Search the Community

Hello! This firmware marks a massive release for the WiFi Pineapple Mark VII, with a huge set of feature additions, bug fixes and improvements to many aspects of the project and it's user experience. From reliability fixes in PineAP and Recon to the addition of the Package browser and a WPA/2 Evil AP or out of the box support for supported 802.11ac adapters, there is sure to be something in this version for you. As always, you can grab the update OTA by giving your WiFi Pineapple an internet connection and navigating to Settings -> Software Update in the Web UI. A huge thank you to the beta testers for this release who provided great feedback and bug reports, you are invaluable and much appreciated! To further join the discussion, feel free to join the Discord chat. You can catch the full changelog below, and highlights of the new firmware in the second reply to this topic. Changelog 1.1.1: General Update the Pineapple Python library. Setup Fix a UX issue where the Filter description doesn't show until a mode is selected. Recon Fix an issue where some partial handshake captures would not have enough data to be crackable. Settings Remove the Nightly Update channel. Changelog 1.1.0: General Add a setup walkthrough dialog when attaching an AC-capable USB radio to the WiFi Pineapple. Improve the displaying of dates from the future in some UI pages. Move warnings into an "Informational Messages" dialog. This new dialog adds more information about system messages, and provides convenient links directly to the relevant setting. Removed bluelog and other bluetooth related tools from firmware. Note: You can now install these packages and more with ease using the Package Manager. Swap PineAP and Recon location in sidebar. Enable SSH earlier in Setup process. Removed polling for Reset button. Add password reset functionality. Notifications Notifications are now previewed in the title bar. Notifications can now be reported as "success", with a green color. Changed to a better download icon. Decrease clutter in title bar for mobile displays. Fix an issue where some kernel modules would cause the device to reboot. Setup Add Sweden to WiFi Country Code list. Fix typo in Client Filters page. Added GIFs to indicate how to proceed with verification. Added the ability to fine-tune filters during setup. Generally improved layout of various setup elements. Dashboard Improved connection error message for "Get News". Campaigns Fix an issue where some reports will use the first Recon scan, instead of the latest. Fix an issue where reports would not be removable. PineAP Fix a crash. Fix an issue where extended Recon scans would lead to a memory leak. Add Sweden to WiFi Country Code list. Fix a hang introduced in the beta which would cause Recon and Filters to show an incorrect status. Change "WPA & Open" tab to "Access Points". Change "Authenticated AP" card title to "Evil WPA AP". Add "View Handshakes" button to Evil WPA AP card. Evil WPA AP handshakes now only send one notification per client. Fix an issue where empty SSIDs would be added to the SSID Pool. Add a new tab for Management and Open APs. Fix an issue where the "Handshakes Captured" counter wouldn't be accurate. Add Evil Twin WPA Access Point. Recon Add a dialog to clarify what a handshake capture does, when clicking "Start Handshake Capture". Fix an issue where handshakes in custom locations couldn't be downloaded. Scan settings are now loaded from the current scan across devices. Added the ability to specify save location for Recon scans. Added the ability to specify save location for Handshakes. Fix an issue introduced in Beta 1 where handshakes could not be deleted. Fixed an issue where the table would become unsorted during a scan. Added graphs for wireless landscape and channel distribution. Moved Settings into a new card, with search functionality. Added the ability to select which radio is used for Recon scanning. Supported devices are listed at docs.hak5.org Add dual-band scanning support for supported adapters. Add the ability to download handshakes in hashcat format. Improved the user experience for cloning access points. Cloning options can now be fine tuned from inside Recon. Add the ability to clone WPA/2 access points. Fixed an issue where BSSIDs would not be highlightable in some browsers. Fixed an issue where a handshake capture button might show for open APs. Massively improved scanning performance by rewriting result de-duplication logic. Massively improved WPA/2 Handshake capture performance. Changed how partial and full handshakes are written to disk. Fixed a rare crash when scanning in client-heavy landscapes. Handshake MAC addresses are now censored when censorship mode is enabled. Handshake MAC addresses now use colon seperators. Logging Improve default colours for log entries in dark theme. Improve column width for the System Log. Improve parsing of System Log. Added the ability to specify PineAP log save location. Added pagination and search functionality to the PineAP Log. Create a new system module for logging. Add ability to download and search the device system log. Modules Add hot-link support for Available Modules, Package Manager, and Develop tabs. Move search box into table footer. Add a new tab for package management. Add the ability to search and download a wide variety of packages. Improve user experience when the device is offline. Settings General Improve user experience when the device is offline. Added a scrollbar for longer changelogs such as this one. Networking Add a placeholder for when the Pineapple hasn't receieved a Client Mode IP address yet. Add signal strength to discovered Client Mode networks. Rewrote Client Mode handling to improve reliability of connection. Improved reliability of automatic route setting when handling USB Ethernet, ICS, or Client Mode connections. Disconnect button is now disabled after being clicked once. Thanks, foxtrot

