Evil portal, beacon spam and deauth: a €40 hardware Wi-Fi lab

[01] The object nobody recognized

There exists, in the trade of teaching information security, a category of moments that could be defined as pedagogically irreversible: those junctures where a practical demonstration demolishes with placid ruthlessness any previously acquired theoretical certainty. This article was born from one of those moments. A particularly successful one, if we're being honest.

The context: a professional security course attended by a mixed audience — computer science graduates, engineers, technicians with years of field experience. People who were not discovering what a TCP packet is for the first time. People who, with that peculiar overconfidence acquired after years of configuring firewalls and VLANs, were convinced — with some justified reason, to be fair — that they already knew how Wi-Fi works. (Spoiler: they knew how to configure it. Not the same thing.)

When I extracted the Cardputer-Adv from my jacket pocket with the solemnity appropriate to the occasion, the collective reaction over the first three seconds oscillated between 'is that a Game Boy?' and 'the professor has lost his mind'. Understandable. The device is the size of a cigarette pack. It has a tiny keyboard that would have done honour to a Nokia 3310. It costs €40 on AliExpress with shipping included. It does not, objectively, radiate an aura of existential threat.

I launched Bruce firmware. I navigated with enviable composure through the Wi-Fi menu, selected Evil Portal, loaded a login page template — a generic 'corporate guest network' screen, the kind of thing anyone would fill in without a second thought — and pressed start. The Cardputer created an access point visible to every phone in the room within about thirty seconds. No additional laptop. No cables. Nothing that cost more than €40.

From the moment I took the device out of my pocket to the moment the fake network was fully operational: less than two minutes. One student — one of the brightest, thanks to that cruel irony fate reserves for the most prepared — connected out of curiosity. Username and password appeared on the Cardputer display in plain text, immediately, with the sobriety of something that has nothing to justify.

The silence lasted exactly four seconds. Then someone said, with the voice of someone who has just realised something unpleasant, a single word. I won't transcribe it, but you're already hearing it. At least three people looked at their phones, saw the list of saved Wi-Fi networks, and silently forgot all of them. (There. That. Is exactly why you do the practical demonstration.)

[02] What's inside — why €40 does all this

Before proceeding with the survey of unpleasant things this object knows how to do, it's worth understanding why it knows how to do them. It's not black magic, it's not a fortunate accident: it's economical engineering applied with a competence that, frankly, should give pause to anyone selling five-figure security solutions.

The fundamental piece is the ESP32-S3: a microcontroller with native Wi-Fi monitor mode support — the ability to receive raw 802.11 frames without associating to any network. It's the same functionality for which you pay hundreds of euros in laboratory Wi-Fi cards, implemented on a chip that costs less than a drink at a bar. Combined with Bruce firmware — an open-source project, actively maintained, specifically designed for offensive operations on ESP32 platforms — the Cardputer becomes a concrete research and testing tool, not the usual gadget you display on your desk to look the part.

[03] Evil Portal — the attack that shouldn't work this well (and yet)

The Evil Portal is not a new technique. It is discussed in every ethical hacking course worthy of the name, features in every red team framework, has been documented with academic thoroughness for at least two decades. And yet — with a stubbornness bordering on insolence — it keeps working. Not because it exploits a protocol vulnerability: the protocol in this case is absolutely blameless. It works because it exploits a human vulnerability, and that one, notoriously, can't be patched with a firmware update.

How it works — the technical version, brief and merciless

# Evil Portal — simplified attack flow
# (version for people who want to get it without a PhD in 802.11)

1. Cardputer starts a fake Access Point (SSID as convincing as you like)
2. Starts an internal DHCP server → hands out IPs to unwitting clients
3. Starts an internal DNS server  → resolves EVERYTHING to itself
4. Starts an HTTP server          → serves the fake login page

# When the victim connects:
   → gets an IP from the Cardputer's DHCP (none the wiser)
   → any DNS query               → answer: "that's me"
   → OS detects captive portal   → opens the browser automatically
   → user sees a login screen    → fills it in ("the usual stuff")
   → credentials → logged in plain text on the Cardputer (display + microSD)

# Setup time with Bruce:              < 2 minutes
# Hardware skills required:           none
# Total cost of the operation:        40€
# Purpose:                            educational, obviously

What leaves one at a loss is not the technical sophistication — it has none, and that is precisely the most unsettling thing. It's the triviality of execution combined with the devastating practical effectiveness. Bruce autonomously manages DHCP, DNS and HTTP stacks, with login page templates loadable from microSD. In the classroom, the page used for the demonstration was a banal 'corporate guest network' screen — the kind of thing you fill in on instinct, without stopping to think, because 'it's just the office Wi-Fi'. Right.

