fluxionnetwork/fluxion

Fluxion is a wireless security auditing tool that tests whether a Wi-Fi network's password can be retrieved through a social engineering technique. It is designed for security researchers and penetration testers who have authorization to test the networks they are targeting. The README states explicitly that using it against infrastructure without the owner's permission is illegal and discouraged. The way it works starts with scanning for a target wireless network and capturing what is called a handshake, a piece of data exchanged when a device connects to the network. That handshake is used later to verify whether a password attempt is correct. Fluxion then creates a fake duplicate of the real access point and runs software that disconnects devices from the legitimate network, pushing them toward the fake one. Users who reconnect through the fake network are shown a captive portal, which is a web page resembling a router login screen asking them to re-enter their Wi-Fi password. Any password submitted through that page is checked against the captured handshake, and once the correct one is entered, the tool stops and logs it. Fluxion runs on Linux and is best suited for Kali Linux, a distribution built for security testing. It requires an external Wi-Fi card in most cases to support the monitor mode needed for these operations. It does not work on Windows Subsystem for Linux because that environment lacks access to wireless hardware. Installation is done by cloning the repository and running the provided shell script, which checks for missing dependencies and offers to install them. It is also available as a package in the BlackArch Linux repository. The setup is described as mostly manual, with an experimental automatic mode covering some steps.