WiFi Pineapple: Mark VII (Hacking Hardware)
- Biohazard
- 6 days ago
- 3 min read
Hack With The WiFi Pineapple: Mark VII
The WiFi Pineapple, developed by Hak5, is a purpose-built rogue access point platform designed for wireless network auditing and man-in-the-middle attacks. It runs a custom OS (Pineapple OS, based on OpenWrt) and provides a web-based interface called the Pineapple Dashboard. Here's a breakdown of its core capabilities and usage:
Hardware & Setup
The latest flagship is the WiFi Pineapple Mark VII (and the cheaper Tetra and Nano models still float around). It has two radios — one for management/AP and one for recon — and typically runs off USB-C power.
Initial setup:
Connect via USB-C to your laptop (shows up as an Ethernet adapter, usually 172.16.42.0/24).
Browse to http://172.16.42.1:1471 and go through the setup wizard.
Set a strong root password, configure internet sharing from your host so the Pineapple can reach the web.
Key Features & Modules
1. Recon
Passive and active scanning of nearby wireless networks and clients. Collects SSIDs, BSSIDs, signal strength, encryption types, probe requests, and associated clients. You can filter and export results for further analysis.
2. PineAP Suite
The heart of the Pineapple's attack surface. It encompasses:
Beacon Response — Responds to probe requests from nearby clients, impersonating the networks they're looking for.
Broadcast SSID Pool — Continuously broadcasts arbitrary SSIDs to populate nearby device Wi-Fi lists.
Capture SSIDs to Pool — Harvests observed probe requests and automatically adds them to the broadcast pool.
Dogma — Filters and controls how PineAP interacts with specific clients or networks.
Used together, these force nearby clients to associate with your Pineapple so you can intercept traffic.
3. Evil Portal
Creates a captive portal that mimics any login page. When a client connects and tries to browse the web, they're redirected to this portal. You can:
Clone any login page (Google, Facebook, corporate VPN portals).
Capture credentials, emails, tokens.
Serve custom HTML/JS payloads.
4. tcpdump / Dwall
Packet capture and traffic inspection directly on the device:
tcpdump for raw PCAPs you can pull to Wireshark.
Dwall strips SSL/TLS warnings from captive portal detection, reducing signs of interception.
5. Modules (Pineapple Modules / Community Modules)
The module ecosystem extends functionality enormously:
Module | Purpose |
HTTPProxy | Transparent HTTP proxy, logs all cleartext traffic |
DNSMasq Spoof | Redirect DNS queries to your Pineapple |
SSLsplit | Man-in-the-middle SSL/TLS interception (requires client to accept your CA) |
Deauth | Send deauthentication frames to disconnect clients from legitimate APs |
Site Survey | Detailed heatmap-style Wi-Fi survey |
Occupineapple | Deauth + PineAP combo for aggressive client harvesting |
Cabinet | File storage and exfiltration |
ettercap | Full network-level MITM suite |
Common Workflow
A typical engagement flows like this:
Recon to map the target environment — SSIDs, clients, signal ranges.
Deploy PineAP to lure target clients by responding to their probe requests (beacon response) and broadcasting the target's SSIDs.
Optionally use deauth attacks to kick clients off legitimate APs, forcing them to reconnect to your Pineapple.
Once associated, serve an Evil Portal (if credential capture is the goal) or set up SSLsplit + transparent proxy for traffic inspection.
Log everything, export PCAPs, and analyze.
Important Technical Notes
SSL/TLS interception (SSLsplit) requires the client device to trust your CA certificate. This works well against devices that don't validate certificates properly, or when you can physically install your CA (e.g., during an authorized physical assessment).
HSTS will prevent many modern browsers from connecting to your SSLsplit proxy for cached domains. You can work around this by targeting non-HSTS domains or using downgrade techniques.
The Pineapple's 2.4 GHz and 5 GHz support is model-dependent. The Mark VII supports both.
For engagements where clients use 802.1X (WPA2-Enterprise), you'll typically pair the Pineapple with a tool like hostapd-wpe or EAPHammer on a separate device, as RADIUS relay attacks need more horsepower.
Companion Tools Worth Pairing
Bettercap — More flexible MITM framework, can run alongside or on a separate device.
Airgeddon — Script-driven wireless auditing with deauth, evil twin, and handshake capture.
EAPHammer — Specialized in 802.1X enterprise attacks (steals RADIUS credentials).
Wireshark — For deep-dive PCAP analysis after tcpdump captures.
Comments