X. ESSID Cloaking

EAPHammer supports the creation of hidden wireless networks. Just add one of the following three flags to whatever attack you're performing:

• --cloaking full - Send empty string as ESSID in beacons and ignore broadcast probes.
• --cloaking zeroes - Replace all characters in ESSID with ASCII 0 in becaons and ignore broadcast probes.
• --cloaking none - Do not use ESSID cloaking (default). For example, to add full ESSID cloaking to a Hostile Portal attack:

./eaphammer -i wlan0 \
	-e TotallyLegit \
	-c 1 --auth open \
	--hostile-portal \
	--cloaking full

There are a couple of reason why you might want to use ESSID cloaking:

1. The network you are targeting uses ESSID cloaking (although in a lot of cases you'll get better results without cloaking your rogue access point. Try it without cloaking first).
2. You are performing a Karma attack.