How to Hack WiFi Networks for Beginners

Hi and welcome to the course. My name is Nikolai and I will be your instructor for this course. In this course, you will start as a beginner with no previous knowledge about Wi-Fi hacking and Kali Linux. My goal is to keep the lecture short so that you can go through them quickly. Now, let's talk about some of the topics that I will cover during the course. In the first part, I'm going to teach you a basic understanding of wireless networks and how they work. Then I'm going to show you some different wireless settings and how to install Kali Linux in VMware player. And lastly, you will learn some very useful Linux commands. Once done with that, I will move to second part which is more advanced. So in this part you will learn how to perform a denial of service attack and find hidden networks. After that you will learn how to hack wireless networks using tools like air crackng wire sharkark crunch cowatty pirate reaver and so on. Finally I'm going to teach you how to perform a evil twin attack. This course is for those who want a career in cyber security or also for someone who just simply wants to learn all the cool Wi-Fi hacking tricks. You also have to remember that all information exposed in this course has the goal to teach you the techniques used by hackers in order to avoid their attacks. So that's it for now. Thanks for watching and I will see you next time. In this tutorial, I'm going to teach you a basic understanding of wireless networks. So, what is a wireless network? Is the network set up by using radio signal frequency to communicate with other computers just like cell phones and radios. Wireless networks makes life incredibly easy and give us such great mobility. It's also referred to as a Wi-Fi network or WLAN. In 1997, the Institute of Electrical and Electronics Engineers created the first WLAN standard, which is a set of technologies for wireless communication. For an easy understanding, I made a simple table to show you a brief history of wireless standards. This table describes the Wi-Fi standards to help you understand the evolution of Wi-Fi technology. As you can see, there are five standards, but you only need to remember the N and the AC because these are the most common standards in use today. Next is wireless signals. Wireless signals are electromagnetic waves traveling through the air. They are important because they can transfer information like a audio, video or voices and so on. There are two types of Wi-Fi signal 2.4 4 GHz a lower frequency. This is the more common Wi-Fi technology in use today and the 5 GHz which is a higher frequency used by fewer devices and can achieve higher speeds. The range is also shorter. You will also need to know what is a wireless channel. For the 2.4 GHz band, there are 14 channels. If you are building networks in the US, you can only use channels 1 through 11. You can also use the 5 GHz frequency band, which is much wider and has more channels. These channels do not overlap, so you don't have to worry about picking non-standard channels like in the 2.4 band. Now that you know what channels and different bands are, you will need to know how to avoid radio interference. If you live in a populated area, your neighbors Wi-Fi could interfere with yours. So, change the default Wi-Fi channel and use 1, 6, and 11. These three channels have no frequency overlap. Interference can also come from other electronics such as microwaves, cordless phones, tablets and so on. The last topic I want to cover in this video is wireless antennas. Antennas are also key components of these radio communication systems. There are two types omnidirectional and directional. An omnidirectional antenna sends a signal out equally in all direction. A directional antenna sends a signal out in one direction. Okay. So now that you have a basic theoretical understanding of wireless networks, we are ready to move on to my next video where I will show you useful wireless settings. So thanks for watching and I will see you next time. Hi and welcome back. In this video, I will cover some useful options for your wireless network. First of all, you need to log to your wireless router. But to get prompted with the login page, you need to know the IP address of the router. So, click on the start menu and type cmd. Press enter. Next, type IP config and look for default gateway. This will be your IP address for accessing the router. Now, I will log into my router and show you some important settings. First thing you need to do is change default password because router manufacturers use the same username and password, which is usually admin and the password admin. An easy way to find router passwords is by using routter passwords.com. Here you have a huge database of different routters. Just select one and click find password. As you can see, this is a very effective way to find your username and password. Okay. So, let's switch back to my router interface and go to the wireless tab. Here you have different options. You can select the wireless modes and use as client client bridge ad hoc but leave it on AP. Next is network modes or standards where you have BGN only and so on. The big thing right here are channels because these channels can help you avoid interference. So I recommend using 1, six or 11. Next is your network name and broadcast which is enabled. This means that I'm able to see the name of the access point when searching for wireless networks. Disable mode will make your wireless network invisible. The next important tab is wireless security. Here you have different security protocols, but always use WPA and avoid web encryption. I will use a simple password for testing. And the last tab I want to cover is MAC filter. This option will prevent clients from accessing your network. If you want to find your wireless MAC address, just open command prompt and type