Leaderboard

Evil Portals A collection of portals that can be loaded into the Evil Portal module and can be used to capture credentials. Usage and more; https://github.com/kbeflo/evilportals/ I'd be happy to hear about issues, and suggestions. Feel free to ask anything, contribute new templates, and improve the project.

Introducing Bash Bunny firmware v1.1 A feature packed firmware awaits Bash Bunny users just one month after release. We've excited to announce version 1.1, including many new features, conveniences, bug fixes and refined experiences. The newly improved LED command adds patterns in addition to variable blinks, as well as standardized payload states for common stages such as setup, attack, cleanup and finish. The Bash Bunny framework now includes support for extensions which augment the bunny scripting language with new commands and functions. Tools can now be installed with ease by copying .deb packages or entire directories to the dedicated /tools folder on the flash drive in arming mode. Updating ducky languages is now just a matter of copying json files to the dedicated /languages folder on the flash drive in arming mode. Many more features, fixes and experiences in the full changelog - so hop on over to BashBunny.com/downloads and nab version 1.1 today! (\_/)

Hi all -- big news we're super excited to share with you. If you've been following the recent 6th gen WiFi Pineapple developments you may have seen comments about 5 GHz. This has been on our road map for quite some time and man let me tell you it ain't easy. Then again, nothing worth doing ever is, right? Which is why we're excited to introduce our first ever dual-band device (2.4/5 GHz) -- the WiFi Pineapple TETRA! We're way ahead of schedule on the project and I want to give the forums community the first opportunity to get them in your hands because this ongoing project is made possible by you. Thank you! Ok - on with the good stuff! :) The WiFi Pineapple TETRA is the second device in the 6th generation line using the new software platform designed around usability and performance. So far the new modern interface has been very well received on the NANO and we expect the TETRA to continue taking the platform to the next level. Speaking of which, this is some serious next level hardware. The TETRA incorporates two Atheros dual-band (2.4/5 GHz) 2:2 MIMO radios capable of 802.11 a/b/g/n over a rock solid PCI Express bus directly connected to FOUR integrated skybridge amplifiers. With the included 5 dBi antennas we're right around 29 dBm EIRP -- which is huge. Range is incredible on this WiFi Pineapple. Under the hood it's a powerhouse. A 533 MHz RISC CPU from Atheros is running the WiFi Pineapple firmware - and it's not only 33% faster than the previous generation but it's based on the MIPS 74K instruction set. Adding to that we have 64 MB of high speed DDR2 32-bit memory and a fast SLC NAND controller with 2 GB of onboard storage -- so there's plenty of space. Ports are a plenty as we've gone with the classic Mark V style platform housing RJ45 Ethernet (eth0), 12V power, and USB 2.0 Host that'll support our new WiFi Pineapple Connector app on Android. Additionally we've incorporated some really convenient extras, like a built-in FTDI Serial UART over Micro USB -- so a console is never far! Next to that is an onboard Realtek USB Ethernet controller (eth1) over Micro USB so connecting directly to your laptop without Ethernet cables is a breeze! Furthermore, both the UART and ETH1 Micro USB ports can power the device over the included USB Y cables -- so most modern laptops can power it, as well as our Pineapple Juice 15000 battery included in the Tactical Edition of course :) This is a major milestone for the project and we can't wait to get them into your hands first. As you know developers are already working on the new 6th gen platform and this is one serious bit of kit that'll be taking advantage of all the new features. We invite you to get in on the ground floor with the TETRA from the HakShop at http://hakshop.com/products/wifi-pineapple-tetra

For all the people who are new at this whole “computer†thing and don’t really understand what hacking is all about and where to begin, I offer up these links to some great places to start learning. Please contribute to this thread and I will keep it up to date. Probably should be made sticky. News: www.digg.com www.slashdot.org Presentations: http://www.lessig.org/freeculture/free.html <-- A speech given talking all about the problems facing culture when dealing with copyright and other digital laws. Podcasts: http://www.grc.com/SecurityNow.htm <-- This is fantastic for people who are new to the field. If you have the time or motivation, go back and listen to them from day 1, they assume you know very little if anything and hit on all of the major topics in the security field. Fantastic show. IPTV Shows: http://www.binrev.com/ <-- Produce a good IPTV show and also have forums that are usually helpful. http://www.hak5.org <--- Duh.... Tutorial sites: http://www.remote-exploit.org <-- Pretty good resources, some very nice video tutorials on various exploits. Defiantly check out the tutorial section. http://www.irongeek.com/ <-- Excellent tutorials/information/articles. http://www.antionline.com/ <-- Tutorials, tools and forums full of helpful people. Programming Related: Teach Yourself C in 21 Days: http://neonatus.net/C/index.html Teach Yourself C++ in 21 Days: http://cma.zdnet.com/book/c++/ The Art of Assembly Language Programming: http://maven.smith.edu/~thiebaut/ArtOfAssembly/artofasm.html Microsoft Developers Network: http://msdn.microsoft.com ----Web Programming: HTML: http://www.w3schools.com PHP: http://www.php.net ASP.NET: http://www.asp.net/Default.aspx?tabindex=0&tabid=1 SQL: http://www.mysql.com Perl: http://www.perl.com/ Python: http://www.python.org Security Related: SecurityFocus: http://www.securityfocus.com/ Milw0rm: http://www.milw0rm.com SecurityForest: http://securityforest.com/wiki/index.php/Main_Page

Hey everyone, Recently I have seen a lot of questions in regards to installing tools on the Bash Bunny. This post will contain a list of .deb files published by Hak5. Please see our wiki for installation instructions. If you would like to suggest a tool to be published, please reply to this thread. All other posts will be removed. Impacket Responder Gohttp Metasploit-Framework (Requires firmware 1.6 or above). Disclaimer: Hak5 is not responsible for these tools. They are 3rd party packages and have not been checked for stability or security. Hak5 simply packages these tools for easy installation.

