Very interesting. Is that also an attack vector on private VPNs?

1. Identify the internal layout of a corporate VPN.

2. Pick a service on, say 10.1.2.3:80

3. Trick user into joining either rogue AP, or rogue VPN

4. Serve an identical service on 10.1.2.3:80 on your network