PineAP and Access Point Control

PineAP & Access Point Control

The core rogue-AP surface - cloning, filters, SSID pool, bands, DNS.

Every command block below is that script's own --help output on the real device, pulled straight from its header comment - not retyped.

• EvilTwin.sh - Dynamic evil-twin / clone-AP launcher.
• openap.sh - Manage the Open AP directly (enable/disable/hide/clear).
• mgmt.sh - Manage the Management AP (enable/disable/hide/clear).
• mimic.sh - Toggle PineAP mimic mode (karma - answer any probed SSID).
• ssidpool.sh - Manage the SSID-impersonation pool (add/list/delete/start/stop).
• filters.sh - Manage PineAP device (MAC) and network (SSID) filters.
• bands.sh - Set which WiFi bands recon monitors.
• examine.sh - Lock recon to one channel/BSSID for handshake collection, or resume hopping.
• reconsession.sh - Start a fresh recon session; pause/resume channel hopping.
• dns.sh - Override the system DNS handed out to clients.
• dnsspoof.sh - Manipulate DNS given to Pineapple AP clients (add/remove spoofed hosts).

EvilTwin.sh

Dynamic evil-twin / clone-AP launcher.

EvilTwin.sh - Dynamic PineAP evil-twin / clone-AP launcher for the
              WiFi Pineapple Pager. Uses ONLY official Hak5 commands
              (WIFI_*, PINEAPPLE_*, PAYLOAD_*_CONFIG) - see
              documentation.hak5.org/wifi-pineapple-pager

Confirmed by direct testing against this device's local API:
  WIFI_WPA_AP / WIFI_OPEN_AP / WIFI_MGMT_AP only accept the
  pre-defined radio0 interfaces (wlan0wpa / wlan0open / wlan0mgmt).
  There is no official way to run the clone AP on radio1 (5GHz).
  Hak5's intended design: Ethernet/USB-C (eth1) carries the uplink,
  radio0 stays fully dedicated to PineAP.

Usage:
  EvilTwin.sh                                   interactive mode
  EvilTwin.sh --cloned "SSID" [--clone-pw PW] [options]

Options:
  --cloned SSID        SSID to clone / broadcast (required)
  --clone-pw PASS      Password for the clone (WPA2-PSK). Omit for an open AP.
  --hidden             Hide the clone AP's SSID
  --bssid MAC           Specific BSSID for the clone AP (default: device MAC)
  --uplink eth|wifi|auto   Uplink source (default: auto)
  --wifi SSID           Uplink WiFi SSID (uplink=wifi only)
  --wifi-pw PASS        Uplink WiFi password (uplink=wifi only)
  --mimic               Enable PineAP mimic mode (answer ANY probed SSID, open AP only)
  --record              Start an official WIFI_PCAP capture of the engagement
  --scope-filter         Restrict the network filter to only the cloned SSID (default: on)
  --no-scope-filter       Do not touch PineAP network filters
  --stop, --off          Tear down the evil AP (and uplink WiFi client, if we started it)
  --on                    Bring the AP back up using your last saved settings (no prompts)
  --status               Show current PineAP / uplink status and exit
  -y, --yes              Don't prompt for confirmation
  -h, --help              This help

Settings are persisted with the official PAYLOAD_SET_CONFIG store under the
"eviltwin" namespace, so re-running interactively will offer your last values
as defaults.

openap.sh

Manage the Open AP directly (enable/disable/hide/clear).

openap.sh - Manage the Pineapple Open AP directly. Wraps WIFI_OPEN_AP /
WIFI_OPEN_AP_DISABLE / WIFI_OPEN_AP_HIDE / WIFI_OPEN_AP_CLEAR.

For a full clone-with-internet-passthrough setup, use EvilTwin.sh instead
- this is the bare single-purpose wrapper for just the Open AP itself.

Usage:
  openap.sh --on --name "SSID" [--bssid AA:BB:CC:DD:EE:FF]
  openap.sh --off / --hide / --clear / --status
  openap.sh                interactive mode

Options:
  --on            Enable the Open AP (needs --name)
  --name SSID      SSID to broadcast
  --bssid MAC       Specific BSSID (default: device MAC)
  --off            Disable the Open AP
  --hide            Hide the SSID
  --clear            Wipe the Open AP configuration
  --status            Show current Open AP config
  -y, --yes            Don't prompt for confirmation
  -h, --help             This help

mgmt.sh

Manage the Management AP (enable/disable/hide/clear).

mgmt.sh - Manage the Pager's Management AP. Wraps WIFI_MGMT_AP /
WIFI_MGMT_AP_DISABLE / WIFI_MGMT_AP_HIDE / WIFI_MGMT_AP_CLEAR.