netshwan show interface. And here is your MAC address. Another cool trick is to find your wireless password. So type netsh w show profile and select your profile name. Mine is kinet. and then type key equal clear and press enter. As you can see, my password is revealed. So that's it for this lesson. Thanks for watching and I will see you next time. In this tutorial, I will show you the fastest way to set up a virtual lab to practice your wireless hacks using a virtual machine. A virtual machine allows you to play with another operating system without leaving your current operating system. You have several options of different virtual machines, but for this tutorial, I will use VMware Player. So, let's switch to my computer and download VMware. Now open up your browser and search for VMware Player and click on the first link and then select download for Windows. When the download has finished, open the file and install the program. After the installation has completed, you should see a new icon on your desktop. Double click on this shortcut and you will be brought to this little menu. to test all the wireless attacks. I have installed Kali Linux into VMware because has all the tools that I'm going to use pre-installed. To download Kali Linux, go to the Kali site and select download Kali Linux. Here we have different ISO files. Just click ISO and wait for the download to complete. I will click cancel cuz I have already downloaded. Next, open VMware and click on create a new virtual machine. And then look for your Kali ISO file. Click next. And here select Linux Debian 864bit. Click next. And here you can give the name to your virtual machine and the location where your virtual machine will be installed. Click next. And in here we have disk capacity, but you can increase it. And the second option is fine. So click next. And in here you can click the customize hardware button and change different settings. You can increase the memory and change the number of processor cores. When you're done just click close. Now I will click cancel because I have already created a virtual machine. So just select this Kali Linux from here and click play virtual machine. Now wait for a few seconds for the system to start. If you want to play with this virtual machine a little bit, feel free to explore. And just remember anything you are doing here, it's never going to affect your host operating system. So that's it for now. Thanks for watching and I will see you next time. Hi and welcome back. In this tutorial, I will cover some really useful Linux commands. So, let's get started. First command is pwd, which displays the present working directory. ls, list directory contents. CD is the change directory command. History prints the history. Man displays the online manual for a given command. Clear clears the screen. MKD to make a directory. CP copy. Grab displays the matching lines. Alias create a shortcut to a command. Touch to create a new file. A advanced package tool is used to install and remove different programs. IF config in short interface configuration. IW config is similar to if config but is dedicated to wireless interfaces. Locate find files by name and nano which is a command line text editor. So let's see these commands in action. Open a terminal by clicking on the terminal icon. It's important to keep in mind that unlike Windows, Linux is case sensitive. This means that LS is different from LS. Use pwd to print the working directory. The directory you are in is root in this case. So use cd command to move to a different location by typing cd /bin. Enter pwd command again and you are in the bin directory. If you want to see the contents of directory you are in, use ls command or ls with option l. This will show you the size, date, permission and owner of file. To go back to your root folder just type cd. And to make a directory use mkdir and type the name of your directory. To remove a directory use command with option r. You can use man to display the manual of a specific command. And a very handy command to clear your screen is clear. If you want to install or remove a program, use upput to get command. To install type to get install and the name of the program and to remove type to get remove. Use tab key for auto completion. Touch command is the easiest way to create a file. Type touch and the name of the file. CP is used to make copies of files and directories. Type CP and the name of your file and then the destination. GP is a powerful command which looks for the pattern of the text that you specify on the command line. Let's say you want to find every line which contains the string password in this word list file. Type grap password word list. Alias command can be useful if you want to create a shortcut to a command. Type alias name equal and the command. This will create an alias called cls which will use the clear command. History command can be used to list commands you have typed. To delete all history, use C option. Locate command is the simplest way to find the location of files on Linux. Just type locate and the name of the file. And here is a list of places where the file is located. If config stands for interface configuration. It is used to view and change the configuration of the network interfaces. To view the configuration of a specific interface, type its name here. You can see the IP address and the MAC address. IW config is used to display the wireless interfaces on your system. Nano is a small and friendly text editor. Just type nano and the path of the file. Nano will follow the path and open that file. Use Ctrl + O to write and press enter to save changes. To exit, press Ctrl + X. So that's it for this lesson. Thanks for watching and I will see you next time. Hi and welcome back. In this video, I'm going to explain you what is air crackng packet injection and how to put your wireless card into monitor mode. First