Penetration Testing: Rogue AP Wireless on Windows/Linux

["szynkro () gmail com" <szynkro () gmail com>]

Hi,

I'm looking for a way/all in one tool to simulate a wireless Access
Point on a Windows XP and/or Linux system preferably with built-in
DHCP daemon and all.
The goal is to see if we can trick wireless clients in connecting to
the AP, sniffing for potential credentials and other interesting stuff
etc...

I've heard about hotspotter, airsnarf and alikes but don't know if
they are valid...

The scenario would be sniffing the unknown wireless network for valid
SSID's and setting the SSID on the rogue AP.... then fingers crossed I
guess that signal is strong enough to get some clients connecting. Can
we force/help the client in associating with the rogue AP?

Anyone some other valid (recent) Wireless Pen-Test scenario's?

thanks