[04] Beacon Spam — or how to create chaos without doing anything useful

After the collective moment of reflection induced by the Evil Portal, the second demonstration was Beacon Spam. Less dangerous — it intercepts nothing, captures no credentials, causes no direct harm — but extraordinarily effective in its role as cosmic disruption, and pedagogically perhaps even more useful than the first demo.

The mechanism: every Wi-Fi access point continuously transmits beacon frames — 802.11 management packets announcing the network, its name, its capabilities. A device in monitor mode can send beacon frames with any made-up SSID, creating dozens or hundreds of ghost networks that nearby phones collect with the meticulous absence of critical thinking that defines them.

In the classroom, launching Bruce in random Beacon Spam mode, students' phones began populating with random-named networks until reaching over 60 SSIDs in the list, where before there had been about ten. Some laughed. Some stared at their phone screen with that vaguely philosophical expression of someone reconsidering life choices. And one person, with impeccable professional seriousness, pulled out a laptop to capture packets — admirable gesture, questionable timing, flawless in spirit.

The question someone asked, with genuine unease, was: 'but then how do I know which networks are real?' Welcome to 2026, please take a seat.

[05] Deauth Attack — the 2004 attack that in 2026 still works just fine

The deauthentication attack is among the most long-lived and least elegant vulnerabilities in the 802.11 protocol. Formally documented since the first half of the 2000s, it remained exploitable for over twenty years for a simple and almost touching reason in its banality: Wi-Fi management frames — including deauthentication frames — were not authenticated. None of them. Anyone could send them. On behalf of anyone. To anyone. It was, to use a technical term, fairly absurd.

The 802.11w standard — Management Frame Protection, also known as PMF — introduced encryption and authentication for these frames. Ratified in 2009. Incorporated into 802.11-2012. Made mandatory in WPA3 in 2018. Supported by WPA2 as an optional feature for years. On paper, it's a solved problem. On paper.

In operational reality, the vast majority of consumer routers — ISP modems leading the pack, empirically tested on TIM hardware — don't expose PMF configuration control to the user, or have it disabled by default with the nonchalance of someone who doesn't think this could be a problem. The result is that millions of home and small business networks are, in 2026, still vulnerable to an attack documented twenty years ago, executable with a device that costs less than a pizza with drinks.

The data — empirical measurement on consumer network

With Cardputer-Adv and Bruce, on a home network with PMF disabled (default on the tested TIM modem), I measured the disconnection time of an Android client at increasing distances. Single measurement per distance, line-of-sight, no shielding. Zero failures across six tested distances. Here are the numbers, in their eloquent simplicity.

The trend is as expected: time grows non-linearly with distance, consistent with RF signal degradation. What was not obvious is the total absence of failures up to 15 metres — a radius that comfortably covers any realistic scenario: a coffee shop, a coworking space, a meeting room, a reception. Everyday stuff, in other words.

PMF — the countermeasure that actually works (use it)

With PMF enabled on the access point — WPA2 + PMF Required, or pure WPA3 — the attack is categorically blocked. Not 'mitigated', not 'made harder': zero disconnections, full stop. Deauth frames sent by the Cardputer are ignored by the client because they cannot be verified as authentic. It's the correct technical response to this attack vector, available for nearly twenty years, and the reason it's still so rarely deployed is, euphemistically, a collective failure of the industry.

[06] What all this means — for those responsible for defending

This article is not a tutorial for causing harm. It's not even an uncritical celebration of 'look how cool this gadget is'. It's a memo, addressed to anyone who manages network infrastructure — corporate, domestic, educational, whatever — that wireless security in 2026 cannot yet afford the luxury of being treated as a solved problem.

The Cardputer-Adv is not a sophisticated tool. It doesn't require specialized expertise to operate. It doesn't have a price that could function as a deterrent to anyone. If a tool with these characteristics can empirically demonstrate everything discussed above, the level of attention that wireless security receives in the planning of most infrastructures is — with all due respect to the profession — structurally inadequate.

Checklist — what to do now, concretely

The last row is the one that matters most. I learned this empirically, in the classroom, that lesson: all the theory in the world doesn't produce the same effect as watching your own credentials appear in plain text on the display of an object that looked like a Game Boy, held by someone who is smiling. That stays. Everything else, at best, gets forgotten two slides later.