of all, air crackng is not a single tool, but rather a suite of tools for manipulating and cracking Wi-Fi networks. The NG stands for new generation. During the course, we will cover these tools. Now, let's see what is packet injection. Packet injection allows to intercept and manipulate network communication. A good example is sending deout packets to a network client and disconnecting him from the router. To really be effective at wireless hacking, you need a wireless adapter that is capable of packet injection and monitor mode. The best supported and recommended USB wireless adapter for Kali Linux is Alpha AWS036. This adapter has good sensitivity and can find hot spots that are far or weak in signal strength. To test my Wi-Fi adapter for packet injection, I will switch to my KI machine and type the following command airplane minus9 and the name of my wireless interface. As you can see, my injection is working. Now, let's put my wireless card into monitor mode using the following command. Airmon nng start wlan zero. And here you will see some processes that could cause trouble. Use airmon nng check kill. This command will stop all the interfering processes. To check that your interface is in monitor mode, you can use iw config. This mode will sniff the packets in the air without connecting with any access point, which means that my wireless card can hook up with anyone. So that's it for now. Thanks for watching and I will see you next time. Hi and welcome back. In this video, I'm going to show you how to find hidden SSID networks around you. First you need to put your wireless card into monitor mode using airmon nng. Now type aerodyump nng wland zeromon to list the wireless networks around you. Any wireless network that is hidden should show up as the name length. Once you found the network that you are looking to find the hidden SSID, use ctrl + c to stop the scan. So, this one right here is my network. And you can see that the SSID is hidden. Now, I will need a few details about my network like its MAC address and the channel that it's using. So, go ahead and type the following command. Aerodyump NG channel 6 and the BSS ID of the network you are targeting. In order to bypass the hidden SSID, you need to wait for a client to connect to the access point. But waiting for a client to connect can take hours, even days. So a better way is to force clients to disconnect and reconnect using the following command. airplane nng--0 and the number of packets and then the BSS ID of the access point you are targeting. Once a client tries to connect to the access point, they exchange probe request and probe response packets. These packets contain the SSID of the access point. As these packets are not encrypted, they can be very easily sniffed from the air and the SSID can be found. So that's it for this lesson. Thanks for watching and I'll see you next time. Hi and welcome. Today I'm going to show you how to spoof your MAC address. But to understand how MAC spoofing works, you need to know what a MAC address is. A MAC address is also called a media access control and it is a unique ID number that is given to your network adapter. In simple terms is a serial number and it cannot be changed forever. Max spoofing is a technique for changing the MAC address that your network interface appears to have. This change is temporary and cannot be permanently. Now why would you want to spoof a MAC address? There are places where you go get the Wi-Fi password but can't access the network because they activated MAC filtering. So spoofing your MAC address can help you access the network. There are also companies which tracks users by recording the MAC addresses. So spoofing can save you from that as well. For Kali Linux, there is a built-in program called MAC Changer, which I will demonstrating. So before you change your MAC address using MAC changer, it's always a good idea to bring your network adapter down. This can be done using the following command. If config wand zero down and now in one single line type MAC changer- rwl0 now this R here is just going to say give me any random MAC address as shown on the screen MAC changer will show you the current permanent and changed MAC address. The permanent MAC address will be restored to your network adapter after early boot. You can also spoof a specific MAC address using the following command. MAC changer-m and here type your new MAC address. Now use the following command to bring up your network adapter. if configw0 up. And to check your new Mac, just type if configw0. So that's it for now. Thanks for watching and I will see you next time. Hi and welcome back. In this video, I'm going to show you how you can sniff usernames, passwords, and web pages using Wireshark, also known as a network sniffer. A network sniffer is a tool that can help you locate network problems by allowing you to capture and view the packets on your network. Wireshark is available for free at Wireshark website and you can download for Windows, Linux and other platforms. But for this tutorial, I will use Wireshark from my Windows machine. If you want to start Wireshark on Kali Linux, just open a terminal and type Wireshark and wait a few seconds. The protocols that we'll be analyzing are FTP and HTTP. FTP stands for file transfer protocol and HTTP for hypertext transfer protocol. So, let's get started. Wireshark is really easy to use actually. All you have to do first of all is tell it which interfaces you want to capture. So I will go up here and click capture options and interfaces and then I have to pick the correct interface which I want to use. So I'm going to select it and press start. And now I will start capturing traffic on that interface. Now, let's say I want to connect to an FTP server on the internet. So, I will open up a FileZilla connection to my web host and click quick connect. Now, it's connecting to my