hostapd

hostapd turns a Wi-Fi adapter into an access point — it’s the same daemon that runs a real router’s AP side, IEEE 802.1X/WPA/WPA2/EAP/RADIUS authenticator included. On offense it’s the engine behind fake-AP and Evil-Twin setups: wifite and airgeddon both use it to stand up a rogue AP that mimics a real network, either to harvest credentials from a captive portal or to lure clients away from the legitimate AP.

It lives at Security → Wireless Attacks → hostapd (a subcategory — hostapd and hostapd_cli each get their own entry). Needs root and, unlike most of this category, doesn’t require monitor mode — it runs the interface as a managed-mode AP.

The help it prints

hostapd v2.12-hostap_2_12+
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2026, Jouni Malinen <[email protected]> and contributors

usage: hostapd [-hdBKtvq] [-P <PID file>] [-e <entropy file>] \
         [-g <global ctrl_iface>] [-G <group>]\
         [-i <comma-separated list of interface names>]\
         <configuration file(s)>

options:
   -h   show this usage
   -d   show more debug messages (-dd for even more)
   -B   run daemon in the background
   -e   entropy file
   -g   global control interface path
   -G   group for control interfaces
   -P   PID file
   -K   include key data in debug messages
   -i   list of interface names to use
   -S   start all the interfaces synchronously
   -t   include timestamps in some debug messages
   -v   show hostapd version
   -q   show less debug messages (-qq for even less)

hostapd_cli talks to a running hostapd over its control socket — starting, stopping, and managing WPS on the live daemon:

usage: hostapd_cli [-p<path>] [-i<ifname>] [-l<link_id>] [-hvBr] [-a<path>] \
                   [-P<pid file>] [-G<ping interval>] [command..]

Options:
   -h           help (show this usage text)
   -v           shown version information
   -p<path>     path to find control sockets (default: /var/run/hostapd)
   -B           run a daemon in the background
   -i<ifname>   Interface to listen on (default: first interface found in the
                socket path)

commands (abridged — dozens more, see `hostapd_cli help`):
  ping = pings hostapd
  status = show interface status info
  all_sta = get MIB variables for all stations
  list_sta = list all stations
  deauthenticate <addr> = deauthenticate a station
  wps_pbc = indicate button pushed to initiate PBC
  disable = disable hostapd on current interface
  quit = exit hostapd_cli

Examples

# hostapd itself always takes a config file, not flags — a minimal open AP:
cat > fakeap.conf <<EOF
interface=wlan0
driver=nl80211
ssid=Free_WiFi
channel=6
EOF
sudo hostapd fakeap.conf

# Check status on the running daemon from another terminal
sudo hostapd_cli status