PAGES
← all tools
◆ Wireless & RF

wifiphisher

v1.4 open-source

Rogue Access Point framework for Wi-Fi phishing attacks, capturing credentials or delivering malware via Evil Twin, KARMA, and Known Beacons techniques.

source ↗ rss ↗ What is a cyber toolchain?

Summary

wifiphisher is an open-source, free command-line framework for staging rogue Wi-Fi access points, run from a laptop or a device like a Raspberry Pi against nearby wireless clients. It handles the association step itself, pushing targets onto an evil-twin or Known Beacons network, then hands off to customizable phishing pages to capture credentials or a WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2 pre-shared key, with a Python extension system for writing new attack modules or scenarios. It is built for penetration testers and red teamers who need a man-in-the-middle position against Wi-Fi clients rather than the access point itself. First committed in 2014 and still maintained by 51 contributors, though it has seen only one commit in the past year, worth checking for how actively issues are handled before relying on it.

Rogue Access Point framework for Wi-Fi phishing attacks, capturing credentials or delivering malware via Evil Twin, KARMA, and Known Beacons techniques.

How wifiphisher helps

Which nearby wireless clients can be pulled onto an access point they never chose to join?

forces association through evil-twin, KARMA, or Known Beacons techniques rather than waiting for a client to connect voluntarily

Can a target's Wi-Fi password be recovered without cracking a captured handshake?

serves a customized phishing page after association and validates the WPA/WPA2 passphrase the victim types against the real network before ending the attack

What will an actual victim see when they land on the rogue portal?

ships a set of community-built phishing templates styled after router firmware updates, OAuth logins, or network manager prompts, chosen to fit the deployment scenario

Is the fake network staying connected to a moving or channel-hopping target AP?

monitors the target's channel during the engagement and adjusts so the rogue AP keeps tracking it instead of silently dropping the impersonation

Does a captured credential actually belong to the network being tested, or is it garbage a suspicious user typed in?

checks submitted WPA/WPA2 keys against the real handshake before accepting them, filtering out failed guesses

Can a one-off social-engineering scenario be built without touching the core tool?

exposes a Python extension system so new attack modules or custom phishing flows can be written and dropped in without modifying the framework itself

all 6 features, with the evidence for each →

Languages

Not documented

Features

6 capabilities

Built from wifiphisher's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What wifiphisher offers you

  • Command-line interface1
  • Plugin API support1
  • Plugin system1
All capabilities 6 capabilities
Rogue Access Point Framework shipped Facilitates Wi-Fi phishing attacks such as Evil Twin, KARMA, and Known Beacons to capture credentials or deliver malware. 8 releases · 2 other sources · first seen Jul 2015

release 8 total

  • Introduces Known Beacons attack vector. v1.4 · Jan 2018 · source · release history
  • Adds Lure10 attack module for automatic association against Windows devices v1.3 · Apr 2017 · source · release history
  • Adds --quitonsuccess (-qS) flag to exit after a successful attack phase v1.3 · Apr 2017 · source · release history
  • Adds interactive scenario selection allowing users to choose attack vectors during runtime. v1.2 · Dec 2016 · source · release history
  • Adds a new Browser Plugin Update scenario template for social engineering. v1.2 · Dec 2016 · source · release history
  • Adds detection of AP vendor based on BSSID information. v1.2 · Dec 2016 · source · release history

docs

  • Rogue Access Point framework for Wi-Fi phishing attacks, capturing credentials or delivering malware via Evil Twin, KARMA, and Known Beacons techniques.

example

  • Automate phishing workflows by stopping the tool immediately once credentials are captured. wifiphisher --quitonsuccess -iI wlan0 v1.3 · Apr 2017 · source
Targeted AP Configuration shipped Allows targeting specific ESSIDs and configuring them as open or password-protected access points for phishing scenarios. 4 releases · 3 other sources · first seen Dec 2016

release

  • Adds WPA/WPA2 captured passphrase validation logic. v1.4 · Jan 2018 · source · release history
  • Adds channel monitoring to detect target AP channel switches. v1.4 · Jan 2018 · source · release history
  • Adds iOS and Android support in network manager imitation templates v1.3 · Apr 2017 · source · release history
  • Adds new recon module with improved target AP selection capabilities v1.3 · Apr 2017 · source · release history

example

  • Target a specific ESSID without manual selection to speed up automated testing. wifiphisher --essid <TARGET_ESSID> v1.2 · Dec 2016 · source
  • Rogue AP with firmware-upgrade phishing scenario wifiphisher -aI wlan0 -jI wlan4 -p firmware-upgrade --handshake-capture handshake.pcap
  • Target specific ESSID with password-protected twin wifiphisher --essid CONFERENCE_WIFI -p plugin_update -pK s3cr3tp4ssw0rd
Evil Twin Against Protected Networks shipped Enables Evil Twin attacks against WPA2/WPA3 password-protected networks by leveraging provided pre-shared keys or detected vendor information. 2 releases · 1 other source · first seen Dec 2016

