Be sure to check out the changelog here.
:octocat: How to contribute
All contributions are welcome! Code, documentation, graphics, or even design suggestions are welcome; use GitHub to its fullest. Submit pull requests, contribute tutorials or other wiki content -- whatever you have to offer, it'll be appreciated but please follow the style guide.
:book: How it works
-
Scan for a target wireless network.
-
Launch the
Handshake Snooper
attack. -
Capture a handshake (necessary for password verification).
-
Launch
Captive Portal
attack. -
Spawns a rogue (fake) AP, imitating the original access point.
-
Spawns a DNS server, redirecting all requests to the attacker's host running the captive portal.
-
Spawns a web server, serving the captive portal which prompts users for their WPA/WPA2 key.
-
Spawns a jammer, deauthenticating all clients from original AP and luring them to the rogue AP.
-
All authentication attempts at the captive portal are checked against the handshake file captured earlier.
-
The attack will automatically terminate once a correct key has been submitted.
-
The key will be logged and clients will be allowed to reconnect to the target access point.
-
For a guide to the
Captive Portal
attack, read the Captive Portal attack guide
:heavy_exclamation_mark: Requirements
A Linux-based operating system. We recommend Kali Linux 2019.4. An external wifi card is recommended.
Verify commits
Now, every commit should be signed. You can verify the signator using git-verify-commit [commit]
.
Contributor | GPG key id |
---|---|
deltaxflux | 40EAE3B9D0FBCE9C |
:octocat: Credits
- l3op - contributor
- dlinkproto - contributor
- vk496 - developer of linset
- Derv82 - @Wifite/2
- Princeofguilty - @webpages and @buteforce
- Photos for wiki @http://www.kalitutorials.net
- Ons Ali @wallpaper
- PappleTec @sites
- MPX4132 - Fluxion V3
- usama7628674 - contributor
Disclaimer
-
Authors do not own the logos under the
/attacks/Captive Portal/sites/
directory. Copyright Disclaimer Under Section 107 of the Copyright Act 1976, allowance is made for "fair use" for purposes such as criticism, comment, news reporting, teaching, scholarship, and research. -
The usage of Fluxion for attacking infrastructures without prior mutual consent could be considered an illegal activity and is highly discouraged by its authors/developers. It is the end user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program.
Note
-
Beware of sites pretending to be related with the Fluxion Project. These may be delivering malware.
-
Use Parrot OS for Less Errors.
-
For WN722n V2/V3 VISIT - https://github.com/aircrack-ng/rtl8188eus
-
Fluxion DOES NOT WORK on Linux Subsystem For Windows 10, because the subsystem doesn't allow access to network interfaces. Any Issue regarding the same would be Closed Immediately
Links
Fluxion website: https://fluxionnetwork.github.io/fluxion/
Discord: https://discordapp.com/invite/G43gptk
Gitter: https://gitter.im/FluxionNetwork/Lobby
Top Related Projects
The Rogue Access Point Framework
This is a multi-use bash script for Linux systems to audit wireless networks.
DEPRECATED, wifipumpkin3 -> https://github.com/P0cL4bs/wifipumpkin3
Targeted evil twin attacks against WPA2-Enterprise networks. Indirect wireless pivots using hostile portal attacks.
*DEPRECATED* mana toolkit for wifi rogue AP attacks and MitM
Rewrite of the popular wireless network auditor, "wifite"
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot