WiFi Pineapple: Pager (Pocket-Sized Hacking Hardware)

WiFi Pineapple: Pager (Portable WiFi Hacking Tool)

The Pager is Hak5's newest device — a standalone, battery-powered, pager-form-factor wireless auditing platform. Think of it as a miniaturized Mark VII that fits in your palm, with a screen, a buzzer, and a 2000 mAh battery. It was released in late 2025 and represents a significant leap over the Mark VII in several key areas.

Full Hardware Specs

Component	Detail
CPU	580 MHz MIPS 24K Router SoC
RAM	256 MB DDR2
Storage	4 GB eMMC + 128 MB SPI
Primary WiFi Radio	Dual PHY 2T2R — 802.11 a/b/g/n/ac/ax (WiFi 6)
Secondary WiFi Radio	Single PHY 2T2R — 802.11 b/g/n
Frequency Bands	2.4 GHz, 5 GHz, 6 GHz (tri-band)
Bluetooth	5.2 + BLE 4.2
Battery	2000 mAh LiPo (serviceable, user-replaceable)
Charging	USB-C, 5V 2A (~2.5–4 hours full charge)
Ethernet	Integrated USB-C Ethernet adapter
Display	Color screen (vibrant, readable)
Audio	Buzzer + vibration motor
LEDs	4x RGB LED, charging status LED
RTC	Real-time clock with onboard battery backup
Dimensions	87 × 62 × 24 mm
Weight	131 grams

Key Differentiators From The Mark VII

1. 6 GHz Band (WiFi 6 / 802.11ax)

This is the single biggest upgrade. The Pager's primary radio covers 2.4, 5, and 6 GHz natively. No add-on adapter needed for 6 GHz — it's built in. In 2026, enterprise environments are increasingly using 6 GHz for WPA3-only deployments, and the Mark VII can't see that spectrum at all without unsupported third-party dongles and custom drivers.

2. Fully Standalone — No Laptop Required

The Mark VII needs USB-C tethering to a laptop for power and Ethernet. The Pager runs completely independently on battery for hours. You can walk through a building, a parking lot, or a campus with it in your pocket and it continuously performs recon, runs PineAP, and triggers alert payloads — no laptop, no cables, no visible equipment.

3. Real-Time Alerts (the "Pager" part)

This is where the name comes from. The Pager has a buzzer, vibration motor, and screen, and it runs alert payloads that fire on events:

• A specific client MAC address appears in recon.

• A target SSID is detected.

• A handshake is captured.

• A deauth target connects to your rogue AP.

• Bluetooth/BLE device of interest enters range.

Payloads can trigger ringtones, vibration, on-screen messages, or launch full attack scripts. It's essentially a portable event-driven attack platform you wear on your belt.

4. DuckyScript + Bash Payload System

The Pager runs DuckyScript™ natively, the same language used by the USB Rubber Ducky and O.MG Cable. Combined with Bash, you can write payloads that:

• Interact with the display and physical buttons.

• Run PineAP operations (beacon response, SSID pool management, mimic mode).

• Trigger on recon events (new AP detected, new client, handshake captured).

• Use ALERT, VIBRATE, RINGTONE, CONFIRMATION_DIALOG, PROMPT commands to interact with the user via the screen.

Payload categories:

• Alert payloads — fire on events, show messages, trigger actions.

• Recon payloads — automate scanning, filtering, and data collection.

• User payloads — manually launched from the menu.

• Advanced payloads — full scripting with environment variables and chaining.

PineAP - 8th Generation Engine

The Pager ships with an entirely rewritten PineAP engine that Hak5 claims is 100× faster than previous generations, optimized for dense RF environments. It includes:

• Beacon Response — answer probe requests from nearby clients.

• Broadcast SSID Pool — continuously advertise arbitrary SSIDs.

• Capture SSIDs to Pool — auto-harvest observed probe requests.

• Mimic Mode — clone a target AP's parameters exactly.

• Evil WPA — rogue WPA-secured AP for credential capture.

• Handshake Collection — automatically capture WPA handshakes from connecting clients.

• Open AP — simple open rogue access point.

• Device/Network Filters — whitelist/blacklist specific MACs, SSIDs, and channels.

• Per-band toggles — enable/disable 2.4, 5, and 6 GHz independently.

Recon

Instant, continuous scanning across all three bands plus Bluetooth/BLE:

• Active and passive AP and client discovery.

• RSSI, channel, encryption type, associated clients per AP.

• Bluetooth device identification (BLE advertisements, device names, MACs).

