Wi-Fi Pineapple · Volume 1
Hak5 WiFi Pineapple Volume 1 — Overview, the Four Models, and the Decision Tree
What a 'pineapple' is, the current line-up, how to read this 21-volume series, and which model to reach for
Contents
1. About this volume — and this series
This is Volume 1 of a 21-volume engineer-grade deep dive into the Hak5 WiFi Pineapple — the longest-running product in this entire Hack Tools hub (Hak5 has shipped a Pineapple since 2008) and the one that most needs the volume count, because “the WiFi Pineapple” isn’t one device — it’s a product family with four current members built on a shared platform.
The series is structured in three phases:
- Foundation (Vols 1-8) — what a pineapple is and does, independent of which model: the history, the PineAP technique catalog, where it sits across hat-colors, the firmware foundation, the web UI + module ecosystem, the generic hardware architecture, and the legal/OPSEC posture. If you read nothing else, read these eight — they’re the conceptual spine.
- Per-model deep dives (Vols 9-15) — a dedicated cluster for each of the four current models: Mark VII, Mark VII + AC Tactical, Pager, Enterprise. Electronics → firmware → operating instructions → mods → use cases.
- Synthesis (Vols 16-21) — the model comparison and which-to-buy-first decision, the per-use-case setup playbooks (wardriving / pentest / attack-watching), the mods catalog, the tooling-integration picture, the operational-posture deep dive, and the laminate-ready cheatsheet.
Vol 1’s job is to make the family legible: what a pineapple is (§ 2), the four models side by side (§ 3-4), what they all share (§ 5), and the decision tree for which one to get first (§ 6) — the question tjscientist explicitly wants answered.
2. What a “WiFi Pineapple” actually is
Strip away the brand and the mystique, and a WiFi Pineapple is:
A purpose-built Linux device whose entire hardware + firmware design is optimized for one job — being a better-than-real Wi-Fi access point that clients want to connect to, while simultaneously watching, recording, and manipulating the 802.11 airspace around it.
It is not a general-purpose router that happens to do security tricks, and it is not an ESP32 board running attack firmware. It is a category of its own: hardware and firmware co-designed, since 2008, specifically for rogue-AP and Wi-Fi-audit work.
Three things define it:
-
The PineAP suite — the heart of the device (Vol 3 is the full catalog). PineAP is the “intelligent sniffing and injection engine” that exploits the 802.11 association protocol: it listens for the probe requests that every Wi-Fi client constantly broadcasts (“is HomeNetwork here? is Starbucks here?”), and it answers yes — becoming whatever network the client is looking for. Around that core sit recon, beacon broadcasting, SSID-pool harvesting, deauthentication, handshake capture, and client tracking.
-
A web-UI-driven operating model — you don’t write code to use a Pineapple. You drive it from a browser. It runs a highly modified OpenWrt (Vol 5) with a polished web interface, a module/app ecosystem (Vol 6), automated Campaigns that run a scripted audit and generate a report, and Hak5 Cloud C2 for remote command and control.
-
Role-based radios — a Pineapple has multiple Wi-Fi radios, each assigned a job: one for management (your connection to the device), one running PineAP (being the rogue AP), one or more for monitoring/recon/injection. That role separation is what lets it attack and observe at the same time — the thing a single-radio device fundamentally cannot do (Vol 7).
The WiFi Pineapple in one diagram
════════════════════════════════════════════════════════
Wi-Fi clients nearby The airspace
constantly probe: the Pineapple watches:
"is HomeWiFi here?" beacons, probes,
"is Airport_Free here?" ───┐ clients, handshakes
│ │
▼ ▼
┌───────────────────────────────────────┐
│ WiFi Pineapple │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │ radio: │ │ radio: │ │ radio: │ │
│ │ MGMT │ │ PineAP │ │ MONITOR │ │
│ │ (you) │ │ (rogue │ │ (recon, │ │
│ │ │ │ AP) │ │ inject)│ │
│ └─────────┘ └────┬────┘ └─────────┘ │
│ modified OpenWrt │ web UI · modules │
│ PineAP engine │ Campaigns · C2 │
└───────────────────┼───────────────────┘
│ "yes, I'm HomeWiFi"
▼
client associates to the Pineapple
→ its traffic now flows through you
3. The four current models at a glance
Hak5 currently sells four WiFi Pineapples. They are not a simple good/better/best ladder — they’re optimized for different deployment shapes.