web host online using my username and password, which is FTP password 88. So, I will stop the capture and close my connection. And let's take a look at what we have. So, here is the capture package. As you can see, it's a ton of information, but FTP is the protocol I'm interested in. And you can see right here, user Frost Web and then the password, which is FTP password 88. If you follow the TCP stream, you can see the username and password. Now I'm going to show you how to obtain the username and password from an HTTP site. So once again click capture interfaces and click start. Then you want to go to the site you are trying to steal the login information and type in the username and password. I will put in test user and password just let me in. Now I will switch back to wireshark and stop the capture. You also need to change the filter to HTTP request method equal equal and encaps. This is just going to make the packet easier to find. When you locate the packet again use leftclick and select follow TCP stream. As you can see here is the user login and the password. So since package sniffing is so simple, it is important to know how to protect against it. If you have to put any important information, make sure the site uses HTTPS, which is a secure protocol. So that's it for now. Thanks for watching and I'll see you next time. Hi and welcome. In this video, I'm going to teach you how to perform a denial of service attack on a wireless access point. First of all, let's understand what is a denial of service attack. Is an attack meant to shut down a system or server by denying users to access a service or website. So, I will switch to my Kali machine and put my wireless card into monitor mode using the following command. Airmon NG starwan zero. Now I want to scan all the access points in range using aerodyump wand 01. To stop the scanning use controll + c and then select your network. Mine is kynet. So I'm going to need the MAC address of the access point and the channel. Then type aerodyump channel 6 and the BSS ID of the router. This will show you the clients that are connected to the access point. Now I will perform the actual attack with airplane dash zero and the number of packets and dash a and then the MAC address of the access point. Now press enter. This attack will disconnect everyone from the network. So I will switch to my Windows machine. And as you can see in my taskbar shows that I'm connected. And you can see now that I have lost my connection. If you want to have a little more fun, you could create fake routters that basically floods your options when you search for a network to connect. First, I'm going to flood my local area with random fake wireless routters. So, I'm going to use MDKWL0 B, which is a beacon flood and use channel 5 by C and press enter. And if you look, it's flooding with these fake names right here. Now, to show that it's working, I'm going to click on my wireless taskbar. And you can see it's showing these random wireless networks. You can also change the names for the routters by using a simple file with some names. So after the dash c type F which means the computer is going to use a file to generate these names instead of random characters. So I'm going to drag and drop the file in here and press enter. Now again, I'm going to go to my taskbar and show you that it's working. But if someone tries to connect to these networks, it's not going to work because the purpose of this is just to flood your options. So that's it for this lesson. Thanks for watching and I'll see you next time. Hi and welcome back. In this tutorial, I'm going to teach you how to crack wireless web encrypted passwords. So I will start by enabling web encryption in my access point. For that I need to go to the wireless security tab and select web. This will allow me to enter a key. I will use a simple password and click save. Now let's switch to my KI machine and put my wireless card into monitor mode and then type a dump nng wl0mon to display the wireless networks. So I will select my network and type aerodyump- c for the channel and you can see is running on channel 6. Now this is the name of the file that the data is going to be written. You can choose whatever name you want but in my case I will type web followed by the BSS ID of the access point and then the interface. As you can see there is one computer connected to this access point and here you have a field with data which is climbing very slowly. Now to crack the password you need a huge amount of data. So the attack that I will use will make the data climb at enormous rate. So first of all I will associate with the access point using airplane-1 for fake authentication then - a and then the bss ID of the access point. Once you associate you will get this message. So now I'm going to start the attack using the same command again just different syntax. Airplac dashb for the BSS ID of the access point. And you can see here that the data is climbing at a quicker rate. Now the data is getting saved to this file here called web01 cap. That's the file I'm going to use to crack the password. So, I will use air crackng and the name of the file. And now it's using the data that I'm collecting to crack the password. If you don't have enough data, it will tell you that it failed. So, I will pause the video and wait until I have enough data. Okay. So, the tech has been running for about a minute now. And I have a huge amount of data here. Now go ahead and run the command again. And you can see the password has been successfully cracked. Another easy way to crack web encryption is by using an automated Wi-Fi hacking tool called Wi-Fi. So in your terminal, type Wi-Fi. And now wait a few seconds to scan the wireless networks. When you see your network, press Ctrl + C to stop the scan. Now I can hack a single network by typing in the number or multiple networks by typing