// the find
s4vitar/evilTrust
Herramienta ideal para el despliegue automatizado de un Rogue AP con capacidad de selección de plantilla + 2FA. No requiere de conexión cableada.
evilTrust is a rogue access point toolkit that automates captive portal attacks — spin up a fake WiFi, intercept credentials, and even relay 2FA codes in real time. It's aimed at penetration testers doing wireless assessments, specifically credential harvesting via evil twin attacks.
The 2FA relay flow is the genuinely interesting part: it doesn't just grab the password and stop — it immediately tries to log in on the attacker's side, triggers the real 2FA SMS to the victim, then captures that too. The template system is practical: drop a directory in the project root and the shell script picks it up as a custom portal automatically. The setup is wireless-only — no ethernet dependency, so it works from a laptop anywhere, which matters for fieldwork.
Dead since September 2021 — the phishing templates imitate Facebook, Twitter, and Google login pages that have all changed their UI significantly, so the fakes now look dated and suspicious. The credential collection is PHP flat-file with no authentication or encryption on the capture endpoint, which means anything on your attack network can read the harvested data. The entire automation is a single shell script with no error handling worth mentioning — if hostapd or dnsmasq fails partway through, you're left with a half-configured network interface and no cleanup. The included APK payload (Meterpreter via a fake CLiQQ app) is years old and won't evade any modern Android security prompt.