How to create fake AP with linux /windows
 

> Creates a fake AP and DHCP server.> Runs a web server & creates an exploit with metasploit.
> Waits for target to connect,
> Uses a backdoor, SBD (Secure BackDoor - bit like netcat!), though this could be replace with VNC if attacker wishes!
> Then starts a few 'sniffing' programs (dnsiff suite) to watch what target does!

http://www.backtrack-linux.org/forums/showthread.php?t=19770

Has anybody tried this before