WiFi Client and Connectivity

WiFi Client & Connectivity

Getting the Pager itself online, and keeping remote access available.

Every command block below is that script's own --help output on the real device, pulled straight from its header comment - not retyped.

• connect.sh - Connect the Pager itself to a WiFi network (auto-detects encryption).
• wifi.sh - Master WiFi kill-switch / restore, official commands only.
• clientip.sh - Look up a connected client's IP address by MAC.
• vpn.sh - Configure/enable/disable OpenVPN or WireGuard.
• autossh.sh - Maintain a persistent outbound SSH tunnel (phone-home access).

connect.sh

Connect the Pager itself to a WiFi network (auto-detects encryption).

connect.sh - Simple WiFi client connect for the Pager. Wraps the official
WIFI_CONNECT / WIFI_WAIT / WIFI_DISCONNECT / WIFI_CLEAR commands and
figures out the encryption type for you instead of making you specify
psk/psk2/sae/sae-mixed/open up front.

Usage:
  connect.sh --name "SSID" --pw "password"     connect (auto-detects security)
  connect.sh --name "Open Network"               connect to an open network
  connect.sh --off                                disconnect
  connect.sh --status                             show current connection
  connect.sh                                       interactive mode

Options:
  --name SSID     Network to connect to
  --pw PASS        Password (omit for an open network)
  --off             Disconnect (keeps saved config - use --clear to wipe it)
  --clear            Disconnect AND forget the saved network config
  --status           Show current client connection status
  --timeout SECS      How long to wait for association per attempt (default: 20)
  -y, --yes           Don't prompt for confirmation
  -h, --help           This help

How "security resolved automatically" works: WIFI_CONNECT needs an
explicit encryption type. Rather than guessing wrong and failing silently,
this tries the encryption types in order of how common they actually are
- psk2, then sae-mixed, then sae, then psk - and stops at the first one
that actually associates (confirmed via the official WIFI_WAIT command).
If none work, it tells you plainly instead of leaving you guessing.

wifi.sh

Master WiFi kill-switch / restore, official commands only.

wifi.sh - Master WiFi kill-switch / restore for the WiFi Pineapple Pager.
          Uses ONLY official Hak5 commands (WIFI_*, PINEAPPLE_*).

--off silences everything the Pager is actively broadcasting/associating
with: Management AP, Open AP, WPA AP, and the WiFi client connection.
It records what was actually running (not blindly everything) so --on
brings back exactly what was on before, nothing more.

How restore works without a duplicate credential store: WIFI_*_AP_DISABLE
only flips the interface's "disabled" flag - it does NOT erase the
SSID/password already configured via WIFI_MGMT_AP / WIFI_OPEN_AP /
WIFI_WPA_AP / WIFI_CONNECT. So --on reads those values back with a
read-only `uci -q get` and re-issues the SAME official setter command
that was already used to configure them - nothing is invented here.

Recon channel hopping is paused/resumed unconditionally (harmless either
way per the Hak5 docs). PCAP capture, Wigle logging, and SSID pool
advertising are stopped on --off but deliberately NOT auto-resumed on
--on - those are data-capture actions that should be restarted
explicitly, not silently.

Usage:
  wifi.sh --off       Silence Mgmt/Open/WPA APs + WiFi client, pause recon hopping
  wifi.sh --on        Restore whatever was silenced by the last --off
  wifi.sh --status     Show current state
  wifi.sh               interactive menu

Options:
  -y, --yes    Don't prompt for confirmation
  -h, --help    This help

clientip.sh

Look up a connected client's IP address by MAC.

clientip.sh - Find the IP address of a client connected to a Pineapple
AP, by MAC. Wraps FIND_CLIENT_IP.

Usage:
  clientip.sh --mac AA:BB:CC:DD:EE:FF [--timeout SECONDS]
  clientip.sh                interactive mode

vpn.sh

Configure/enable/disable OpenVPN or WireGuard.

vpn.sh - Configure/enable/disable OpenVPN or Wireguard. Wraps
OPENVPN_CONFIGURE/_ENABLE/_DISABLE and WIREGUARD_CONFIGURE/_ENABLE/_DISABLE.
Syntax confirmed live via OPENVPN_CONFIGURE --help / WIREGUARD_CONFIGURE --help:
  OPENVPN_CONFIGURE disable
  OPENVPN_CONFIGURE enable [config file]
  WIREGUARD_CONFIGURE disable
  WIREGUARD_CONFIGURE enable [wg.conf]
  WIREGUARD_CONFIGURE enable [server-ip] [server-port] [server-pubkey] \
      [server-psk|NONE] [private-key|AUTO] [local-ip] [ipv4-nets|NONE] [ipv6-nets|NONE]

Usage:
  vpn.sh openvpn --enable [config-file]
  vpn.sh openvpn --disable
  vpn.sh wireguard --enable [wg.conf]
  vpn.sh wireguard --enable-full SERVER_IP SERVER_PORT SERVER_PUBKEY SERVER_PSK PRIVATE_KEY LOCAL_IP IPV4_NETS IPV6_NETS
  vpn.sh wireguard --disable
  vpn.sh --status         best-effort: is a VPN actually up right now
  vpn.sh                interactive mode

autossh.sh

Maintain a persistent outbound SSH tunnel (phone-home access).

autossh.sh - Maintain a persistent outbound SSH tunnel (e.g. phone-home
remote access). Wraps AUTOSSH_ENABLE/_DISABLE/_CLEAR, AUTOSSH_CONFIGURE,
AUTOSSH_ADD_PORT, and SSH_ADD_KNOWN_HOST.
Syntax confirmed live via AUTOSSH_CONFIGURE --help / AUTOSSH_ADD_PORT --help:
  AUTOSSH_CONFIGURE disable
  AUTOSSH_CONFIGURE enable [host] [port] [user] [remoteport] [localport]
  AUTOSSH_ADD_PORT local|remote [localport] [host] [remoteport]
  SSH_ADD_KNOWN_HOST [hostname] [keytype] [keydata]

Usage:
  autossh.sh --enable
  autossh.sh --disable
  autossh.sh --clear [-y]
  autossh.sh --setup HOST PORT USER REMOTEPORT LOCALPORT
  autossh.sh --add-port local|remote LOCALPORT HOST REMOTEPORT
  autossh.sh --known-host HOSTNAME KEYTYPE KEYDATA
  autossh.sh --status        best-effort: is a tunnel actually up right now
  autossh.sh                interactive mode