Skip to content

Payloads

Qwavey edited this page Aug 23, 2026 · 1 revision

Payloads

The 8 on-screen menu wrappers under payloads/general/<name>/payload.sh. Each one drives the CLI scripts documented elsewhere in this wiki, through the Pager's own picker/dialog UI (DuckyScript LIST_PICKER, NUMBER_PICKER, CONFIRMATION_DIALOG, ALERT, LOG) instead of flags - no SSH session needed to run any of these, they show up directly in the Pager's Payload menu after python setup.py.

Title/author/description/version below are pulled straight from PAYLOAD_META in setup.py (the same source the device itself shows) - setup.py warns if a payload.sh's own # Version: header ever drifts out of sync with this.

LAN Sniffer (lan_sniffer) - v3.6

Live LAN traffic view - auto-detected adapter, or bridge/tap both ports (internet is forwarded, not blocked, with a brief settling window after bridging; self-heals eth0/br-lan if the bridge drops it). Timer or infinite duration, A pauses/resumes, B asks to stop, then offers to save the log. HTTP/DNS/credential hits are flagged live with source IP and destination host; a captured credential pops a dedicated alert so it can't get lost in the scroll. Shows a live progress bar while the bridge comes up instead of one static line.

Driven by sniff.sh.

WiFi Deauth (wifi_deauth) - v9.0

Continuously deauth a network's clients until you press B. Same-name networks (mesh APs) are grouped - pick once to hit all of them. Chase mode follows a specific target as it roams a mesh; dynamic escalation periodically re-checks each AP for still-active clients and escalates burst pressure specifically where it's measurably not working yet - whole-range disruption, not one device. (Dual-radio support was removed - it caused repeated hard hangs needing a manual power cycle.)

Driven by deauth.sh.

Bluetooth Jam (bluetooth_jam) - v4.1

Scan (classic + BLE), L2CAP-flood one target, jam the whole area, flood BLE adverts, or occupy the 2.4GHz band (full sweep or BLE-advertising- channel focus). Press B to stop.

Driven by bluetooth.sh.

DeadNet LAN Kill (deadnet_lan_kill) - v4.0

Discovers live LAN hosts, then ARP-poisons the whole wired LAN (eth1) to disconnect them. Real --background support with a liveness check. Press B to stop.

Driven by deadnet.sh.

PC Link Capture (pc_link_recon) - v2.0

Detects the PC directly wired to the Pager (USB-C tether or USB-A adapter) and captures + summarizes its traffic.

Driven by pc_link.sh.

Live Packet Tracer (packet_tracer) - v1.0

Wireshark-style live packet trace - WiFi connection, wired LAN, or passive nearby-WiFi monitoring. Errors clearly if there's nothing to trace. Press B to stop.

Driven by tracer.sh.

Custom LAN Scan (custom_lan_scan) - v2.0

nmap scan of the wired LAN (eth1) - pick a mode on-screen, logs to /root/loot/lanscan/.

Driven by LanScan.sh.

Reset Device State (reset_device) - v1.2

Undo everything this toolkit can leave in a non-standard state, or a fast pineapple-app restart, or a full slow reboot. Live progress, not a wait-then-dump.

Driven by reset.sh.

Clone this wiki locally