Also counts toward: Command-line interface

release

  • Adds --internetinterface (-iI) argument to specify the interface providing Internet connectivity to victims v1.3 · Apr 2017 · source · release history
  • Adds --presharedkey flag to enable Evil Twin attacks against WPA2/WPA3 password-protected networks. v1.2 · Dec 2016 · source · release history

example

  • Launch an evil twin attack against a protected network by providing the pre-shared key. wifiphisher --essid <TARGET_ESSID> --presharedkey <PASSWORD> v1.2 · Dec 2016 · source
OAuth Credential Harvesting shipped Delivers phishing pages to capture OAuth credentials via rogue access points. 2 releases · 1 other source · first seen Dec 2016

release

  • Adds support for logging multiple POST values in the phishing server responses. v1.2 · Dec 2016 · source · release history
  • Adds a new OAuth template for credential harvesting. v1.2 · Dec 2016 · source · release history

example

  • Open AP with OAuth phishing and Known Beacons wifiphisher --essid "FREE WI-FI" -p oauth-login -kB
Modular Extension Architecture shipped Supports modular plugins via an extension architecture for extending functionality. 1 release · first seen Jan 2018

Also counts toward: Plugin API support, Plugin system

release

  • Introduces Wifiphisher Extensions architecture for modular plugin support. v1.4 · Jan 2018 · source · release history
WPS Attack Capability shipped Enables WPS PIN and PBC phishing attacks to capture credentials from protected networks. 1 release · first seen Jan 2018

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for wifiphisher, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail wifiphisher puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

4 entries

  1. January 20181
  3. April 20171
  5. December 20161
  7. July 20151

    4 entries

    1. v1.4 Jan 12, 2018 · release notes

      v1.4 adds extensions, WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2 validation, Known Beacons, and --logging

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4 https://github.com/sophron/wifiphisher.git
# already have the repo? check out this version:
$ git checkout v1.4
      • Adds --logging CLI flag to enable detailed logging output.
      • Introduces Wifiphisher Extensions architecture for modular plugin support.
      • Adds WPA/WPA2 captured passphrase validation logic.
      • Introduces Known Beacons attack vector.
      • Adds WPS PBC phishing attack capability.
      +3 more show less
      • Adds wireless interface Internet sharing for victim users.
      • Adds channel monitoring to detect target AP channel switches.
      • Auto-kills interfering processes on startup.

      8 details in Everything

    2. v1.3 Apr 15, 2017 · release notes

      New CLI flags --quitonsuccess and --internetinterface, plus iOS/Android template support and Lure10 attack module.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.3 https://github.com/sophron/wifiphisher.git
# already have the repo? check out this version:
$ git checkout v1.3
      └──▷ USE IT
      Automate phishing workflows by stopping the tool immediately once credentials are captured.
      shell 
      wifiphisher --quitonsuccess -iI wlan0
      • Adds --quitonsuccess (-qS) flag to exit after a successful attack phase
      • Adds --internetinterface (-iI) argument to specify the interface providing Internet connectivity to victims
      • Adds iOS and Android support in network manager imitation templates
      • Adds new recon module with improved target AP selection capabilities
      • Adds Lure10 attack module for automatic association against Windows devices

      5 details in Everything

    3. v1.2 Dec 5, 2016 · release notes

      Adds --essid and --presharedkey flags for targeted attacks on password-protected networks

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.2 https://github.com/sophron/wifiphisher.git
# already have the repo? check out this version:
$ git checkout v1.2
      └──▷ TRY IT
      Target a specific ESSID without manual selection to speed up automated testing.
      $ wifiphisher --essid <TARGET_ESSID>
      Launch an evil twin attack against a protected network by providing the pre-shared key.
      $ wifiphisher --essid <TARGET_ESSID> --presharedkey <PASSWORD>
      • Adds --presharedkey flag to enable Evil Twin attacks against WPA2/WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. password-protected networks.
      • Adds --essid flag to skip the AP selection phase by directly specifying the target ESSID.
      • Adds interactive scenario selection allowing users to choose attack vectors during runtime.
      • Adds support for logging multiple POST values in the phishing server responses.
      • Adds a new Browser Plugin Update scenario template for social engineering.
      +3 more show less
      • Adds a new OAuth template for credential harvesting.
      • Adds a new Wi-Fi Connect scenario template.
      • Adds detection of AP vendor based on BSSID information.

      8 details in Everything

    4. v1.1 Jul 3, 2015 · release notes

      v1.1 adds Pineapple DD-WRT template and fixes Python 3 compatibility.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1 https://github.com/sophron/wifiphisher.git
# already have the repo? check out this version:
$ git checkout v1.1
      • Added support for Pineapple's DD-WRT.

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in sophron/wifiphisher, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog not measured open issues today
    1. Issues opened / month not measured
    2. Open backlog not measured
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 14,853
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Articles

    1 article · updated Nov 4, 2026

    Where wifiphisher turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.

    Tutorials & guides 1

    • WiFi Exploitation with WifiPhisher Hacking Articles
      Today we are going to demonstrate WIFI- Phishing attack by using the very great tool “WIFIphisher”, please read its description for more details.
      2 more quotes
      Wifiphisher is a security tool that mounts automated victim-customized phishing attacks against WiFi clients in order to obtain credentials or infect the victims with malware.
      Wifiphisher Working After achieving a man-in-the-middle position using the Evil Twin or KARMA attack, Wifiphisher redirects all HTTP requests to an attacker-controlled phishing page.

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback