repository·master·Indexed 19 days ago
https://github.com/hak5/pineapple-modulesA collection of community-developed modules and Python-based helper libraries for the WiFi Pineapple Mark 7. This repository provides security auditing and testing capabilities, including the Cabinet module for filesystem management, the DenyIP module for managing IPv4/IPv6 blocklists via ipset and iptables, and the DNSspoof module for DNS allocation and mapping.
For technical guidance on how to build and develop modules for the Mark 7, refer to the official developer documentation. This includes an introductory guide to the module system.
The Evil Portal module maintains several state objects that reflect the current configuration of the hardware and the module:
Tracks the operational status of the module:
running: Whether the Evil Portal service is active.webserver: Whether the webserver is running.autoStart: Whether the module is configured to start on boot.There are two primary lists for managing client access:
/tmp/EVILPORTAL_CLIENTS.txt file. These are clients permitted to interact with the portal./pineapple/ui/modules/evilportal/assets/permanentclients.txt file. These are persistent clients.Both lists support adding or removing clients via the update_client_list API action.
MDK4 supports several attack modes, each with a specific set of command-line flags. The attackMode key uses single-character identifiers. When constructing a command, the system combines the base mdk4 command with the selected interface, mode, and specific attack options.
a: Authentication Denial Of Serviceb: Beacon Floodingd: Deauthentication and Disassociatione: EAPOL Start and Logoff Packet Injectionm: Michael Countermeasures Exploitationp: SSID Probing and Bruteforcings: Attacks for IEEE 802.11s mesh networksw: WIDS Confusionf: Packet FuzzerThe Evil Portal uses a targeted skeleton (index.php) to serve different captive portal pages to clients based on specific criteria defined in a .ep JSON configuration file.
When a client connects, the system maps their metadata (MAC address, SSID, Hostname, or User Agent) against a set of rules. The routing logic follows these steps:
getClientMac, getClientSSID, getClientHostName, and the HTTP_USER_AGENT server variable.rule_order defined in the {portalName}.ep file.exact matches or regex matches:exact: Checks if the client's data exists as a key in the rule's value array.regex: Iterates through regular expression patterns and returns the destination if a match is found.default key of the JSON configuration.The DenyIP module allows you to manage blocked IP addresses. You can add specific IPs or user types to a deny list, clear the entire list, or retrieve the current list of IPv4 and IPv6 addresses being managed.
/* Example: Adding an IP via the API */
// To add an IP, use the 'add' action with the following parameters:
// user_ip: The IP address to block
// user_type: The category or type of user/IP
// API Call Example:
// API.request({ module: 'DenyIP', action: 'add', user_ip: '192.168.1.1', user_type: 'client' }, callback);To allow users to authorize through the portal and redirect them to their original destination, include a POST form that targets /captiveportal/index.php.
The form must include a hidden input field named target containing the destination URL. The destination URL is typically constructed using the current protocol, host, and request URI to ensure the user returns to where they were before being intercepted.
<form method="POST" action="/captiveportal/index.php">
<input type="hidden" name="target" value="<?php echo $destination; ?>">
<button type="submit">Authorize</button>
</form>To execute an MDK4 attack, you must provide the command string, the input interface, and the output interface. The system tracks the job via a job_id and monitors an output_file for real-time logs.
Send a request to the start action. You must include:
command: The full mdk4 command string including all flags.input_iface: The interface used for input.output_iface: The interface used for output.Send a request to the stop action to terminate the currently running MDK4 process.
poll_job action using the job_id to check for completion.load_output action with the output_file path to retrieve the current log content./root/.mdk4/[output_file]. Use the APIDownload method to retrieve them locally as mdk4-[output_file].log.MDK4 requires specific system dependencies to function. You can check the current status and install missing dependencies via the API.
Calls check_dependencies to see if the environment is ready.
Calls manage_dependencies with install: true. This initiates a background job (opkg) to install the required packages. The system monitors this job and will notify you once installation is complete or if an error occurs.
The Evil Portal module requires specific dependencies to function. You can check their status and manage installation through the API.
check_dependencies action. It returns whether dependencies are installed or if an installation is currently in progress (installing).manage_dependencies action with { "install": true }. This initiates a background job.job_id. Use the poll_job action with that job_id to monitor progress until is_complete is true.