Lookit, anyone that's been around for awhile, even noobs, there have been ups and downs. Hak5 stuck with it, I just want to say Thank you guys, I hope this year is a New Dawn. Thank you developers so much...guys lets donate a bit to them, they give us the good stuff....WhistleMaster, Newbi3, Foxtrot, sud0nic, Datahead, mbuckyboy, Ingsoc, hfam, ExigentCircumstance, patriceking, phpsystem, barry99705, leg3nd....ect ect... Whatever you have used.... Forgive me devs if I missed you, I had to post on my phone

What would be a WiFi Pineapple firmware release without a code name vintage movie poster?

WiFi Pineapple - Themes Github: https://github.com/kbeflo/pineapple-themes Dark Theme Install: wget -qO- https://raw.githubusercontent.com/kbeflo/pineapple-themes/master/dark/install-dark.sh | bash Screenshots:

Hey all - just thought I'd share a great time I had with the NANO this weekend. My dear friends got married this weekend and I thought I'd have some fun, but not in the usual pineapple-y way. I wanted to wish them the best and congratulate them in my way - the hacker way. I loaded up the NANO with the Occupineapple module and created a list comprised of: Congrats Drew and Pete! Woohoo Pete and Drew! P&D 2016! Pete and Drew Tie the Knot! Pete and Drew Forever! etc, etc, etc I used a small usb battery, and fit it into my tux. People started arriving, and of course after the obligatory greetings and whatnot many of them pulled out there phones and were taking photos of themselves all dressed up. When they went to post to Facebook and Instagram, many of them noticed the new BSSIDs! Remarks such as "Whoa, whats this? Wow, cool!" and "Holy shit, Pete and Drew had a whole bunch of wifi things setup!" were overheard by my wife and I. Best of all, on the shuttle over to the reception, I cornered the couple and said "Hey guys, I think theres some wifi on the shuttle, that's pretty sweet". They both pulled out their phones and tried to connect, and upon seeing all the celebratory BSSIDs...ear to ear smiles. They both turned their heads to me, knowing I was somehow responsible, and we shared a great memorable moment. All because of the Pineapple. So big thanks to the hak5 crew and to Whistlemaster for the excellent module that added a bit more magic to the evening. You guys are the best telot

Hi @RazerBlade, I'm sorry you are not satisfied with the WiFi Pineapple. I haven't been able to spend a lot of time on the WiFi Pineapple lately, because I was focusing on other Hak5 products. That's why you haven't seen any firmware or system module updates. In terms of bugs, I am aware that some exist, but you should know that only a small subset of our users experience them, which make them hard to track down. Once I pick up the WiFi Pineapple again, I'm going to go over every Module (maybe one a week) and rid it of bugs and usability issues. I'll also be launching RCs to ensure that the shipped firmware upgrades are solid and "bug free(tm)". For now though, I'm truly sorry you are unhappy with the current state of the WiFi Pineapple. I hope that over the next few weeks and months we can remedy this.

Hey Everyone, Just three and a half weeks from dev launch, the WiFi Pineapple NANO is getting its first full firmware update. We're excited to bring you a number of bug fixes and features. In the coming days modules will begin to become available over the air through the Module Manager. Similarly the package repository is now online. Our next focus will be on API documentation. Thank you all for the continued support and feedback! Once again please submit any bugs found to wifipineapple.com/bugs Changelog 1.0.6: Wireless Update WiFi drivers from upstream Fixed an issue where the mac80211 driver would crash Fixed an issue where access to the WPA2 management network was lost Fixed an issue where adding a third radio caused the SD card to reset Recon Mode Added UTF-8 support Fixed an issue with channels not showing correctly Added more verbose security types Improved the scan reliability Logging Fixed MAC and SSID filters being case-sensitive Automatically apply filters when refreshing the PineAP log Misc Fixed tracking MAC being case-sensitive Fixed PineAP filters being case-sensitive Added nginx SSL module Fixed varius utf-8 issues Updated all system modules to their latest versions Ensure applications installed to the SD card can reference /etc/ correctly Ensure the correct PATH variables are set for the SD card Changelog 1.0.5: Fixed an issue with packages not downloading correctly Changelog 1.0.4: Added the ability to download the PineAP SSID Pool and Log Improved the stability of WiFi Client mode Improved various API components Changelog 1.0.3: Fixed an issue with Module Manager not upgrading system modules Fixed a couple of issues with the PineAP Pool Changelog 1.0.2: PineAP Improved the PineAP configuration view. PineAP Daemon is now a toggle which should clear up some issues and conclusions Fixed a bug where "Capture SSIDs to Pool" did not save for autostart Added a refresh button to the SSID Pool Added support for changing the PineAP log location Fixed jibberish SSIDs Networking Fixed an issue with a third external radio causing bootup and interface issues Fixed a bug where Android Tethering did not share the connection properly to clients Fixed an issue where scanning does not work when the radio is in monitor mode Added support for some ralink and realtek dongles Dashboard Clicking the number of connected clients / number of SSIDs in pool now opens up the appropriate module Fixed a bug where the "SSIDs added this session" counter would not increment Module Manager Module Manager has now been released Modules are going to be added over the course of this week API documentation for how to create custom Modules will be released shortly Fixed a bug where no SSIDs were show in the clients Module Fixed a bug where the SD card did not mount correctly Fixed a bug where no MAC dropdowns appeared next to some MACs in Recon Fixed a bug where the SSID filter would never change mode Misc Added and made public the Pineapple opkg (package) repository. Updated the old SSH ASCII banner The logout button is now a dropdown allowing for quick logging out, shutting down, or rebooting. API fixes We hope you enjoy this release! -The WiFi Pineapple Team

Hey guys we're super excited to introduce our 6th gen wireless network auditing tool! We're calling it the WiFi Pineapple NANO. We engineered it from the ground up based on the successes and feedback from the Mark V with a focus performance and usability. What we ended up with is something total new. It's not a simple client radio, or just a router or access point. We believe the WiFi Pineapple NANO is the most powerful wireless network auditing tool you can put in your pants. It leverages our unique hardware design and intuitive new web interface to integrate with your pentest workflow. There's a huge emphasis on workflow and usability with the WiFi Pineapple NANO. We completely re-engineered the web interface built on modern standards. It's fast, intuitive, responsive and familiar. For example new table views give you a detailed look of the WiFi landscape and context menus provide instant access to core PineAP features and modules. But it's not just the web interface either - the entire system was rebuilt on a modern base and compartmentalized in way that'll allow us to take the platform to the level. Of course modules (ya know, Infusions ) remain a core feature. Over the air downloads of community developed add-ons and web front-ends to popular tools remain. The new API is extremely simple for seasoned developers and newcomers alike. We also put together a really sweet Tactical kit. The case straps to your bag as an every-day-carry including a new Pineapple Juice battery pack. We even tailored the case with a nice Hak5 imprint liner and a cut out for the USB host port so you don't have to take it out of the case to plug in your phone. Oh yeah, it works with your phone now. The new WiFi Pineapple Android app simplifies USB Internet connection sharing. You just tap to tether and it instantly connects to the beautiful new mobile friendly web interface. No root required. https://play.google.com/store/apps/details?id=org.hak5.pineappleconnector You can also plug the NANO into your laptop and it'll both power on and enumerate as a USB Ethernet adapter so less cables and mess. And if you're doing a long term deployment, you can just plug the NANO into any standard USB power plug. Getting out-of-band access is even easier seeing as it supports the new gen of QMI-based modems. Here'a an intro video Seb and I made: So it should be no surprise that we had been working very hard to bring the new device for our little WiFi Pineapple ecosystem. What really surprised us though was the Mark V availability ending so soon. We were caught off guard post-DEFCON when our parts supplier notified us that the RTL8187 would no longer be available. We had developed a Mark V successor prototype using an alternative chipset, one that would allow for a somewhat inline change, but we found it came with a number of new complications that made the change unfeasible. At that time we had also anticipated the launch of our new WiFi Pineapple device to be much sooner. That being said, with as meticulous as we have been throughout the development, it's added considerable time to the process. Thankfully though our attention to detail has paid off as what we've developed is nothing short of amazing. We're so proud of the new device! Design decisions were made based on feedback from users and directly by observing the way in which the Mark V is being used, and it's clear we have a real winner. Unfortunately we underestimated the time in which certification takes to complete. For the last month and a half we've been anticipating the ability to launch for mass availability "in just another week or two". We have CE. We have FCC. We even have units in hand, awesome firmware, and a team raring to go. The latest development is that we're undergoing SAR testing, and sadly between labs being backed up and the new dongle requirement - we're looking at needing to wait just a while longer. The good news is that we're ready to launch for development and evaluation - meaning software developers like you here on the forums will now have early access to the new device. I want to give the core community that has been so good to us first dibs. Link at the bottom of the post. We'll be updating the other sites soon in anticipation of the official launch. Lastly, thank you for your patience and continued support for the project. I know it's not easy when we run into snags like this, especially while we're working tirelessly and quietly to bring something epic to the WiFi Pineapple community. And yes, we're rethinking that quietly part now. I'll keep you all updated with all of the latest as we take this next big step together and I'll try my best to answer any questions you have. Order the WiFi Pineapple Evaluation and Development Kit here: https://hakshop.myshopify.com/products/wifi-pineapple-nano-evaluation-and-development-kit Specifications: CPU: 400 MHz MIPS Atheros AR9331 SoC Memory: 16 MB ROM, 64 MB DDR2 RAM Disk: ROM + Micro SD Card Reader (card not included) Wireless: Atheros AR9331 + Atheros AR9271, both IEEE 802.11 b/g/n Ports: (2) RP-SMA Antenna, Ethernet over USB (ASIX AX88772A), USB 2.0 Host, Micro SD Power: USB 5V 1.5A. Includes USB Y-Cable Configurable Status Indicator LED, Configurable Reset Button FCC NOTICE: This kit is designed to allow: (1) Product developers to evaluate electronic components, circuitry, or software associated with the kit to determine whether to incorporate such items in a finished product and (2) Software developers to write software applications for use with the end product. This kit is not a finished product and when assembled may not be resold or otherwise marketed unless all required FCC equipment authorizations are first obtained. Operation is subject to the condition that this product not cause harmful interference to licensed radio stations and that this product accept harmful interference. Unless the assembled kit is designed to operate under part 15, part 18 or part 95 of this chapter, the operator of the kit must operate under the authority of an FCC license holder or must secure an experimental authorization under part 5 of this chapter. For evaluation only; not FCC approved for resale.

To all those that are whining about "customer service" and/or the "we want value for money" boys; you're not only giving your money for the hardware, you're also supporting innovation. You're supporting a good cause, see it as a way you can make Unicef keep doing what they do. But without the CEO that fills his pockets with $1000000 a year. Besides that, they have given us more updates for the hardware then Linksys, Netgear and Belkin did combined for all of their stuff in the past year... And not only you get the best piece of hardware you yourself never could come up with, they also are giving you a weekly dose of technolust, and everything that surrounds that. Have you ever seen a company that gave you as much bang for buck than these bunch? No you haven't. It's absurd how much heart they put into their product, it is pure love and dedication. You can't even compare it to another company, these are the people we need more of in the world, make sure they can keep doing what they do.

Hi everyone, In an effort to lower the barrier to entry of writing Ducky Scripts even more, our newest addition to the development team @dallaswinger has created a totally self-contained HTML file which acts as a Ducky Script encoder. In addition to supporting all currently available commands the original Java based Duckencoder, this new version also supports different keyboard layouts in the form of the Bash Bunny language files. We will be adding more features to this encoder soon, and are especially looking forward to your feedback. Please leave all suggestions or bug reports in this thread. The jsencoder.html file can be found attached to this post and should be considered to be in beta. If it drinks your coffee, eats your pets, or starts an intergalactic war, please blame @dallaswinger. Note: You currently need an internet connection to load the bootstrap CSS and jQuery JS files. As this is not the final release, we have forgone including them inside of the HTML. Grab the download from the Hak5 Download Center.

I'll be demoing this on next weeks Hak5 episode but figured I'd post it here first and get some feedback. Thus far it works perfectly on a Galaxy Nexus running the latest Android 4.2.1. I've also tested it with a Galaxy Note 2 running 4.2.1 and it ran as expected. I'm very surprised that with the stock Android OS and recommended settings of setting a PIN code this was possible. I had expected the phone to reset or format after 100 attempts or something like that. With a 4 digit PIN and the default of 5 tries followed by a 30 second timeout you're looking at a best case scenario of exhausting the key space in about 16.6 hours. Not bad all things considered. If you're the NSA or the Mafia that's totally reasonable, I'd say. Thankfully the USB Rubber Ducky never gets tired, bored or has to pee. Rather than post the nearly 600K duckyscript I'll just post the bit of bash I used to create it. You could modify it to do 5 digit, but that would take 166 hours. 10 digit would take 1902.2 years. ;-) echo DELAY 5000 > android_brute-force_0000-9999.txt; echo {0000..9999} | xargs -n 1 echo STRING | sed '0~5 s/$/\nWAIT/g' | sed '0~1 s/$/\nDELAY 1000\nENTER\nENTER/g' | sed 's/WAIT/DELAY 5000\nENTER\nDELAY 5000\nENTER\nDELAY 5000\nENTER\nDELAY 5000\nENTER/g' >> android_brute-force_0000-9999.txt [/CODE]

not sure what it is yet but just shut up and take my money!!!

dafuq are you talking about? If you have a problem with a module post the issue in its support thread and the developer will help you.

Hey everyone, We have recently discovered a bug in the update process of the Bash Bunny, which causes boot-loops. The bug is triggered if the upgrade file had been extracted, renamed, or was otherwise altered. Fortunately, we have now found a fix for the issue: Plug in the Bash Bunny and unplug it immediately when the initial green LED turns off Repeat step #1 three times Plug the Bash Bunny back in and wait for it to reset. You should see either a "police" pattern or a red blinking LED. Set the switch to the switch1 position (furthest from the USB port) Wait for the device to reboot (indicated by the green led) and set the switch to arming mode immediately as the green light turns off. If all went well, you should now be able to access the Mass Storage partition of the Bash Bunny (or serial in). Delete any leftover update files (such as "ch_fw_1.3_264 (1).tar.gz") Safely eject / sync the Bash Bunny Reboot your device, by re-plugging it, while keeping the switch in arming mode. This should get your Bash Bunny up-and-running on firmware v1.0, allowing you to properly upgrade to the latest version. We recommend using the Bash Bunny Updater for this. We have released firmware 1.4 which prevents this bug from being triggered. Note: These instructions are not the same as the one from this thread. Similar, but more reliable.

It really depends on what you're wanting to do. The Armory has some nice specs for a dev platform - so if you have a specific use case in mind and are keen on the programming, go for it. The Bash Bunny is a purpose built pentesting platform. We emphasize the convenience factor and really try to foster a healthy development community around the tools. It's a simple plan that's been working for us for nearly a decade as we've been making infosec tools. So - you could probably do some nifty attacks with the Armory, but there'll be more heavy lifting involved. As for the hardware differences - while Micro SD is nice for memory expansion, the fast SLC NAND memory in the Bash Bunny is one of the enabling factors for the quick boot -- which is very important for physical pentest engagements. The Bash Bunny has a 50% higher clock speed and 4x more cores. The other specs like RAM and dimensions are similar. At the end of the day it's really the software, community, and continued support you've come to know from Hak5 that makes the difference.

No we aren't... Some people read books then go out and sell their services as testers and let people down. That reflects badly on the industry and can get clients into trouble if they trust bad advice or rely on faulty results. Some people pose as testers to ask questions that they know if they asked offering their real intentions that they would be kicked off. Some people are just hobbyists. Someone who is a working pen tester would know how to scan a network to find user names and would know that you can't know what reach you have into a network without looking.

Hi This is a module that allows you to quickly generate a template for your GUI module. You can also manage the modules you have generated in the past. Module Maker creates a template for your module, with some comments to help you understand what each file does and how they work together. Images are available in the spoiler. -Foxtrot

ZaraByte - Thanks for providing detailed feedback on the WiFi Pineapple NANO. While it is unfortunate that your particular Android device does not support USB Tethering, I have yet to see any indication that your NANO is not working properly. Similar to the wp6.sh script, the WiFi Pineapple Connector app is provided free of charge as a convenient way to tether the device. The former is a front-end to iptables, and the later is a front-end to figuring out the IP address of the WiFi Pineapple on your Android device when USB Tethered. Given the nearly infinite unix network configurations and nearly 20,000 unique Android devices, we cannot possibly warrant or support each. Not all Android devices support USB Tethering, and we are not in control of that situation. Simply put, the issue is far outside the scope of this project. That said, we're here on the community forums to be as helpful as possible. There is no one way to use the WiFi Pineapple, and creative solutions are presented all the time. As xrad pointed out, iMcPwn's tutorial on Easy Tether for Android may be helpful. https://forums.hak5.org/index.php?/topic/37101-questions-about-usb-tethering/page-2#entry270022 Similarly the WiFi Pineapple may be tethered over its built-in USB Ethernet controller in Windows, Linux, OSX, Android, or via WiFi to an access point or portable hot-spot. The requirements listed on the box state "Computer, Smartphone or Tablet" as well as "Internet Connection for Setup". In a previous video you demonstrated the new interface, so obviously you have completed setup successfully. I also see a Windows computer in your video, so might I recommend the following Hak5 video on Internet Connection Sharing with Windows: The WiFi Pineapple NANO is in a development and evaluation phase while we finalize certification -- and we're providing early access to developers and evaluators to gather feedback, make bug fixes, refine features and develop modules. Based on your shown expertise, I am confident that you will be able to use your NANO rather than relegating it to the "gadget box". Regarding the USB Rubber Ducky - it has always shipped with the same factory firmware -- so there's no way your friends device was a paperweight due to an out dated firmware. We do support flashing community firmware versions through the DFU bootloader, but those aren't made by us. Saying "Typical Hak5 sell you stuff that doesn't work correctly half the time" is absolutely bogus. Everyone here is trying to be as helpful as possible, and while we value your input, a little less hostility would be appreciated. We stand by our products and I reject any statement to the contrary. If you're not satisfied with the NANO, I'm happy to take it back.

I'm planning on doing some videos covering the core functionality. For right now I highly recommend checking out the Help section in the new interface. I know it sorta sounds like I'm saying RTFM, but as the author of TFM -- I tend to think it's pretty good

DuckyScript 3.0 for the new USB Rubber Ducky can be encoded in Payload Studio — both Community and Pro editions — right in your browser. The compiler and all payload editing is done client-side, locally. We never see your work. You can download an offline copy of the IDE from your browser. Keep in mind that the offline version you download will be frozen in time, whereas the online version will be continuously updated as we add features and fixes over time. You can see the version number in the bottom left corner of the page.

Hi! We're pleased to announce a new release for the WiFi Pineapple NANO: 2.7.0. This update addresses some of the bugs reported by the great community here on the forums and in the Hak5 Discord, as well as updates to some community packages and updates to OpenWRT. 2.7.0 Changelog: General OpenWRT version is now 19.07.2. Kernel has been updated from 4.14.133 to 4.14.171. Fixed an issue where OpenVPN would cause a kernel panic upon establishing tunnel. Recon Fixed an issue where live scans would fail on the WiFi Pineapple TETRA. Reporting Fixed an issue where emails would not be sent. Improved the user experience by automatically saving email settings when testing emails. Improved the user experience by forcing an email to send when testing, regardless of whether the "Send Email" option was checked. Advanced Fixed an issue where swap would not be mounted automatically on the NANO's SD Card. Renamed "USB" panel to "USB & Storage". Misc Added SSLSplit package to repositories. This fixes the SSLSplit module dependencies. Updated Kismet package in repositories. Updated Kismet-RemoteCap package in repositories. You can update your WiFi Pineapple NANO Over-The-Air via the Advanced module or manually at the Hak5 Download Center. ♥ - The Hak5 Development Team

Hey everyone, It's that time of year again and as you might imagine were very excited for DEF CON. We've been busy working on new features for Buffalo Bulldozer and amidst development we've generated a mostly feature complete (sans DIP switches) and stable port of the 6th generation WiFi Pineapple firmware for the Mark V. Flashing to and from this beta release will require a manual sysupgrade from the console (see commands below). Thank you all for your patience and continued support of the project - we're excited as always to see ever more creativity among the community. We hope you enjoy this release! -The WiFi Pineapple Team Download: https://www.wifipineapple.com/downloads/mk5/3.0.0 SHA256: 45bd51c665e0587ee137fa3ea87c03493b170f9668079ed0cecd4558c266a5ca Flashing: Download the upgrade-3.0.0.bin file linked above Verify the sha256 checksum SCP the downloaded .bin file to your pineapple's /tmp/ directory. SSH in to the WiFi Pineapple and execute the following command: sysupgrade -n /tmp/upgrade-3.0.0.bin Wait for the system to reboot and browse to http://172.16.42.1:1471

