Individual skill
offensive-evil-twin
Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.
Skills/wireless/offensive-evil-twin/SKILL.md
Source commit a8de813edc9f66f60d44cfe42d47750e89d9930b
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 2, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 10,477
- Repository last updated
- Oct 12, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- claude-ai Repository topic
- claude-skills Repository topic
- redteam Repository topic
- redteam-tools Repository topic
- skills Repository topic
- claude-pt Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Evil Twin / KARMA / Mana
Stand up an AP that looks like (or is more attractive than) the legitimate target. Clients associate, you become their gateway, you intercept everything. The classic "captive portal at the airport" attack pattern, scaled to whatever the engagement requires.
## Quick Workflow
1. Discover target ESSID(s) clients are looking for (PNL — Preferred Network List)
2. Stand up rogue AP advertising matching ESSID(s)
3. (Optional) Deauth clients off legitimate AP to push them toward yours
4. Run captive portal / transparent MITM
5. Capture creds, deliver payload, or harvest sessions
---