• Export to PCAP, Wigle, or CSV.

• EXAMINE command locks the recon radio to a specific channel for deep inspection.

• FIND_CLIENT_IP resolves a target client's IP by ARP probing.

Critical Operational Note: External Adapter Required For Recon/Attack

This is the most important detail that catches people off guard. The Pager's built-in WiFi radios are management-only. The internal radios handle the Pager's own management network, PineAP operations, and Bluetooth — but for monitor mode, packet injection, and recon, you must plug in a USB adapter (the MK7AC, same as the Mark VII).

The adapter enumerates as wlan1 and all recon, deauth, handshake capture, and payload-based attack operations run through it. Without the adapter plugged in, you have a PineAP controller with no recon data feed and no injection capability.

This means:

• The Pager + MK7AC dongle in your pocket is the real operational setup.

• The dongle will drain battery faster — expect reduced runtime during active operations.

• The dongle's antennas protrude and break the "stealth pager" aesthetic slightly.

Virtual Pager - Remote Control

Just like the Mark VII's web dashboard, the Pager has a Virtual Pager interface accessible from a browser. Connect to the Pager's management WiFi (or Ethernet via USB-C), browse to its IP, and you get:

• Full PineAP control.

• Recon dashboard with live results.

• Payload management and execution.

• Web terminal (SSH access).

• File browser for loot retrieval.

• GPS data overlay if GPS is active.

This means you can set up the Pager in a target area, walk away, and control it remotely from your laptop or phone over its management WiFi.

GPS Integration

The Pager has GPS support — you can feed it NMEA data and it'll geotag recon results, handshake captures, and alert events. This feeds into Wigle exports and on-screen mapping. Combined with the battery, you can literally walk a site survey and have every AP plotted geographically.

Quick Comparison: Mark VII vs. Pager

Feature	Mark VII	Pager
2.4 GHz	✅ Built-in	✅ Built-in
5 GHz	❌ Needs MK7AC	✅ Built-in
6 GHz (WiFi 6)	❌	✅ Built-in
Bluetooth / BLE	❌	✅ 5.2 + BLE 4.2
Battery	❌ USB-powered only	✅ 2000 mAh LiPo
Standalone operation	❌ Needs laptop	✅ Fully standalone
Screen	❌ (headless)	✅ Color display
Alerts (audio/vibration)	❌	✅ Buzzer + motor
DuckyScript	❌	✅
Recon radio	Built-in (2.4 only)	Needs MK7AC dongle
PineAP engine	7th gen	8th gen (100× faster)
Form factor	Desktop box	Pocket pager
Price	~$140	~$180–200

Practical Red Team Use Cases

1. Walk-by recon — pocket the Pager with MK7AC attached, walk through a target building or campus, capture every AP, client, probe request, and Bluetooth device silently. No laptop visible.

2. Client hunting — write an alert payload that vibrates when a target executive's phone MAC appears in recon. Walk through a lobby or coffee shop and know instantly when they're nearby.

3. Drop box / persistent recon — leave the Pager plugged into a USB power bank in a target area (under a desk, in a ceiling, in a plant). Connect to its management WiFi or use an out-of-band cellular backhaul and monitor recon remotely via Virtual Pager for days.

4. Credential capture — set up Evil WPA mimicking the target's corporate SSID. When employees connect, capture the WPA handshake or the RADIUS/MSCHAPv2 exchange, and crack offline. Or serve an Evil Portal for a captive portal attack.

5. Deauth + PineAP combo — deauth target clients from legitimate APs, force them to reconnect to your PineAP rogue AP, inspect or manipulate traffic. All from your pocket.

Setup Quickstart

1. Charge fully — USB-C to a 5V charger until the LED goes green (2.5–4 hours).

2. Power on — hold the power button.

3. Connect — the Pager creates its own management WiFi. Connect your phone/laptop to it.

4. Browse to Virtual Pager — or use the on-device screen and buttons for initial config.

5. Set up internet passthrough — connect the Pager to a WiFi network with internet access for firmware updates and module downloads.

6. Plug in MK7AC — attach the USB dongle before running any recon or attack payloads.

7. Update firmware — over WiFi, no computer needed.

8. Install payloads — from the Hak5 community repo or write your own.

Community Payload Repos

• Official: github.com/hak5/wifipineapplepager-payloads

• NullSec Suite (third-party): 125+ professional payloads across 14 categories — recon, interception, exfiltration, stealth ops, Bluetooth attacks, and more.

Please Donate Here