Usage:
  mgmt.sh --on --name "SSID" --pw "password"
  mgmt.sh --off
  mgmt.sh --hide
  mgmt.sh --clear
  mgmt.sh --status
  mgmt.sh                interactive mode

Options:
  --on              Enable/configure the Management AP (needs --name)
  --name SSID        Management AP SSID
  --pw PASS           Management AP password (WPA2/WPA3-SAE-mixed)
  --off              Disable the Management AP
  --hide              Hide the Management AP SSID
  --clear              Wipe the Management AP configuration
  --status              Show current Management AP config
  -y, --yes              Don't prompt for confirmation
  -h, --help               This help

mimic.sh

Toggle PineAP mimic mode (karma - answer any probed SSID).

mimic.sh - Toggle PineAP mimic mode (karma - answer ANY probed SSID on
the Open AP). Wraps PINEAPPLE_MIMIC_ENABLE / PINEAPPLE_MIMIC_DISABLE.

Usage:
  mimic.sh --on
  mimic.sh --off
  mimic.sh                interactive mode

ssidpool.sh

Manage the SSID-impersonation pool (add/list/delete/start/stop).

ssidpool.sh - Manage the PineAP SSID impersonation pool. Wraps
PINEAPPLE_SSID_POOL_ADD / LIST / DELETE / CLEAR / START / STOP /
COLLECT_START / COLLECT_STOP.

Usage:
  ssidpool.sh add "SSID" ["SSID2" ...]
  ssidpool.sh delete "SSID" ["SSID2" ...]
  ssidpool.sh list
  ssidpool.sh clear [-y]
  ssidpool.sh --on [random]      start advertising the pool (optional random BSSID)
  ssidpool.sh --off                stop advertising
  ssidpool.sh --collect on|off       auto-collect probed SSIDs into the pool
  ssidpool.sh                          interactive mode

filters.sh

Manage PineAP device (MAC) and network (SSID) filters.

filters.sh - Manage PineAP device (MAC) and network (SSID) filters.
Wraps PINEAPPLE_DEVICE_FILTER_* and PINEAPPLE_NETWORK_FILTER_*.

Usage:
  filters.sh device mode allow|deny
  filters.sh device add allow|deny AA:BB:CC:DD:EE:FF [MAC2 ...]
  filters.sh device delete allow|deny AA:BB:CC:DD:EE:FF [MAC2 ...]
  filters.sh device clear allow|deny [-y]
  filters.sh device list allow|deny
  filters.sh network mode allow|deny
  filters.sh network add allow|deny "SSID" ["SSID2" ...]
  filters.sh network delete allow|deny "SSID" ["SSID2" ...]
  filters.sh network clear allow|deny [-y]
  filters.sh network list allow|deny
  filters.sh                interactive mode

Note: PINEAPPLE_MIMIC is automatically paused while filters change and
re-enabled after, matching Hak5's own documented example - filter
changes should not be made live while mimic mode is actively answering
probes.

bands.sh

Set which WiFi bands recon monitors.

bands.sh - Set which WiFi bands recon monitors. Wraps
PINEAPPLE_SET_BANDS [interface] {2} {5} {6}.

Usage:
  bands.sh --iface wlan1mon --2 --5          monitor 2.4GHz + 5GHz only
  bands.sh --iface wlan1mon --2 --5 --6       monitor all bands
  bands.sh                                      interactive mode (default iface: wlan1mon)

examine.sh

Lock recon to one channel/BSSID for handshake collection, or resume hopping.

examine.sh - Lock recon to a single channel/BSSID (helps handshake
collection) or resume normal hopping. Wraps PINEAPPLE_EXAMINE_BSSID /
PINEAPPLE_EXAMINE_CHANNEL / PINEAPPLE_EXAMINE_RESET.

Usage:
  examine.sh --bssid AA:BB:CC:DD:EE:FF [--time SECONDS]
  examine.sh --channel 6 [--time SECONDS]
  examine.sh --reset
  examine.sh                interactive mode

reconsession.sh

Start a fresh recon session; pause/resume channel hopping.

reconsession.sh - Start a fresh recon session, and pause/resume channel
hopping. Wraps PINEAPPLE_RECON_NEW / PINEAPPLE_HOPPING_START/STOP.

Usage:
  reconsession.sh --new [NAME] [-y]
  reconsession.sh --pause
  reconsession.sh --resume
  reconsession.sh                interactive mode

dns.sh

Override the system DNS handed out to clients.

dns.sh - Override the system DNS. Wraps SYSTEM_DNS.
Syntax confirmed live via SYSTEM_DNS --help:
  SYSTEM_DNS DHCP        use the DNS server(s) handed out by DHCP
  SYSTEM_DNS [IP]        pin a specific DNS server

Usage:
  dns.sh --dhcp          use DHCP-provided DNS
  dns.sh --set IP          pin a specific DNS server
  dns.sh                     interactive mode

dnsspoof.sh

Manipulate DNS given to Pineapple AP clients (add/remove spoofed hosts).

dnsspoof.sh - Manipulate DNS given to clients of the Pineapple APs. Wraps
DNSSPOOF_ENABLE/_DISABLE/_ADD_HOST/_DEL_HOST/_CLEAR.

Usage:
  dnsspoof.sh --on
  dnsspoof.sh --off
  dnsspoof.sh --add example.com 10.0.0.5
  dnsspoof.sh --del example.com
  dnsspoof.sh --clear [-y]
  dnsspoof.sh                interactive mode