Hi! We're pleased to announce a new release for the WiFi Pineapple TETRA: 2.7.0. This update addresses some of the bugs reported by the great community here on the forums and in the Hak5 Discord, as well as updates to some community packages and updates to OpenWRT. 2.7.0 Changelog: General OpenWRT version is now 19.07.2. Kernel has been updated from 4.14.133 to 4.14.171. Fixed an issue where OpenVPN would cause a kernel panic upon establishing tunnel. Recon Fixed an issue where live scans would fail on the WiFi Pineapple TETRA. Reporting Fixed an issue where emails would not be sent. Improved the user experience by automatically saving email settings when testing emails. Improved the user experience by forcing an email to send when testing, regardless of whether the "Send Email" option was checked. Advanced Fixed an issue where swap would not be mounted automatically on the NANO's SD Card. Renamed "USB" panel to "USB & Storage". Misc Added SSLSplit package to repositories. This fixes the SSLSplit module dependencies. Updated Kismet package in repositories. Updated Kismet-RemoteCap package in repositories. You can update your WiFi Pineapple TETRA Over-The-Air via the Advanced module or manually at the Hak5 Download Center. ♥ - The Hak5 Development Team

Hi all. I'm just now becoming aware of multiple related situations identified in this thread. I sympathize as no one should be waiting this long on their orders, and I offer my sincerest apologies. Looking deeper into the various issues it seems that most are related to a hazmat shipping situation that has prevented us from selling batteries outside of very limited circumstances (domestic ground shipments only). Unfortunately our logistics provider has been extremely slow to respond in rectifying the situation. For example, some international shipments sent by DHL had been shipped back then repackaged via FedEx. It's extremely frustrating to have high value orders containing multiple units get to the border and be delayed by days if not weeks and incur immense shipping expenses due to one unit. We have since removed all batteries from kits until a better logistics solution can be found. We are also investigating alternative logistics providers to alleviate these response delays. I'm terribly saddened that our plan to use a professional logistics outfit for fulfillment of orders at higher speeds than possible by the small team that is Hak5 has resulted in the exact opposite in these edge cases. It's absolutely unacceptable and I share in your frustration. Furthermore, our support systems have not been adequate to deal with these logistics challenges in a timely manner, and for that I offer my sincere apologies. We are back from defcon, we hear you, and while half of us are hard at work on the next big thing - the rest of the team is dedicated to digging into to each and every support ticket to ensure that you receive exactly what you are due. You will have resolution by the end of the week.

Heh, made you look! ??????

Ignoring the sarcasm, imagine unstable extroot on "unstable" sd cards..

Here are a few more pics. Currently working on a more compact enclosure, roughly a third smaller. Some improvements with the smaller enclosure will be custom USB cables, possibly removal of the cooling fan (testing if it is actually needed), and as mentioned before a built in battery pack. The current setup was mainly done for testing but seems to be very functional. The only piece not seen in the pictures is the GPS unit which is mounted to the lid of the enclosure. Any suggestions for improvements or general thoughts on the build would be appreciated!

Yup, that's it. I have it working but it's a bit slow. There are some tricks to speed it up though, so once I finish that, I'll push out a new firmware.

First! :)

I am working on a new payload that will act as a web gui for standard BashBunny functions. The idea is that you keep this payload in one switch folder, and run it from a non-target. The BB will spin up a php server, and serve a local website at http://172.16.64.1 With the gui up, you can execute daisy chained shell commands in the 'console', or quickly swap out payloads found in the git repo, to the other switch folder. The repository url can easily be swapped out for your own fork, so you can quickly pull down changes, and make debugging payloads easier. Check out the repository and tell me what you think. To do (I might submit the pull request before these tasks are done, and make them a future enhancement): Write help page (or leave it as is) integrate existing terminal emulator in place of custom 'console' https://github.com/mathew-fleisch/bashbunny-payloads/tree/master/payloads/library/BrowserBunny

Hey Everyone, As is likely apparent from the name, Buffalo Bulldozer is a rock solid release with the intent of synchronizing a stable base for both WiFi Pineapples in the 6th generation - the NANO and TETRA. We've implemented some major improvements to the Recon mode of the PineAP engine, both increasing accuracy as well as stability. Recon scans now gather both AP and Client information by default using only one radio. This change decreases wlan0 overhead, allowing for faster association responses and uninterrupted communication with connected clients. WPS detection has also been added to Recon, further adding to the at-a-glance visibility of the wireless landscape. Information gathering is also enhanced from the Recon view with each client's probe requests visible from their respective menus, meaning you'll be able to immediately identify targets without having to page over to logs. TETRA users will appreciate the enhanced 5GHz support in both Recon and PineAP for both scans and deauthentication. Under the hood the kernel has been updated, upstream wireless fixes have been applied and packages have been updated. We feel you'll find this release rock solid throughout and we're eager to hear your feedback. Please as always use the bug tracker from https://www.wifipineapple.com/bugs This major release paves the way for an upcoming "CC" version and its accompanying cloud infrastructure. We're excited to share these developments as the project progresses. Once again thank you all for your support. This is truly the best time to be a WiFi Pineappler and we're grateful for this community!-- Seb & Darren Changes can be found at https://www.wifipineapple.com/downloads#tetra.

The Bash Bunny averages 1.5A idle - 2A at load - so it works well with either the TETRA or NANO.

Hopefully I have something people can try out in a couple of weeks :)

I keep different versions of the file depending on the use case. Many times I'm looking to grab unassociated clients in a particular area. For that purpose I have a file of just the top 100, public, free wifi points in the area. Throughout a week of capturing clients, the Nano will pick up more SSIDs during the course of doing business. At the end of the week the top 100 file gets reloaded to the /etc/pineapple/. I've found that once you reach a ridiculous number of SSIDs, it takes a longer time to capture a device if you get it to associate at all. Having a targeted list along with watching for SSIDs being beaconed by the client seems to work pretty well. Within the /etc/pineapple/ directory make yourself some copies of ssid_file. In my case it may look like this: cp ssid_file myTop100ssids cp ssid_file topssidsinKentucky cp ssid_file topssidsinCleveland Next, edit each one of these copies to your specifications. I use nano. nano myTop100ssids After editing press [Ctrl o] to save and [Ctrl x] to exit. To load up a file type for use. cp myTop100ssids ssid_file This will copy myTop100ssids and rename it ssid_file for use by the pineapple. Forgive me if this is something you were already aware of how to do but I thought it might help based on the question. Have a great day!

