Airbase-ng Cheat Sheet

airbase-ng is part of the Aircrack-ng suite and is used to create fake (rogue) access points. It is commonly used in Evil Twin attacks, captive portal setups, and wireless attack labs.

What is a Rogue Access Point?

A rogue AP impersonates a legitimate wireless network to: - Lure clients into connecting - Capture credentials or traffic - Perform MITM attacks

Danger

Rogue AP attacks should only be performed in authorized environments.

Basic Syntax

airbase-ng [options] <interface>

Requires a monitor mode interface.

Create an Open Access Point

airbase-ng -e FreeWiFi wlan0mon

-e → ESSID name
Creates an open (no encryption) AP

Create AP on Specific Channel

airbase-ng -c 6 -e TestAP wlan0mon

Locks the rogue AP to channel 6.

Evil Twin Attack (Clone ESSID)

airbase-ng -e TargetWiFi -c 11 wlan0mon

Matches the target AP name to trick clients.

Fake Authentication (WEP)

airbase-ng -a AA:BB:CC:DD:EE:FF wlan0mon

Used in WEP testing scenarios.

Enable Internet Routing (Lab Setup)

After launching airbase-ng, a new interface is created:

at0

Assign IP:

ifconfig at0 10.0.0.1 netmask 255.255.255.0

Enable forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

DHCP Setup (Optional)

dnsmasq --interface=at0 --dhcp-range=10.0.0.10,10.0.0.100,12h

Typical Evil Twin Workflow

airmon-ng start wlan0
airbase-ng -e CoffeeShopWiFi wlan0mon
ifconfig at0 10.0.0.1 netmask 255.255.255.0
dnsmasq --interface=at0

Monitor Connected Clients

tcpdump -i at0

Common Issues

Clients not connecting

Check channel alignment
Ensure strong signal
Deauth clients from real AP

No at0 interface

airbase-ng not running
Driver not compatible

aireplay-ng – deauthentication
bettercap – MITM attacks
dnsmasq – DHCP service
iptables – traffic routing

Use Cases

Evil Twin attacks
Captive portal testing
Wireless attack labs
Client behavior analysis

Legal Notice