Spot attacks, protect traffic, stay safe on public Wi-Fi.
You open your laptop at a coffee shop and see two strong signals.
Which one belongs to the coffee shop?
Connecting successfully does not prove safety.
🕵️
You do not know who controls the network.
The access point between your device and the internet may belong to the venue, or to an adversary sitting nearby. Connected ≠ Trusted.
Buying weapons doesn't mean you can build one.
Uses existing tools without creating new ones.
🧰
Uses ready-made or purchased tools against documented vulnerabilities.
Buying a weapon does not mean you can build one.
Low-skilled adversaries are tool users, not tool creators.
The barrier to entry is low — anyone can download an attack framework. But skill level says nothing about their motivation.
Writing the tools no one else has seen yet.
Creates new tools and discovers undocumented vulnerabilities.
🧠
Can discover and exploit vulnerabilities before a fix exists.
A zero-day exploit targets a vulnerability the security community does not yet know about. High-skilled adversaries write the tools; they don't just download them.
High skill does not equal high motivation. A nation-state actor and a researcher finding their first zero-day may share the same technical capability but act for entirely different reasons.
What separates an attacker's capability from their purpose?
Question
A low-skilled attacker and a high-skilled attacker both target a public network.
Does their skill level tell you why they are attacking?
Money is common, but adversaries can be driven by many goals.
💰
Click to reveal
🏆
Click to reveal
📢
Click to reveal
😡
Click to reveal
🗳️
Click to reveal
💡
Click to reveal
Understanding who attacks and why they do it.
Low-Skilled: Uses ready-made tools, exploits known vulnerabilities
High-Skilled: Creates new tools, may discover zero-days before a fix exists
Greed, Recognition, A Cause, Revenge, Politics, Belief
Real-world attackers often have multiple overlapping motives
A familiar name on the Wi-Fi list — but who's really behind it?
A rogue access point copies the name of a network you trust.
😈
A rogue access point mimics a trusted network name.
"Sunshine_Coffee_Free" instead of "SunshineCoffee_WiFi" — one character different, and now the adversary sits between your device and the internet.
HTTPS still protects encrypted content, but the attacker sees which sites you visit and captures anything sent in plaintext.
When the air itself becomes too noisy to communicate.
Flooding the frequency with noise blocks all legitimate traffic.
📵
A strong signal floods the frequency so no one can connect.
"No one in the gym can connect to Wi-Fi whenever a certain van is parked outside."
The goal is disruption, not theft — a wireless Denial of Service.
Someone drives by — not to break in, but to map what's in the air.
Scanning wireless beacons to map network names and coverage.
🚗
Scanning wireless beacons from outside to map network names and coverage.
"A security team finds a map online showing every Wi-Fi network name and signal strength around their office building."
The attacker collects SSIDs, network types, and signal strength — this is reconnaissance, not an active attack.
Two nearly identical network names appear in the same coffee shop.
Question
A coffee shop customer connects to Free_Cafe_WiFi. A sign at the counter says the official network is Cafe_Free_WiFi.
What kind of attack occurred?
A nearby source makes every wireless connection disappear.
Question
During a school event, all devices in the gym lose Wi-Fi whenever a certain van is parked outside.
What kind of attack is occurring?
A map reveals network signals extending beyond the building.
Question
A security team finds a map online showing every Wi-Fi network name and signal strength around their office building.
How was this map likely created?
Three distinct ways adversaries exploit wireless environments.
A rogue AP uses a matching or similar SSID to attract victims and capture network traffic.
A strong EM signal on the same frequency blocks legitimate wireless traffic, causing a DoS.
An adversary scans wireless beacons to map network names, types, and signal coverage.
You're connected. Now type your password. Where does it go?
🔑
Every keystroke travels through the access point before it reaches the internet.
Unless encryption protects that path, the network operator can see everything you send.
Your browser shows a padlock — who holds the other end?
Encryption protects your content even on an untrusted network.
🔐
Encrypts everything between your browser and the website.
"Even on an evil twin, the attacker cannot read your password inside an HTTPS session."
Metadata may still leak — DNS queries can reveal which sites you visit. HTTPS is essential, but it does not make an untrusted network trusted.
Connected to an evil twin. Does HTTPS save you?
Question
A victim connects to an evil twin and visits https://bank.com.
What can the attacker see, and what stays hidden?
Your data travels through a hidden path — but where does the tunnel end?
A VPN encrypts your traffic, but trust shifts to the provider.
🛡️
A VPN creates an encrypted tunnel past the public network.
"The coffee shop Wi-Fi can no longer read your data — but the VPN provider can."
A VPN changes who you trust, not whether you trust. Choose a provider carefully; a VPN cannot make a fake website legitimate.
Encryption still protects content, but the local network can observe more of the connection.
👀
Plaintext is readable; encrypted traffic still leaves limited clues.
HTTPS protects passwords, messages, and page content.
The local network may still observe DNS queries, connection timing, traffic volume, and anything sent without encryption.
The public network sees an encrypted tunnel, while trust shifts to the VPN provider.
🛡️
The public Wi-Fi cannot read inside the tunnel, but it can still observe the connection.
The coffee shop can see an encrypted connection to the VPN, including timing and traffic volume. The VPN provider becomes the next trusted party when traffic leaves the tunnel.
Trust does not disappear — it shifts. Choose a provider carefully. A VPN cannot make a fake website legitimate.
Tap each card to reveal what to do.
🔤
Click to reveal
🙈
Click to reveal
🔒
Click to reveal
🛡️
Click to reveal
🚪
Click to reveal
You read public news on airport Wi-Fi.
Question
You are at an airport waiting for a flight. You open your laptop, connect to the public Wi-Fi, and start reading the day's headlines on a news website.
Safe, risky, or depends?
You log into online banking at a cafe.
Question
You are at a coffee shop working on a project. Before leaving, you remember you need to check your account balance, so you open your banking app and type in your password.
Safe, risky, or depends?
You use a VPN ad you saw on social media.
Question
You are at a hotel and need to check your work email. You remember seeing an ad for a free VPN service on social media, so you install it and connect before logging in.
Safe, risky, or depends?
You connect, but a certificate warning blocks the page.
Question
You connect, but a certificate warning blocks the page.
What is the safest response?
The essential ideas to carry into every shared-network decision.
Encrypts passwords, messages, and page content
Metadata like DNS queries may still leak
Never ignore certificate warnings
Creates an encrypted tunnel past the public network
VPN provider can still see your traffic — choose wisely
VPN is not invisibility — stay cautious
Verify the exact network name
Postpone banking, purchases, and sensitive logins
Use HTTPS and a trusted VPN
Disconnect and report anything suspicious
Complete it on time and submit it before the deadline.
Check what comes next and arrive ready.
Key takeaways from this lesson.
Know the Adversary
Separate skill level from motivation and recognize zero-day capability.
Name the Attack
Distinguish evil twin, jamming, and war driving from their evidence.
Reduce Exposure
Verify the SSID, protect traffic, avoid sensitive actions, and disconnect when unsure.