Whoa DigitalData, just chill.......this is a new release......if you don't even realize Darren and Sara are so awesome for checking the "first shipment". The manufacturer made a mistake....not hak5. You were offered a refund email, and wait till later when the problem has been fixed, for a month or so and get your order promptly. Apparently you chose to not get a refund. I'm not sure how long you have been around.....but....None of us "deserve a pineapple".... We are fortunate, there is a group of people like hak5 working on, producing and offering a product like..."the pineapple" at a very affordable price. Hey, from what I hear, they won't even let Seb get any sleep...(Send him some Red Bull or energy shots...Please)......We are also truly fortunate to have the Devs for sure they give us more good stufff......and last but not least all the people in this forum.....(I would advise you to read the "cluttered" post as call them in all the threads.....lots of wisdom in them, lots of nuggets, your going to learn a lot) Take a deep breath, especially before you post, trust me.....your going to be happy with your purchase, and the help you get on this forum......at least if you don't p**s everyone off. You are truly welcome here..and we are glad to see new people to add to the forums...so please don't take my post as an attack...... Its a new version of a unique product, stuff happens...... BTW......Thanks for the update Darren.... *This opinion has not been paid for or approved by hak5 or any of its affiliates.

Great news! They've left the port and I have tracking ^_^ I'll update as soon as it updates with an ETA. It shouldn't be long now! Thanks everyone so much for the patience!

Because i'm on your network...

I did the whole "pineapple in a birdhouse" method...though I didn't have the benefit of having Seb's C code (which he apparently lost! I forgive you Seb, because you're too beautiful to be mad at. But DK, if you have a copy laying around somewhere, please share!). Heres a long explainer, so indulge if you want. TL;DR version: I record the macs from beacon frames and know where two pineapples are. From there I can determine travel time and avg speed of vehicles. Some background if you care: I work in the ITS industry (Intelligent Transportation Systems - think of the big pole mounted cameras you see on the freeway and the red/yellow/green traffic data you see on google maps - a lot of that is from state-deployed permanent inductive loop sensors in the roads). I take ITS and bring it into road construction work zones. So we do travel times, queue warning systems, and traffic control performance monitoring for Departments of Transportation in order to make work zones safer for motorists and workers. One of the metrics agencies most often want to see is a mobility rating (trip reliability, Buffer Time Index, 95th percentile weighted by volume averages...in case theres any civil engineers in the audience). One way of establishing a historical record of travel times is to have a sensor that can detect some kind of RF unique identifier from a vehicle at a known (via GPS) location and another sensor down the road a mile or more that can detect the same unique ID. If you know the time a mac address passed sensor 1 and the time it passed sensor 2 and you know the distance (again, via GPS or mile post markers) you can determine the average speed and travel time. A bunch of companies track this stuff using bluetooth, but you can only get a unique identifier from devices in DISCOVER mode. Think old-ass blackberries and shitty Tom toms, etc. Those are very popular, but as a lifelong friend of the hacking community like myself, I've dug into their internals and they are all smoke and mirrors. WIFI detectors hit the scene a couple years ago (recording mac addresses from probe requests, basically what the Jasegar portion of the pineapple says "YES!" to) and they work a lot better due to so many more targets. Targets = you with your wifi left on on your smart phone driving by. This industry is quite a small niche, so its a very low-volume sales model. They sell their sensors for ~2-5K to make up for the low volume, even though its basically an atheros chip inside with some storage and a cell modem (~$180-250 actual cost of hardware). My company does the software side of things (reporting, data crunching, posting messages to portable message boards) so I frankly don't give two fucks about the plight of the low-volume/high margin hardware folks. I use my trusty markVs in little NEMA boxes with off the shelf cellular routers and a small solar/12V battery setup. I do a custom tcpdump to pcap on a sshfs to a VPS, then use Vivek's pcap to XML converter (which only runs on windows...WTF Vivek!?!) that I learned about from you Darren. My software pulls in the XML like we do so many other XML feeds and it goes to the database for number crunching. Easy mode. It's not a central "core" offering of my company, but it's a nice value add. And you'll be happy to know that I (unlike all the other vendors), salt and hash the mac addresses in memory before they hit disk or the net so your privacy is (at least somewhat) protected. I also only transmit it via ssh like I mentioned - others send them in plaintext over the web. I bet I could do better on this front and I sincerely would like to, but it was a 1 day hack to throw it all together. So yeah, I sure am sad the MarkV is EOL - because it was so ideal for this use case...but such is life. I have a lead on some old Alfa AP121U's (markIV hardware) I might use instead if another project calls for this type of data, we'll see. If you guys want specifics and code I'll provide it, because I love this community and all that I've learned from the pineapple with the help of all the regulars here on this forum. So please feel free to send me a PM if you want to know more. Cheers :) telot

The 5G solution has been in the works for quite some time and I think I speak for Seb and I when I say, man this stuff ain't easy. I guess if it were there'd be dual band APs littering the streets. Those gripes aside, I'm excited to say in the last few days some major milestones were made which'll bring the dual band WiFi Pineapples to us way ahead of schedule. Having boots on the ground at the factory saved a ton of time....timezones on the other hand aren't friendly to developers. Ask Seb if he remembers what sleep feels like Hardware wise we're at the stage where we're just waiting on the final stamp but everything has passed in testing (after some rigorous tuning). The RF on this thing is insane. It'll be a completely different animal from the NANO though. Form factor, cost, etc but we're building 'em both on the same base platform. Porting wise we're in the early alpha stages. Stuff builds, but we still have some ways to go. Think Return of the Jedi Death Star, not A New Hope... (Empire Strikes Back FTW) If all goes well we may have a very limited number of developer units (whatever fits in a suitcase) here before the new year.

