wpa-sycophant
open-sourceThe section your link pointed to isn't on wpa-sycophant's page any more, so we've brought you to the top.
wpa_sycophant is a tool that relays phase 2 authentication attempts to access corporate wireless without cracking the password.
Summary
wpa-sycophant is an open-source command-line tool, free to use, that relays phase 2 PEAP/MSCHAPv2 authentication attempts to gain access to corporate wireless networks without cracking the captured password. It runs as a modified wpa_supplicant binary driven by a shell script, taking a config file and network interface as arguments, and it is meant to be paired with a rogue access point running hostapd-mana's enable_sycophant flag, which captures the first part of the challenge response for it to relay. This is a tool for wireless penetration testers running MSCHAP relay attacks rather than for defenders, and its README frames it as one half of an attack chain alongside hostapd-mana. First committed in 2018 with three contributors, it has seen no commits in the past year, so treat it as a historical reference implementation rather than an actively maintained tool.
wpa_sycophant is a tool that relays phase 2 authentication attempts to access corporate wireless without cracking the password.
How wpa-sycophant helps
Can I get onto a corporate wireless network without ever cracking the captured password?
relays the intercepted phase 2 MSCHAPv2 exchange live against the target network, so the authentication succeeds using the victim's credential in real time instead of a recovered password
Which corporate SSID am I actually able to authenticate against right now?
reads the SSID and blacklist settings from the config file, forcing the phase 1 and phase 2 parameters needed to relay against that specific network's PEAP setup
Will my rogue access point end up authenticating against itself instead of the real target?
takes a blacklisted BSSID in the config so the relay refuses to connect back to the rogue AP's own radio
How do I get the victim's challenge response into the relay without building my own capture path?
pairs with a rogue access point running a companion flag that writes down the first part of the challenge response, which it then picks up to start the handshake
Languages
Command line
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Release-note detail over time
See how much detail wpa-sycophant puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
Nothing shipped since we started watching. Releases and docs updates land here as they happen.
Project health
Issue, contributor and maintainer activity in sensepost/wpa_sycophant, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 0 ±0 vs prior 12 months
- Maintainers 0 +0 joined · −0 left, last 12 months
- Bus factor 0 committers behind half the commits
- Community-filed 100% of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog 2 of 6 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 2
- Contributors / month 0
- Commits / month 0
- Stars 221
- other 100%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →