When constructing a rougeAP to phish for WPA keys we have noted in these forums and in aircrack-ng forums that when setting up the Essid rogueAP the name should visually look the same to the client BUT be different to the computer.
The reason is that clients using a specific WPA key to associate to the router cannot associate to an Open Router of same name. For the client to associate to an Open rogueAP of same name the WPA encryption selected on the client's computer for that station must be removed. This is not something normally done by clients and might arouse their suspicions.
To avoid this we have suggested one place a space after the name hence changing the name to the computer but looking the same to the client.
With pwnstar9.0 this cannot be done. A workaround is to enter the exact AP name then add approximately 8 spaces and a period.
Considerations
If the AP name length is greater then 32 spaces the client cannot associate to your rogueAP.
If there are too many spaces after the name three period symbols will be shown rather then one.
i.e. APname ... rather then APname .
The farther the period symbol is from the name the less likely the client will even notice it. And since the warning they get when they log on states the router firmware is corrupted, a slightly altered ESSID AP Name would further convince the client that their firmware was indeed corrupted.
As this is a social engineering attack there is a line of thought that three period symbols would further strengthen the phish that something was indeed wrong with their firmware.
In social engineering there is no right or wrong just deception.
MTA/MTB
In Memory of the ultimate social engineers of Betchly Park and Enigma
Where deception saved us fom ourselves