all. So I will type one which is the number of my network and press enter and let the script run until gets enough packets to crack the password. I'll pause the video again and return back when the password is cracked. As you can see the key has been cracked. So, that's it for this tutorial. Thanks for watching and I'll see you next time. Hi, and welcome back. In this tutorial, I'm going to show you how to crack WPA encryption. WPA stands for wireless protected access and was designed to replace the web encryption. These security protocols are designed by the Wi-Fi aliens to secure wireless networks. So let's start the cracking process. First of all, make sure that your wireless card is in monitor mode. Then type aerodyump w0 to scan the wireless networks and select your network. Mine is this one right here. So go ahead and type aerodyump and the channel of the access point and the name of the file and then the BSS ID of the access point. So up to this point we are pretty much the same as cracking web except I'm not looking for the data here to climb. I just want here in this corner a four-way handshake. The four-way handshake contains the hash of the WPA access point, which I will use to crack the password. You can only capture the four-way handshake when a device connects or reconnects to the network. So, I'm going to kick off this computer right here. And when it reconnects to the access point, it's going to give me the four-way handshake. Now go ahead and type airplane-0 and the number of packets and then the BSS ID of the access point and on the top right corner you can see WPA handshake. Now you can stop this and clear the screen and then type ls to list the files. And now I will use this WPA01 cap file with air crackng and brute forcing the password with a word list. As you can see, I have a word list right here on my desktop. So let's crack the password by typing air crackng and the name of the word list and then the name of the file which is WPA01 cap in my case and press enter. So as you can see the key was found and there is the password. Please note that this is a dictionary attack. If your password is not in the dictionary the attack will fail. You also need to remember that this cracking process can be very timeconsuming when the password is not found in your word list. So that's it for this lesson. Thanks for watching and I will see you next time. Hi and welcome back. In this tutorial, you'll learn how to use crunch with air crackng. Crunch is an easy to use tool for generating a custom dictionary or word list. This tool can save you hours or days in password cracking. So in your terminal, type crunch. Now let's say the target has a password of eight characters and ends with the number 68. So go ahead and type crunch 88 which are the min and the max numbers dash t option and dash o for output and then the location and name of your word list file. As you can see on my desktop the word list pass has been created. You can open the file and you can see that every word ends with the number 68. I forgot to mention that these symbols here will insert lowercase characters. You can check the manual page by typing man crunch and scroll down and then look for the symbols but I will leave this for you to read. Now let's say you want to make a word list using more characters. So type crunch 816 ABCD 1988 tour and you can see the numbers are stunning. But don't worry because I will show you how you can pass all the passwords that are generated here. So I will use the pipe option with the following command. Now all the passwords that are generated here will be placed straight into the air crack and will be used for the cracking process. So you don't need to use a word list because you will use the input from crunch. This method will save you a lot of time and valuable drive space. So that's it for this lesson. Thanks for watching and I'll see you next time. Hi and welcome. In this video, I will show you how you can speed up the WPA cracking process using Calpati engine PMK. Calpy supports using a premputed hash file. Premputed hash files are used to accelerate the cracking process by eliminating the transformation of a password into an encryption key. So, I will switch to my KI machine and type cow patty. And here you can see different options. First of all, make sure you have a capture file with the four-way handshake and the word list to start the cracking process. So I will first show you how you can do the attack with a dictionary file the same way I did with air crack. So go ahead and type cowpati-f and your dictionary file and dash r for the packet capture file and then dash s for the ss ID. As you can see, kpati is generating a hash of every word from my word list. When the hashes match, it displays the password of the access point. This process is very CPU intensive and slow, so I'm going to skip ahead here. And you can see it takes almost 5 minutes to crack the password. But the way that will speed this up is to create your own hashes by using a tool called genpmk. This tool is very useful when you don't have any client connected to the access point, but you want to start generating the hashes for the SSID you are targeting. Now go ahead and type genpmk-f and your dictionary file and dash d for output file which is going to be hash and then dash s for the SSID which I want to create the pre-generated hashes. Now it's creating pre-generated hashes for the network. So again I will skip ahead and now whenever I want to attack the network I will use the hash file which is this one right here. So go ahead and type cowpati-d for the hash file and dash r for the packet capture and then dash s for the ss ID. And as you can see it took less than a second to crack the same password. So that's it for now. Thanks for watching and I'll see you next time. Hi and welcome back. In this tutorial, I'm going to teach you how to use