| Model | The one-line | Optimized for | Form factor |
|---|---|---|---|
| Mark VII | The 7th-generation baseline — “the industry-standard WiFi pentest platform.” Single-core MIPS SoC, three role-based radios, 2.4 GHz native. | Learning the platform; standard engagements; the reference everything else is measured against. | Small puck, USB-C powered |
| Mark VII + AC Tactical | A Mark VII plus the MK7AC dual-band 802.11ac adapter, a tactical case, and a field-guide book. | The same engagements, but where 5 GHz matters — modern networks live on 5 GHz, and the bare Mark VII is 2.4 GHz native. | Mark VII + adapter, in a case |
| Pager | The pocket member — tri-band 2.4/5/6 GHz + Bluetooth/BTLE, an on-device 2.4” color display, a 2000 mAh battery, belt-clip portable. “PineAP engine 100× faster.” | Mobility — opportunistic, short-window, walk-around engagements where you can’t carry a laptop and a puck. | Pocket device with screen + battery |
| Enterprise | The rack-mount flagship — 4× ARM Cortex-A7, five dual-band MIMO radios, handles ~100 DHCP clients, AC-powered, metal enclosure. | Permanent installs, large client populations, agency/firm-scale work, multi-radio orchestration. | 1U-ish rack platform, AC mains |
The shorthand: Mark VII is the bench reference, +AC Tactical is the field kit, Pager is the pocket, Enterprise is the rack. Vol 16 is the full comparison; § 6 below is the fast decision tree.
4. Quick-facts panels — all four models
┌─ WiFi Pineapple Mark VII ──────────────────────────────────┐
│ SoC Single-core MIPS network SoC │
│ Radios 3 role-based · MT7601U + MT7610U │
│ 2.4 GHz 802.11 b/g/n native │
│ 5 GHz / 802.11ac via the MK7AC module │
│ Memory 256 MB RAM · 2 GB eMMC │
│ Ports USB-C (power + ethernet) · USB 2.0 host │
│ I/O 3 high-gain antennas · 1 RGB LED │
│ Power USB-C (bus / battery pack) │
│ OS Modified OpenWrt + PineAP │
└────────────────────────────────────────────────────────────┘
┌─ WiFi Pineapple Mark VII + AC Tactical ────────────────────┐
│ Base = Mark VII (panel above) │
│ Adds MK7AC WiFi adapter — MT7612U, dual-band │
│ 802.11ac, 866 Mbps, dedicated monitor+inject │
│ Adds Tactical case · field-guide book · decals │
│ Net effect Native 5 GHz audit capability + a field kit │
│ Price ~$235 (kit) │
└────────────────────────────────────────────────────────────┘
┌─ WiFi Pineapple Pager ─────────────────────────────────────┐
│ Radios Dual-radio array · tri-band 2.4 / 5 / 6 GHz │
│ Bluetooth 5.2 + BTLE 4.2 │
│ Memory 256 MB RAM · 4 GB eMMC │
│ Display 2.4" full-color, 480×222 · physical buttons │
│ I/O 4× RGB LED · buzzer · vibration · RTC │
│ Power 2000 mAh LiPo · USB-C charge · ~4 h runtime │
│ Ports USB 2.0 · integrated ethernet adapter │
│ Note "PineAP engine 100× faster than any other" │
│ OS Streamlined Pineapple firmware │
└────────────────────────────────────────────────────────────┘
┌─ WiFi Pineapple Enterprise ────────────────────────────────┐
│ CPU 717 MHz · 4× ARM Cortex-A7 quad-core │
│ Radios 5 dual-band MIMO: │
│ Radio0/1 Qualcomm IPQ4019 (2.4/5) 1.733 Gbps │
│ Radio2/3/4 MediaTek MT7612U (2.4/5) 866 Mbps │
│ 802.11ac Wave 2 · MU-MIMO · TxBF │
│ Memory 1 GB DDR3L RAM · 4 GB eMMC │
│ Ports 2× Gigabit Ethernet · USB-C 3.0 │
│ Power 100-240 V AC 50/60 Hz │
│ Enclosure Metal, rack-mountable │
│ Scale ~100 DHCP clients (vs Mark VII's 5-10) │
└────────────────────────────────────────────────────────────┘
All specs research-baseline (docs.hak5.org / shop.hak5.org), 2026-05.