Hello everyone! We're extremely excited to have announced the all-new Key Croc, and this update brings some improvements to the launch firmware as well as introducing support for the Hak5 Cloud C2. Change Log (1.2): General Fix non-ASCII logging Improved automatic VID/PID cloning Improved support for various ATTACKMODES Enable NTP Cloud C2 Add Support for the Hak5 Cloud C2 Misc Remove unneeded packages Improve LED status indication Update DuckyScript 2.0 lang files for US and GB Add fallback Arming Mode Framework now validates payload syntax at startup with LED feedback. Add INSTALL_EXTRAS script Add KEY_DEBUGGER script Add CHECK_PAYLOADS script Add RELOAD_PAYLOADS script You can download the firmware from the Hak5 Download Center. Instructions for updating your Key Croc can be found in the docs.

Forgive me for feeling suspicious but I trust no one, especially companies and governments. I'm new to Hak5 and I've read through a lot of the sight and I see a recurring theme. "Hosted on our server's" like it's a good thing. It may be I guess but the untrusting part of my brian (95%) is saying that seems strange. Why would they still want you tied to there server's year's after you obtained there products. Why can't you use these item's without the umbilical cord attached? Or did i miss something that says you don't need there server's to use your products? How do I know that your server's aren't collecting data from our target's for later use or putting clients at risk if your server's get compromised? Go ahead and call me paranoid but I'll be standing when many fall's.

Hi Guys I need help creating a payload on the Twin Duck rubber ducky that silently runs tree /a/ /f on the victims computer and then saves the output to the ducky. This is the code that I have so far: for /f %d in ('wmic volume get driveletter^, label ^| findstr "DUCKY"') do set myd=%d&echo tree /a /f > echotree.cmd&echotree.cmd > %myd%/results.txt&del echotree.cmd I would like to run it in the Run line. Please help me to optimise it!

Hello Hackers !!! I am new into infosec practically i was learning before but now into industry work so i am fed up of searching different methodology, tools, frameworks. I am stucked with something real life scenarios, there is wifi router which have 10 users. Me as admin of that router, how can i access these 10 users (PC, Andriod, etc) ? I tried wireshark, and many other stuff didnt get anything suitable? can i do this via adding a default welcome page to my router if some one connect will have to download something or something like this? a Newbie need help ;D

Hey Buddies a Newbie here, i watched https://www.youtube.com/watch?v=0UmJLLTr2gg i i have seen in video beside normal ducky there were micro ducky by having SD card. I didnt got any link to buy those any where? can anyone help here getting it ?

Why is Hak5 leaving the warehouse and where will you be going???

https://instagram.com/p/BatFZAIA8Pk/ Anyone know where I can find the Packet Squirrel and Ducky version?

hi guys i've a big proble, in the last weeks i won a usb rubber ducky during an hackathon but the replay buttons seems broken. When i press it the rubber ducky doesn't replay the script, what could be the problem?

I have purchased about 80% of your equipment, Pineapple Mark V, Nano tactical, bash bunny, pocket squirrel, lan turtle, usb rubber ducky, router, wifi dongles, etc. Unfortunately I purchased them separately as they came out. Therefore I don't have a custom Hak5 case to keep them in. I wish you would consider selling the cases separately. I would be your first customer to buy one. Love your products, and the show.

Dear Hak5, don't mean to anger anyone with this post... but im finding myself missing the good old Hak5 podcasts. The days when we had tutorials based around hacking tools , readily available . It seems the show is now based purely on Hak5's amazing products. An as great as they maybe, they aren't very affordable outside of the US e.g. Wifi Pineapple nano, being £125 , from European supplier. i appreciate, that Hak5 is a business and they have to eat. But would it not be possible to setup another channel to provide the tutorials for the products you sell and get back to the old format? I mean, how's the Hak5 van? Has it been turned into a hacking mobile command centre? Have you guys built any custom gear of late e.g. Password cracking rigs, photo framed pc and all that goodness. I've even noticed a decline in the discussions and help that is available on the forums. please, please, please bring back the show we all loved and admired.

I know this may be seen as a very pointless and stupid question. Does the Hak5 team provide a set of the icons they use for the various diagrams they publish? E.g https://www.hak5.org/wp-content/uploads/2017/10/openvpn_diagram1.png Although not essential it would be good to be able to produce diagrams while learning, using the same theme as used by Hak5. Must admit I really like the simplistic look of them.

