← retour aux outils back to tools

# hostapd-mana

hostapd patché pour les attaques de type Karma / rogue AP : capture les probe requests et les handshakes et associe automatiquement les clients qui recherchent des SSID connus. Patched hostapd for rogue AP / Karma-style attacks — captures probe requests and handshakes and auto-associates clients probing for known SSIDs.

↗ https://github.com/sensepost/hostapd-mana

## Overview

hostapd-mana is a modified build of hostapd that implements the Karma and MANA attacks against WiFi clients. Devices constantly broadcast probe requests for previously-joined networks; hostapd-mana listens for these and responds as if it were that network, tricking clients into auto-connecting to a rogue AP. It also captures WPA/WPA2 handshakes from any client that associates, and can log loud/quiet MANA probe activity for later analysis.

## Common Usage

Basic Karma mode — respond to any probed SSID

    hostapd-mana /etc/hostapd-mana/hostapd-karma.conf

Loud MANA mode (respond to all probes, broadcast known SSIDs)

    hostapd-mana /etc/hostapd-mana/hostapd-mana.conf

Run in the foreground with debug output

    hostapd-mana -dd /etc/hostapd-mana/hostapd-mana.conf

## Example config snippet

    # hostapd-mana.conf
    interface=wlan0
    driver=nl80211
    ssid=Free WiFi
    channel=6
    mana_wpaout=/tmp/mana-handshakes.hccapx
    mana_loud=1
    enable_mana=1

## Notes

- Requires a wireless adapter capable of AP mode and packet injection.
- Combine with `dnsmasq` (for DHCP/DNS) and `airbase-ng`/`bettercap` for a full rogue-AP + captive-portal chain.
- Captured handshakes (`.hccapx`) feed directly into hashcat for offline WPA cracking.

Help / Man page

    hostapd-mana [-hdBKtv] [-P PID_FILE] [-e ENTROPY_FILE] <configuration file(s)>

      -h   show this help
      -d   show more debug messages (-dd for even more)
      -B   run daemon in the background
      -K   include key data in debug messages
      -t   include timestamps in some debug messages
      -v   show hostapd version

    MANA options (in config file):
      enable_mana=1        enable Karma/MANA response mode
      mana_loud=1           reply to all probe requests, not just known SSIDs
      mana_mac_acl=0        disable MAC filtering
      mana_wpaout=FILE      write captured WPA handshakes to FILE
      mana_eapsuccess=1     force EAP success for enterprise capture
      mana_eaptls=1         force TLS EAP success

## Vue d’ensemble

hostapd-mana est un build modifié de hostapd qui implémente les attaques Karma et MANA contre les clients WiFi. Les appareils diffusent constamment des probe requests pour des réseaux précédemment rejoints ; hostapd-mana les écoute et répond comme s’il était ce réseau, piégeant les clients pour qu’ils se connectent automatiquement à un point d’accès pirate. Il capture aussi les handshakes WPA/WPA2 de tout client qui s’associe, et peut journaliser l’activité de probe MANA en mode bruyant ou silencieux pour une analyse ultérieure.

## Utilisation courante

    # Mode Karma de base : répondre à tout SSID probé
    hostapd-mana /etc/hostapd-mana/hostapd-karma.conf

    # Mode MANA bruyant (répondre à tous les probes, diffuser les SSID connus)
    hostapd-mana /etc/hostapd-mana/hostapd-mana.conf

    # Lancer au premier plan avec sortie de debug
    hostapd-mana -dd /etc/hostapd-mana/hostapd-mana.conf

## Extrait de configuration exemple

    # hostapd-mana.conf
    interface=wlan0
    driver=nl80211
    ssid=Free WiFi
    channel=6
    mana_wpaout=/tmp/mana-handshakes.hccapx
    mana_loud=1
    enable_mana=1

## Notes

- Nécessite une carte sans fil capable de mode AP et d’injection de paquets.
- Combiner avec `dnsmasq` (pour DHCP/DNS) et `airbase-ng`/`bettercap` pour une chaîne complète rogue-AP + portail captif.
- Les handshakes capturés (`.hccapx`) alimentent directement hashcat pour un cassage WPA hors ligne.

Aide / Page de manuel

    hostapd-mana [-hdBKtv] [-P PID_FILE] [-e ENTROPY_FILE] <configuration file(s)>

      -h   show this help
      -d   show more debug messages (-dd for even more)
      -B   run daemon in the background
      -K   include key data in debug messages
      -t   include timestamps in some debug messages
      -v   show hostapd version

    MANA options (in config file):
      enable_mana=1        enable Karma/MANA response mode
      mana_loud=1           reply to all probe requests, not just known SSIDs
      mana_mac_acl=0        disable MAC filtering
      mana_wpaout=FILE      write captured WPA handshakes to FILE
      mana_eapsuccess=1     force EAP success for enterprise capture
      mana_eaptls=1         force TLS EAP success