Evil Portal Setup for Security Awareness Testing

What Evil Portal Actually Is

A rogue access point that mimics a legitimate captive portal (the kind of "sign in to WiFi" page you see at hotels/airports/cafes) to demonstrate how easily users can be tricked into entering credentials on a fake page. This is a genuine, widely-used technique in professional security awareness training — showing employees exactly how a credential-harvesting attack looks, in a controlled setting, so they recognize it in the wild.

Authorization Is Not Optional

Running this against any network, in any physical space, without explicit written authorization from whoever owns/administers that network and space is illegal in essentially every jurisdiction — this isn't a gray area. Legitimate use looks like: you're running an authorized internal security awareness exercise at your own workplace with sign-off from IT/security leadership, or you're a contracted penetration tester with a signed scope-of-work document covering this specific technique. "Testing it in my own house on my own devices" is the only unambiguously safe context outside a formal authorized engagement.

Setup on the WiFi Dev Board

With Marauder firmware flashed (see the setup guide), the Evil Portal function is in the main menu:

Select Evil Portal from the Marauder menu on Flipper's screen.
Choose or upload a portal template — Marauder includes several generic templates; custom HTML can be loaded onto the Dev Board's SD card for a specific training scenario matching your organization's actual login page style.
Set the broadcast SSID — for training purposes, name it obviously (not literally mimicking a real internal network name unless that's specifically the sanctioned test scenario) to avoid genuine confusion beyond the intended exercise.
Start the portal — it broadcasts as an open AP; devices that connect and open a browser get redirected to the portal page.

What Gets Logged

Marauder logs any credentials/data submitted through the portal form to the Dev Board's storage — for a legitimate awareness exercise, this is the "gotcha" data showing who fell for it, which then feeds into a training debrief, not punitive action against individuals (that's a program design choice worth thinking through before running the exercise, not an afterthought).

Running It Responsibly

Time-box the exercise and communicate to relevant stakeholders (IT, facilities, leadership) that it's happening, even if individual participants aren't pre-warned about the specific timing.
Have a clear debrief plan — the value of this technique is entirely in the education that follows, not the capture itself.
Turn it off promptly at the end of the planned window — don't leave a rogue AP broadcasting indefinitely "just in case."

Related Guides

Loading_