Verify on acquisition — Hak5 iterates hardware revisions.5. What every Pineapple shares — the common platform
The four models differ in radios, CPU, form factor, and power — but they share a common platform, and that’s what the Foundation volumes (2-8) are about. A skill learned on one transfers to all four:
| Shared element | What it means | Volume |
|---|---|---|
| The PineAP suite | The same rogue-AP / KARMA / recon / capture engine on all four — the Pager’s is just faster, the Enterprise’s runs across more radios | Vol 3 |
| Modified OpenWrt | Every model runs Hak5’s heavily-customized OpenWrt build on purpose-built hardware | Vol 5 |
| The web UI | The same browser-driven operating model — dashboards, recon, PineAP config, Campaigns | Vol 6 |
| Modules / apps | The same extensibility model — install modules from the ecosystem to add capability | Vol 6 |
| Campaigns | Automated, scheduled audits that run a scripted workflow and emit a report | Vol 5 § 4 |
| Cloud C2 | The same remote command-and-control enrollment + management | Vol 5 § 5 |
| Role-based radios | All four assign radios to roles (management / PineAP / monitor) — the count differs, the model doesn’t | Vol 7 |
| The legal posture | Identical across all four — rogue-AP work is TX-active and intrusive | Vols 4, 8 |
The practical upshot for tjscientist’s “buy one of each” plan: the learning curve is paid once. Learn the Mark VII deeply, and the Pager and Enterprise are the same platform with more radios and a different chassis.
6. Decision tree — which model, and which one first
tjscientist plans to acquire one of each. The question Vol 1 answers: which first? Full analysis is Vol 16; here’s the tree.
Which WiFi Pineapple should I get FIRST?
│
┌────────────────┴─────────────────┐
│ Is this your first Pineapple — │
│ are you learning the platform? │
└────────────────┬─────────────────┘
│
┌─────────┴──────────┐
YES NO (you know Pineapples)
│ │
▼ ▼
┌──────────────┐ ┌─────────────────────────┐
│ Get the │ │ What's the dominant │
│ MARK VII │ │ deployment shape? │
│ (or the │ └────────────┬────────────┘
│ +AC kit — │ ┌───────┼────────┬──────────┐
│ see below) │ │ │ │ │
│ │ mobile permanent scoped max
│ It's the │ walk- install / field radio
│ baseline │ around large pop kit count
│ everything │ │ │ │ │
│ else is │ ▼ ▼ ▼ ▼
│ measured │ PAGER ENTERPRISE +AC ENTERPRISE
│ against; │ TACTICAL
│ skills │
│ transfer. │
└──────────────┘
The "first" recommendation for tjscientist (learning the platform,
wants 5 GHz which modern networks require):
→ Mark VII + AC Tactical kit.
Rationale: it IS the Mark VII (the baseline), so skills transfer to
every other model; the MK7AC adapter closes the 5 GHz gap that the
bare Mark VII has and that real-world networks demand; the tactical
case + field guide suit a learner. ~$235. Then add the Pager (pocket
mobility) and Enterprise (scale) as the use cases land. Full buy-order
analysis with the tradeoffs spelled out: Vol 16.This is the preliminary recommendation from the Foundation phase. Vol 16 revisits it with the full per-model deep dives in hand — but the logic (“buy the baseline first, with 5 GHz, because skills transfer and modern Wi-Fi needs 5 GHz”) is stable.
7. Where the Pineapple sits in tjscientist’s lineup
The Hack Tools hub already has Wi-Fi-capable gear. Where does a Pineapple fit?
| Tool | Overlap with the Pineapple | The Pineapple wins when… | The other tool wins when… |
|---|---|---|---|
| ESP32 Marauder Firmware (AWOK V3, Flipper devboard) | Both do Wi-Fi recon, deauth, evil portal | You need a real rogue AP that clients actually associate to + route through; multi-radio; Campaigns + reporting; Cloud C2 | Cheap, pocketable, “is there Wi-Fi activity here” + quick deauth/portal demos |
| Nyan Box / Ruckus Game Over | Both are multi-radio 2.4 GHz handhelds | Purpose-built rogue-AP engine; OpenWrt depth; the module ecosystem | Education UX (Nyan), swappable daughter cards (Ruckus) |
| HackRF One / PortaRF | None, really — different layer | You’re working at the 802.11 / association layer | You need raw RF / SDR / sub-GHz |
| AWOK ESP32 C5 / Banshee | 5 GHz Wi-Fi | The full Pineapple platform — rogue AP, recon, Campaigns, C2 | Just want a cheap 5 GHz ESP32 scanner |
The Pineapple’s niche: it is the purpose-built rogue-AP and Wi-Fi-audit platform — the thing that turns “I can see Wi-Fi traffic” into “clients are associating to me and their traffic is flowing through my device, and I have a web UI, a report, and remote C2 for it.” Nothing else in the lineup is built for that. The ESP32 tools touch the same techniques; the Pineapple is engineered around them.