Official answer: Use a MicroSD card — not a Micro SDHC, SDXC or SDUC card. That means 2 GB and under. Unofficial (I'm a hacker) answer: As long as the file system is FAT (FAT/VFAT or FAT32) as opposed to other common formats like exFAT, NTFS EXT4, etc — it should work, albeit with a potential performance hit*. *The larger the partition (and the more files/directories) the longer it will take to be read — both from the perspective of the USB Rubber Ducky itself (reading inject.bin, seed.bin or writing loot.bin) but also to the target, enumerating the USB "Flash Disk" when using the command ATTACKMODE STORAGE. As an example, I've formatted a 200 GB SanDisk Ultra MicroSDXC card with the FAT32 file system and loaded it with a very simple "Hello World" payload: ATTACKMODE HID STORAGE DELAY 1000 STRING Hello, World! And it injected the keystrokes within a second of attaching it to the target — however the target (a Windows 10 PC in this case) took over a minute to recognize the USB drive in Explorer.

You forgot NETMODE TRANSPARENT wget https://packetsquirrel.com BUTTON 1m && { echo "Discount unlocked!" LED FINISH } || { echo "Timeout dude!" LED FAIL }

wlan0 hosts the AP(s) while wlan1 does sniffing and injection. An optional wlan2 (USB Adapter) may be used for various purposes, such as Client Code / WiFi Tethering. wlan1 is on the vent/SD side of the NANO while wlan0 is on the opposite side. Total output power (EIRP) is calculated by adding txpower (dBm) and antenna gain (dBi). Replacing the stock antennas with your average 5 dBi dipoles will effectively double the output power. 9 dBi antennas, while ridiculous looking, will result in a 5x increase over stock. Just for fun here's a comparison:

Since you're bringing up a reference design I think it's worth pointing out here the immense work we've done in regards to integrating the four very high gain amplifiers onboard for the main SoC plus the PCIE second radio. It's no small feat and not something you'll find off the shelf. The RAM specs aren't of much consequence for what we're doing though it's a simple drop in replacement if we want to upgrade down the line. The focus was on making a rock solid long term platform and looking at our roadmap I think we've done just that.

Welcome to the community! You're at somewhat of an advantage starting on the 6th generation WiFi Pineapple platform in that it's a new modernized approach to the web interface with an emphasis on the workflow. I'm sure pineapple veterans here are re-learning the layout. The timing wasn't great with the holidays for release, hence not having all of the documentation in order. We're focused now on small update of bug fixes and little features along with developer documentation. Seb and I will be hosting a hangout shortly. I haven't nailed down the exact date with him, but I'm gunning for this coming week. In the mean time I shot a quick WiFi Pineapple Primer video that'll introduce the fundamentals of the PineAP suite.

Seb and I are planning to do a developer hangout and publish the API documentation when we get back from the holiday :)

The NANO was developed with a focus on performance and usability with integration with existing wireless pentest workflows. The platform we've chosen, keeping with the Atheros, is due not only with our familiarity with the chipset for development but because of it's strengths on the networking side of things. It's a router chip built to handle the sorts of network loads we're accustom to putting it under and for that we're very happy with the performance. And this radio in particular is tuned so well, I think you're really going to notice the RF performance. We've learned a lot since the MK5 and applied that knowledge not only to the NANO but it's the same reason we're working on a 5G capable device using similar technology. Integration wise we've already come out with an Android app that simplifies connection and setup to the extreme. Seriously it's dead simple -- check the box and everything just works. We're also working with Nethunter developers to get the NANO integrating well with that platform, which should be pretty epic! Similarly a new connector for Linux is being built similar to wp5.sh but taking it to the next level. The new software is more than just the streamlined Web Interface (which looks awesome, BTW). It's about compartmentalizing functions and making it easy to administer so that down the line applications can communicate and control the NANO through it's API. For example, the entire web interface and additional applications could be run on a completely separate device. Building on our strengths while integrating with the strengths of existing devices is one of the focuses with the NANO. Whether that's a tablet running nethunter, an unrooted Android, a Pi running Kali. We're never going to compete on price with the Zero - and that's ok. Eventually we'd like to have a sexy turnkey out-of-the-box ARM solution and for a while we've been developing what we call the "WiFi Pineapple Core" -- an ARM counterpart to the NANO. Essentially when plugged into the device it would act as the next node up on the network doing heavy lifting and even seamlessly controlling the device through the API. It's all very possible since the hardware was designed with a single USB plug for both power and network connectivity. That said, in our experience talking with ODMs on ARM we've found it extremely expensive and time consuming, at least at our scale. That's not to say we're not keen on the Core - but we think focusing on working with what's out there now before rolling our own is the better bet. Once we have more of the software done I'd love to see our own distro or tighter connector tools for these platforms. The above photo is only a proof of concept -- but it works.