Hacking (redacted) PUBLIC WiFi with a Raspberry Pi and Kali Linux

A credit-card-sized Raspberry Pi running Kali Linux can impersonate a public Wi‑Fi network and then manipulate victims’ web traffic—making “free Wi‑Fi” at places like coffee shops and airports a direct privacy risk. The core technique is an “evil twin” attack: the attacker broadcasts a fake access point with the same or similar network name (SSID) as the legitimate hotspot, lures devices to connect, and then uses DNS spoofing to reroute popular domains to attacker-controlled pages.

The walkthrough begins with the attacker setting up a wireless interface in monitor mode using a tool from the Aircrack suite (Aerodyump) to identify nearby networks and clients. With that information, the attacker turns the Raspberry Pi into a rogue access point using Host APD, while DHCP assigns victims IP addresses on the attacker’s network. DNS Chef then performs DNS spoofing—so when a victim tries to reach sites such as Starbucks.com (or other targeted domains), the DNS responses point to a web server hosted on the Pi instead. The result is that the victim believes they’re browsing the real site, while the attacker can observe browsing activity and potentially harvest sensitive information.

To demonstrate impact, the attacker sets the fake SSID to “Starbucks,” then runs a web server and shows that DNS visibility reveals the exact websites being visited. The DNS spoofing is shown working in practice: starbox.com (a spoofed Starbucks domain) no longer routes to the real Starbucks site but to the attacker’s server. The same approach is described as reusable for other brands and domains, since the mechanism depends on DNS control after the victim connects to the rogue network.

The defense portion centers on VPN use. A victim who installs and launches NordVPN while still connected to the attacker’s fake Wi‑Fi sees the attacker’s DNS view collapse into “ghost town,” because encrypted traffic prevents the attacker from reading or altering the victim’s browsing in the same way. The demonstration also claims that once the VPN is active, DNS spoofing attempts no longer succeed for targeted sites.

The attack playbook expands beyond evil twins. A second scenario uses a deauthorization attack to force a device off the legitimate Wi‑Fi and onto a stronger fake network broadcasting the same SSID and channel. By sending deauthentication frames, the attacker triggers automatic roaming to the rogue access point, after which DHCP and DNS spoofing again enable domain impersonation.

Finally, the transcript describes ARP spoofing (via Ettercap) as a different route to interception on an existing network. Instead of running a fake Wi‑Fi, the attacker positions the Pi as a man-in-the-middle by poisoning ARP tables so the victim and the router misidentify each other’s MAC addresses. With traffic routed through the attacker, DNS spoofing and content redirection can again be applied. The VPN is presented as the consistent countermeasure: once NordVPN is connected, the attacker can’t see or manipulate the victim’s traffic as before.

Overall, the message is blunt: connecting to public Wi‑Fi without a VPN leaves devices exposed to network impersonation, DNS redirection, and man-in-the-middle interception—attacks that can be executed with commodity hardware and common security tools.