8. The one-paragraph posture warning
The WiFi Pineapple is the most legally-consequential tool in this entire hub, and that has to be stated in Volume 1, not buried in Volume 8. PineAP’s core function — impersonating networks so that other people’s devices connect to you — is, in most jurisdictions, unauthorized access and interception unless you own the network and the clients, or you have explicit, written, scoped authorization. Operating a Pineapple’s PineAP / evil-twin / deauth functions against networks or devices you don’t own and aren’t authorized to test is a crime in the US (CFAA, Wiretap Act) and equivalently elsewhere. Recon (passive listening) is generally fine; the moment the Pineapple transmits — beacons, deauth, association responses — you are in regulated, authorization-required territory. Vol 4 draws the line in detail; Vol 8 is the full posture. Read both before the device transmits anything.
9. How to read this series — depth indices
If you want the concept → Vols 2-8 in order. That’s the “super deep dive on what a pineapple is” — history, techniques, hat-colors, firmware, web UI, hardware, posture.
If you want a specific model → its per-model cluster:
| Want… | Go to |
|---|---|
| Mark VII — electronics | Vol 9 |
| Mark VII — firmware / operation / mods / use cases | Vol 10 |
| Mark VII + AC Tactical — the AC adapter, the kit, 5 GHz operation | Vol 11 |
| Pager — electronics (display, BT, battery, tri-band) | Vol 12 |
| Pager — firmware / on-device operation / mods / use cases | Vol 13 |
| Enterprise — electronics (the 5-radio array, the rack platform) | Vol 14 |
| Enterprise — firmware / multi-radio operation / scale / mods | Vol 15 |
If you want the decision → Vol 16 (model comparison + which-first), Vol 17 (setup playbooks per use case).
If you want to operate one well → Vol 17 (playbooks), Vol 18 (mods), Vol 19 (tooling + Cloud C2), Vol 20 (field OPSEC), Vol 21 (cheatsheet).
Specific topics:
- The PineAP suite, component by component → Vol 3
- KARMA vs MANA vs PineAP — the technique history → Vol 2 § 4 + Vol 3
- OpenWrt internals, SSH, the firmware → Vol 5
- Modules — finding, installing, writing → Vol 6
- Radios, chipsets, role assignment → Vol 7
- Is this legal for what I want to do → Vol 4, then Vol 8
- Wardriving setup → Vol 17 § wardriving
- Watching for attacks (blue team) → Vol 4 § blue, Vol 17 § attack-watching
- Cloud C2 fleet operation → Vol 5 § 5, Vol 19
10. Status + research-baseline disclosure
As of 2026-05-14, the WiFi Pineapple is Aspirational in tjscientist’s lineup — not yet owned. The plan is to acquire one of each model.
What’s solid: the model line-up, the platform concept, the history, the PineAP technique catalog, the firmware/OS foundation — these are well-documented by Hak5 and the community and are reported here with confidence.
What’s research-baseline (verify on acquisition): exact hardware revisions, specific RAM/storage/radio part numbers (Hak5 iterates), current firmware version + feature set, the live module catalog, exact first-boot procedures, and anything depending on a bench measurement (runtime, range, thermal). Hak5 hardware revisions and firmware releases move; the per-model volumes (Phase 2) will be written/updated against the actual units.
FIGURE SLOT markers throughout the series flag photos to fill once hardware is in hand and the Photo Helper is engaged against shop.hak5.org / docs.hak5.org.
11. Resources
Hak5 — vendor + docs (the authoritative source)
- Hak5: https://hak5.org · Shop: https://shop.hak5.org · Docs: https://docs.hak5.org
- WiFi Pineapple product line: https://shop.hak5.org/products/wifi-pineapple
- Mark VII docs: https://docs.hak5.org/wifi-pineapple/
- Enterprise docs: https://docs.hak5.org/wifi-pineapple-enterprise/
- Pager docs: https://docs.hak5.org/wifi-pineapple-pager/
- Nano/Tetra (6th-gen, legacy) docs: https://docs.hak5.org/wifi-pineapple-6th-gen-nano-tetra/
- Hak5 Cloud C2: https://docs.hak5.org/cloud-c2
- Hak5 forums: https://forums.hak5.org
Foundational
- OpenWrt (the firmware base): https://openwrt.org
- ESP32 Marauder Firmware deep dive (shared Wi-Fi-attack mechanics):
Cross-tool
- Hack Tools comparison:
../../../_shared/comparison.md - Capability matrix:
../../../_shared/capability_matrix.html - Legal / ethics:
../../../_shared/legal_ethics.md
This is Volume 1 of a 21-volume series. Next: Vol 2 traces the history and lineage — from the 2008 KARMA-patched Fon access point in a novelty pineapple cup, through the Mark IV, Mark V, Nano, and Tetra, to today’s Mark VII / Pager / Enterprise line — and the technique evolution from KARMA through Dogma to the PineAP suite.