Pirate. Pirate is a tool that uses all the cores in your system to help speed up the cracking process. Now, if you want to see how many cores you have, just type pirate list underscore cores. First, make sure you have a capture file and the word list and then type pirate- r and your capture file and dash i and the word list and then attack pass through. This method is much faster compared to air crack because with aircraft is only going to use one core. Now, let's see a much faster method. So go ahead and type pirate- i and your password list and then import passwords. And now it's going to import all the passwords from the file into the pirate database. Next, you need to add the SSID of the network using pirate- e and the name of your network and then create ESS ID. Now type pirate eval to get an overview of everything and you can see the SSID and the passwords. So go ahead and type pirate batch to start processing those passwords. This process can take some time depending on how big is your dictionary file. Okay. So once it's done batch processing, you can launch the tag by typing pirate- r for the capture file and then a tag db. This is by far the fastest method. And lastly, if you feel like you want to clean up your database, type pirate- e skynet delete ess. And to delete all the passwords from database, type rm-rf.pirate blob space password. And now I have zero passwords and no networks. So that's it for now. Thanks for watching and I'll see you next time. Hi and welcome back. In this tutorial, I'm going to teach you how to crack a WPA password with Rever. Rever works by targeting WPS enabled routters and brute forcing the WPS PIN. WPS stands for Wi-Fi protected setup and was implemented to simplify the wireless connections by entering a 8digit PIN instead of entering a password. So, let's go ahead and get started. The first thing you need to do is to make sure you have your wireless card into monitor mode. And then you need to find the vulnerable target by using a tool called wash. So, I'm going to type wash- i and the name of my interface. This will show all the networks with WPS enabled. You can stop the scan by pressing Ctrl + C and then select your target. Mine is kind. Now you need the BSS ID of the access point and the channel to begin the attack. So in your terminal, go ahead and type rever and the name of your interface and -B for the BSS ID of the access point. You also need to specify the channel using dash c and the channel number. Mine is six and - vv. This is very verbose which will give you more information on the screen. And then dash f for fixed. In other words, it's going to disable channel hopping. Now it's going to go pin by pin until it gets the one that works. This process can take hours. So, I'm going to skip ahead in the video to where the attack is complete. So, you can see what the end result looks like. So, here you can see that River has finished the attack and it was able to successfully brute force my routter WPS pin and below is my password. It's important to note that new routters come with improved technology and lockout systems and this attack might not work. So that's it for this lesson. Thanks for watching and I'll see you next time. Hi and welcome back. In this tutorial, I'm going to teach you how to perform a evil twin attack. An evil twin is a rogue or fake wireless access point that appears as a genuine hotspot. The idea is to set up your own network that looks exactly like the one you are attacking. So let's get started. First step as always is to make sure you have your wireless adapter into monitor mode and then scan all the wireless access points in your range using aerodyump and the name of your interface. Now you need to find the access point you want to clone. Mine is kinet. So, I'm going to use Airbase NNG, which is a tool used to convert your wireless card into an access point. So, go ahead and type in the following airbase NG- A and the MAC address of the access point you want to clone E for the name of the network and channel 6 and then the interface WL0. Now the fake access point is running. Next step is forcing the client to disconnect from the real access point and connecting to your fake access point using the following command airplaneg-0- a and the MAC address of the real access point. Now if my signal is stronger he will automatically reconnect to my evil twin. As you can see a client has connected to my fake access point. Okay. So now I need to provide internet access to the fake access point. And to do this you just have to know which interface is providing you with internet. Mine is ETH0. First of all you'll need bridge utils. So go ahead and type up to get install bridge utils and after the installation has completed type brctl at brr fake. You can name it any way you like. In my case I have named it fake but it doesn't really matter. Next type brctl add if fake eth0. This will create a bridge between fake and ETH0 which has internet access. You also need to add the interface which is created by airbase NG. So use the same command just change the name of the interface to AT0. This interface should be the same on your system because airbase will create this interface for you. Next step is to add IP addresses to these interfaces and bring them up. So go ahead and type if config0 up and then if config fake up and finally the evil twin attack is complete. The client is now connected to your fake network and can use the internet. Now all the packets that go from the user to the internet pass through your interface and these packets can be monitored with wireshark. So in your terminal type wireark and wait a few seconds and then go up here and click capture and select the interface you have created. In my case is this one right here called fake and press start. And now you can listen to all the wireless traffic on fake interface. So have fun and thanks for watching.