u/mahdi_sto

Fit a WifiPumpkin3's rogue AP inside an ESP32s3 supporting APSTA, DNS spoofing, NAPT tunneling

Been digging into what the ESP32 WiFi stack is actually capable of for wireless security research and honestly it's way more powerful than people give it credit for.

The idea was to port the core concepts of WiFiPumpkin3 onto the chip itself. No Kali, no wifi interfaces, just a 5 bucks microcontroller powered from a USB bank.

The interesting part architecturally is running APSTA mode, the chip acts as an AP for clients while simultaneously connecting upstream as a STA to the real router. DNS spoofing handles captive portal redirection until the portal interaction is done, lets queries pass through to the real upstream. NAPT takes care of the internet tunneling so connected clients get actual internet access while causing traffic reorientation and thus sniffing it, which makes the whole thing behave like a legitimate hotspot. I tried to serve HTTPS directly from the chip with a cert generated for the spoofed domain but it didn't work, note that there's also a separate admin interface for scanning, cloning APs, monitoring traffic and managing everything in real time.

The main challenge was keeping DNS, HTTPS and NAPT tasks running concurrently on FreeRTOS without race conditions on a single radio doing two jobs at once.

Repo: github.com/mahdamin/ESP32-WiFiPumpkin

Happy to talk through the APSTA or NAPT implementation if anyone's done similar stuff.

Fit a WifiPumpkin3's rogue AP inside an ESP32s3 supporting APSTA, DNS spoofing, NAPT tunneling

Been digging into what the ESP32 WiFi stack is actually capable of for wireless security research and honestly it's way more powerful than people give it credit for.

The idea was to port the core concepts of WiFiPumpkin3 onto the chip itself. No Kali, no wifi interfaces, just a 5 bucks microcontroller powered from a USB bank.

The interesting part architecturally is running APSTA mode, the chip acts as an AP for clients while simultaneously connecting upstream as a STA to the real router. DNS spoofing handles captive portal redirection until the portal interaction is done, lets queries pass through to the real upstream. NAPT takes care of the internet tunneling so connected clients get actual internet access while causing traffic reorientation and thus sniffing it, which makes the whole thing behave like a legitimate hotspot. I tried to serve HTTPS directly from the chip with a cert generated for the spoofed domain but it didn't work, note that there's also a separate admin interface for scanning, cloning APs, monitoring traffic and managing everything in real time.

The main challenge was keeping DNS, HTTPS and NAPT tasks running concurrently on FreeRTOS without race conditions on a single radio doing two jobs at once.

Repo: github.com/mahdamin/ESP32-WiFiPumpkin

Happy to talk through the APSTA or NAPT implementation if anyone's done similar stuff.

Fit a WifiPumpkin3's rogue AP inside an ESP32s3 supporting APSTA, DNS spoofing, NAPT tunneling

Been digging into what the ESP32 WiFi stack is actually capable of for wireless security research and honestly it's way more powerful than people give it credit for.

The idea was to port the core concepts of WiFiPumpkin3 onto the chip itself. No Kali, no wifi interfaces, just a 5 bucks microcontroller powered from a USB bank.

The interesting part architecturally is running APSTA mode, the chip acts as an AP for clients while simultaneously connecting upstream as a STA to the real router. DNS spoofing handles captive portal redirection until the portal interaction is done, lets queries pass through to the real upstream. NAPT takes care of the internet tunneling so connected clients get actual internet access while causing traffic reorientation and thus sniffing it, which makes the whole thing behave like a legitimate hotspot. I tried to serve HTTPS directly from the chip with a cert generated for the spoofed domain but it didn't work, note that there's also a separate admin interface for scanning, cloning APs, monitoring traffic and managing everything in real time.

The main challenge was keeping DNS, HTTPS and NAPT tasks running concurrently on FreeRTOS without race conditions on a single radio doing two jobs at once.

Repo: github.com/mahdamin/ESP32-WiFiPumpkin

Happy to talk through the APSTA or NAPT implementation if anyone's done similar stuff.

Fit a WifiPumpkin3's rogue AP inside an ESP32s3 supporting APSTA, DNS spoofing, NAPT tunneling

Been digging into what the ESP32 WiFi stack is actually capable of for wireless security research and honestly it's way more powerful than people give it credit for.

The idea was to port the core concepts of WiFiPumpkin3 onto the chip itself. No Kali, no wifi interfaces, just a 5 bucks microcontroller powered from a USB bank.

The interesting part architecturally is running APSTA mode, the chip acts as an AP for clients while simultaneously connecting upstream as a STA to the real router. DNS spoofing handles captive portal redirection until the portal interaction is done, lets queries pass through to the real upstream. NAPT takes care of the internet tunneling so connected clients get actual internet access while causing traffic reorientation and thus sniffing it, which makes the whole thing behave like a legitimate hotspot. I tried to serve HTTPS directly from the chip with a cert generated for the spoofed domain but it didn't work, note that there's also a separate admin interface for scanning, cloning APs, monitoring traffic and managing everything in real time.

The main challenge was keeping DNS, HTTPS and NAPT tasks running concurrently on FreeRTOS without race conditions on a single radio doing two jobs at once.

Repo: github.com/mahdamin/ESP32-WiFiPumpkin

Happy to talk through the APSTA or NAPT implementation if anyone's done similar stuff.