1. “Man in the Middle” and Wifi Jamming
Jean Pierre Castillo
John Abbott

2. Introduction
This project is designed to illustrate the ease that a man in the middle or similar type of attack can be accomplished through inherent vulnerabilities that exist within wireless network connections.
We will also demonstrate how we may detect and counter or even initiate such an attack using something like the Raspberry Pi programmed with a Wifi Jammer and a few tools which may be compiled.
It is also a worthwhile undertaking as it simultaneously uses one of the biggest known risks in cybersecurity, human error.

3. Setup
We plan to set up the login page to look like the Mercy Blackboard page and name our network “Maverick -unsecure”. The network we will be setting up will not have any internet so everything will be contained on the Raspberry Pi.
During this time lapse there shall be a second Raspberry Pi setup to show real-time detection of any rogue access points on the network. This second Pi should ideally be able to detect the first Pi shortly after it connects to the network. And if fortunate, before the first one is able to, it should successfully gather any information/credentials.
The Wifi Jammer will then kick off any of the unauthorized guests of Maverick-unsecure.

4. Concepts and Goals
The general concept chosen is a wifi configuration on a RPI being penetrated and then implementing an automated response to protect the network.
In this type of scenario, of using access points and wireless connections, security concerns between the access point and stations have a high chance of occurence.
The end goal would be identifying the phishing usernames and passwords on a network using a Raspberry Pi as an access point. From another perspective we are also using the access point as a honeypot. (Essentially)
One Raspberry Pi will be utilized as a captive portal: The wifi access point that the potential victims visit will be nothing more than misdirection. It will actually be leading aforementioned user to our login page where they will input their credentials to login normally.

5. Initial Wifi AP Setup

6. Setting up Host AP

7. WLANS info.
- WLAN is a group of wireless networking devices limited to a given location such as a building. It utilizes radio communications in order to transfer data.
-WLAN technologies are based on the IEEE standard: The fundamental components of an IEEE WLAN are devices (i.e. laptops, mobile devices, and access points, which logically connect client devices with a distribution system, typically the organization’s wired network infrastructure. Some WLANs also use wireless switches, which act as intermediaries between APs and the distribution system
-WLANs are typically less secure than hardwired alternatives:
Ease of access to WLAN
WLANs favor convenience over strong security leading to weaker security configurations.

8. Connecting to the AP/

9. Network Jamming
We will be utilizing a Raspberry Pi with Kali Linux to scan and analyze the access point in order to find any vulnerabilities.
The application we chose to jam the wifi network is known as Websploit. It uses wifi deauthentication in order to jam the wifi signal, which is unique and differs greatly in operation from the more commonly known exploit of radio jamming (involving frequencies).
This application uses wifi deauthentication:
A DoS attack that specifically targets the communication between user and access point.
It takes advantage of the connection as the IEEE protocol inherently has the deauthentication frame.
This frame may be sent to the wireless access point as long as the MAC address is known.
This forces the client to stop using the ap and try to reauthenticate (ideally into our ap/honeypot).

10. Setting up Wifi Jammer

11. (Rogue) Wifi AP Demo

12. Wifi Jamming Demo (Websploit)

13. Future Goals
Our future ambitions include being able to have all devices in a certain area forcibly try and use the Raspberry Pi to log in and pull even small amounts of data and then successfully boot the user to log in legitimately to the school’s network: All the while not being wise to the attack.
Another goal would be to have the system do all of this autonomously through an API so that all an individual would have to do is plug it in and let it run for as long as possible.