Skip to main content

WiFi Pineapple Pager — The Complete Guide

一句話定位：WiFi Pineapple Pager 是 Hak5 二十週年的旗艦 — 把整台 Pineapple 塞進口袋，2.4 吋螢幕、三頻無線電（2.4/5/6 GHz）、還有 DuckyScript 驅動的 Payload 系統，完全不需要電腦就能出任務。

The Pager answers the question every Pineapple owner eventually asks: "What if I didn't need a laptop to run this?" It's a standalone Linux handheld with a full color screen, four RGB D-pad buttons, a buzzer, a vibration motor, and the 8th-generation PineAP engine — capable of tri-band recon, evil-twin attacks, and automated DuckyScript payloads, all on a 2000 mAh battery clipped to your belt.

It's the "retro pager from the 90s" aesthetic with a modern pentest brain — and for students, it's the most approachable Pineapple yet because the screen tells you what's happening instead of a cryptic LED.

⚠️ Authorised testing only. A pocket-sized rogue AP is still a rogue AP. Test on your own networks only.

Specs at a glance​

ItemSpecification
CPU580 MHz MIPS 24K router-class chip
Wireless (primary)Dual-PHY 2T2R 802.11 a/b/g/n/ac/ax
Wireless (secondary)Single-PHY 2T2R 802.11 b/g/n
BandsTri-band: 2.4 GHz / 5 GHz / 6 GHz
BluetoothBluetooth 5.2 + BLE 4.2
Display2.4" LED-backlit TFT, 480×222 px (221 PPI), 16-bit color
Memory / Storage256 MB DDR2 RAM / 128 MB SPI flash / 4 GB eMMC
Battery2000 mAh LiPo (serviceable, BMS, LED charge indicator)
PortsUSB-C (charge + integrated Ethernet), USB 2.0 (expansion)
Indicators4× RGB LED, PWM buzzer, vibration motor, RTC
OS / PayloadsOpenWrt-based Linux; DuckyScript + Bash + Python
Official docshttps://docs.hak5.org/wifi-pineapple-pager

Anatomy​

PartPurpose
2.4" color screenLive dashboard: recon results, payload status, menus
4-way D-pad + A/B buttons (RGB)Navigate menus, trigger payloads, get haptic feedback
USB-C portCharging AND Ethernet adapter (host access to the Pager's LAN)
USB 2.0 portHardware mods: GPS, extra radios, custom modules
Belt clipField ops — hands-free deployment
Speaker + vibrationReal-time alerts: "target AP appeared", "payload matched"

What makes it different from other Pineapples​

Mark VIIPager
Laptop requiredYes (web UI on 1471)No — screen + buttons onboard
Bands2.4 GHz (+5 GHz w/ MK7AC)2.4 / 5 / 6 GHz out of the box
Payload engineModules onlyDuckyScript + Bash + Python
FeedbackRGB LEDScreen, buzzer, vibration, RGB
PowerUSB-C (tethered)Battery — truly portable

Quickstart — first boot​

Step 1 — Charge​

Plug the Pager into USB-C. The charge LED shows progress; the screen wakes.

Step 2 — Power & first dashboard​

Press the power button. Within ~30 seconds the screen shows the main menu: Recon, PineAP, Payloads, Settings.

Step 3 — Set your timezone & password​

  • Settings → System → timezone (the RTC keeps timestamps correct even when off).
  • Settings → Security → set an admin password for the web/SSH access.

Step 4 — Run your first Recon​

  1. D-pad to Recon → Start Scan.
  2. Watch the screen populate: APs and clients on 2.4 GHz and 5 GHz (6 GHz needs toggling on in Settings → Network → 6 GHz — it's off by default for good reasons: short range, few clients).

Expected screen output:

Scanning...
  [2.4G] CoffeeShop      WPA2   ch 6
  [5G]   Home-5G         WPA3   ch 36
  [2.4G] Office-Guest    OPEN   ch 11   ← interesting
Clients: 23   APs: 12

Step 5 — Trigger your first payload​

  1. Payloads → Library → pick a built-in example (e.g. "AP Alert").
  2. Press A to arm it as the default.
  3. The payload runs automatically when its trigger condition is met — the buzzer chirps and the screen flashes the match.

You might be asking: "Why would I want a payload that just alerts me?" Because that's the core red-team workflow: park the Pager in a target zone, let it recon passively, and get notified when a specific AP/client pattern appears — then decide to act. The Pager is a sensor and trigger device, not just an attack box.

Payloads — DuckyScript on a Pineapple​

The Pager runs the same DuckyScript family as the USB Rubber Ducky, but extended for wireless: payloads can inspect the airspace, branch on events, and control the buzzer/display. Payload Studio v1.5+ supports Pager payloads (Community & Pro).

REM Example: alert when a specific SSID appears
WAIT_FOR_EVENT ssid "CoffeeShop"
BUZZER 3
DISPLAY "Target AP detected!"
REM Example: capture handshakes on a schedule
BEGIN_PAYLOAD
SET_TIME 2 30
REPEAT_FOREVER
    RECON SCAN 60
    IF handshake_found THEN
        BUZZER 2
        SAVE_LOOT "handshake.pcap"
    END_IF
END_PAYLOAD

These examples illustrate the concepts — exact command names ship with each firmware release. Always check the Pager docs (https://docs.hak5.org/wifi-pineapple-pager) for the current command set.

Advanced​

CapabilityHow
Rogue AP / evil twinPineAP menu — clone SSIDs, beacon-response luring, deauth
WPA3-Enterprise testingTri-band radios cover the newest enterprise auth; pair with the Enterprise tab concepts
Automated field reconPayload schedules: scan → save loot → notify, hands-free
Custom hardware modsUSB 2.0 port + root Linux: GPS modules, SDR radios, you name it
Remote managementVirtual Pager web interface — see the screen and press buttons from your browser
Cloud C²Offload loot and manage payloads remotely
Host accessUSB-C Ethernet adapter gives a computer direct LAN access to the Pager

Troubleshooting​

SymptomCauseFix
6 GHz APs never appear in Recon6 GHz disabled by defaultSettings → Network → enable 6 GHz (expect shorter range)
Screen dim / no buzzerBattery saver or muted alertsCheck Settings → Display / Audio
Payload doesn't triggerTrigger pattern doesn't matchRecheck SSID/BSSID matching in the payload editor
Battery dies fast during scansContinuous tri-band scanning is power-hungryUse 2.4+5 GHz only, or schedule payloads
Can't reach Virtual PagerPager not on the same network as your browserConnect via USB-C Ethernet or join the Pager's hotspot