[hunt3r972]

This is the correct answer ^

[ch3rn0byl]

If he wants to sniff the network so yes he will need the WPA/WPA2 key, you're right.
If he wants to do an MITM attack he will also need the WPA/WPA2 key to connect to it to do his MITM attack, you're right too.

The thing that made me think he is confusing about MITM and Evil Twin is that he wants to create a fake AP with the same ESSID that will allow him to sniff the victime

You can do an "Evil Twin" AP and MITM attack in the same "hack". The two are not mutually exclusive.

MITM is a technique used on a network to get between the victim and his destination. How that victim connects to the network is irrelevant. If you deauth someone and youve got an Evil Twin with a stronger signal that they auto-connect to with no passphrase then you can perform a MITM.

the OP's confusion is about the evil twin... how the victim would connect if the fake AP had a passphrase... but in reality this is irrelevant. the device will often connect automatically to any network it can with a strong signal.

So let's say I have everything set up, they're connected, and they are surfing the web...attempting mitm always...from my testing, kills the connection. I only tried a few tools like dsniff, ettercap, and arpspoof. With arpspoof though, from my testing, you can only spoof one way, and forget about sslstrip haha..it's dead. The connection always comes back up when those commands are terminated. I'm gonna try ferret and hamster and see if that'll work. Have you had that?

[hunt3r972]

So let's say I have a WPA2 network named "linkgear". Would it be possible for a cyber criminal to obtain my WPA2 key by creating an evil twin "linkgear" AP which uses WEP passphrase authentication instead of WPA2. Then persuade/force my client devices and their human operators to attempt to connect to the evil "linkgear" AP with the real "linkgear"s WPA2 key, thereby performing a caffe-latte attack? It would rely on a little user ignorance as they would have to type the WPA2 key but 95% of the population would think absolutely nothing of it.

In this case the thing I would do gonna be:
1. Creating the linkgear fake AP with open encryption
2. DeAuth you from the real to make your computer connect to the fake one
3. Run a apache/PHP/mysql server hosting a page that will tell you "Your router has been updated. Enter your WPA2 key to activate internet" or something like this. The password will be sent to my mysql database with a short php script
4. Redirect your traffic to my hosted page when you'll try to go to google.com for example
5. Wait until you enter the key
6. Stop DeAuth so you will reconnect to the real AP
7. Take your WPA2 key in my mysql database and use it to connect to your AP

This is evil twin attack

[5y5t3m32]

in MITM we sniff the clients traffic.
in evil twin attack we redirect them to fake page.
evil twin is not suitable for mobile client and other situation.
can someone tell me that how can we capture password of AP in fake AP ??