Hello, I must be doing something totally wrong. When I try connecting to irc.hak5.org/6697 it takes me to the darkscience irc. I am using hexchat. What am I doing wrong?

xD I just hope its not to expensive

Hello everyone. Can you explain What a pineapple network is and why i would want to use 1?

Ayy Hak5 people I recently received my Elite kit I ordered, only to find out the kit was missing a bunny basher and it had an extra rubber ducky. I contacted them 3 days ago and they still havn't responded. I just wanted to ask how long it may take for them to respond? Will I have to send back the extra rubber ducky? Can I use my tools in the meantime, or should I wait until I get a response (If they do need me to send the items back, will they accept them if I have used them) Thanks!

So I tried doing everything that is mentioned in Hak5's episode 2101, but when it goes to execute the .ps1 file, there is an error in the cmd prompt which says: Specified cast is not valid. At line:2179 char:7 + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_D ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OperationStopped: (:) [], InvalidCastException + FullyQualifiedErrorId : System.InvalidCastException When I look at the .ps1 file through my web server, the error seems to be somewhere here: [IntPtr]$LoadAddr = [IntPtr]::Zero if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) { Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again" -WarningAction Continue [IntPtr]$LoadAddr = $OriginalImageBase }

I'm from Argentina, I'll be in NYC for a few days. I want to buy some stuff from Hak5 and I know I can get them delivered to my hotel, but I will be at a different hotel each day and I won't book it until I get there. Is there any other way I can buy the things I need and pick them up somewhere? Like a PO box, or something similar. Thank you.

Hello, In the recent episodes Darren showed how to use the USB rubber duck to exfiltrate specified files from a victims computer when they are logged in. I am wondering if there is any way of doing this when no one is logged in? and the computer is at the login screen. thanks!

This originally was meant as a private message to Darren but, understandably, it was denied. so... here it is haha Hey, have you heard of Discord? I'd like to ask if you've ever considered using Discord as an extension of the Forums. It'd not only help members establish common grounds but it'd also help build familiarity and quite possibly a larger platform to reach a larger crowd. It'd give members/visitors/viewers and guests a sense of familiarity and direction within the community. It could open the opportunity for the more active and knowledgeable members to even educate and help where they can. This is only a suggestion, I'd like to know what you think. It definitely would be pretty awesome to watch how this community expands. Who knows, maybe in the future it'd grow and express a need of its own for the awesome products you guys come out with... This is something I want to be a part of- that's it and I'll contribute any way I can. This is something I'm passionate about and I KNOW you guys are too - otherwise, you guys wouldn't have gone to great lengths to get to where you're at today. Other than that, is it weird if I actually wanted to get to know you guys?

I mostly see hak5 items for sale. Is it ok offer non-Hak5 items for sale in this section?

I Picked up an unused alfa 800mhz pen booster for something stupid like $4, but it didn't come with anything. Can any one give me the specs of the barrel DC to USB cord or a link to one? I'd hate to order one and end up being another cord to go in the junk cord milk crate.

Help, I made this keylogger software in which I want to make a Rubber Ducky Keylogger automatic. Is there anyway for me to make the duck run the keylogger or just simplycan anyone give a keylogger payload P.S. I don't want the script to download some files and stuff just plain run

Hello guys! I'm pretty new to pentesting, and I thought that purchasing a usb rubber ducky would be a great place to start. However, when I plugged it in to my windows computer, I found that it cannot run GUI and a few other commands in duckyscript. I'm so lost, and was wondering if I could get some help from some of the vets in this group. Thanks!

First i want to mention that I'm a Huge fan for years! So what i want to ask actually is that i have made my own web shop and trying to sell some Pentesting equipment and guides around it on how to use it, and how to do some basic pentests but since it's somehow hacker related i can not so easy to do on advertising. Cause i heard from a friend that google somehow ranks that kinda traffic lower than other good websites. Like the Hak5 webshop is almost like all the time on the top here (From Belgium) if I search google for hakshop the Hak5 webshop is on the first place and even if i search hackshop so with "CK" the Hak5 webshop is on the 3th place. But i dont have allot off money to put in advertising cause google ad's cost really way to much for me to invest in. So since i dont have money to put in advertising and made a guide on how to make your own USB Rubber Ducky using a normal USB Stick (BADUSB) my question is if that i can make a post about it on the Hak5 forum under the USB Rubber Ducky section? I really don't want to be cooperative against the Hakshop so now also another question is if it's okey for the Hak5 team that i made this post on my webshop and used the USB Rubber Ducky Encoder and the name in my title? Again huge fan off the show for years now so not offended if u tell me i cannot, but i thought that i maybe should ask it first So that i don't get in trouble. Thanks in Advance Develectron