Your Raspberry Pi replaces the WiFi Pineapple

Part two: from review to build

In the WiFi Pineapple Pager review we reached an uncomfortable conclusion for a ~300 € gadget: almost everything it does —recon, Evil Twin, handshake capture, captive portal— is just software running on Linux. So in this second part we drop the theory and build it ourselves: a Raspberry Pi that does the same —and more on several fronts— for a third of the price.

What we're going to do, and why

What: turn a Raspberry Pi + a WiFi adapter with injection + a power bank into a portable rig equivalent to the Pager, with the same wireless arsenal.

Why: because underneath it's Linux and runs the exact same tools (aircrack-ng, bettercap, hostapd, hcxdumptool…). In fact, almost every serious Pager payload is bash or python: you copy it over and it runs the same on the Pi. And because, with full control of the system, you can extend it without limits and crack passwords locally without relying on the cloud.

Recap: Pi vs Pineapple Pager

We broke it down capability by capability in the review; here's the summary before we start:

That said, let's be honest about what the Pager does better and is hard to match on a budget: built-in Bluetooth/BLE (no adapters), 6 GHz and the plug-and-play swarm of multiple Pagers. If your work lives on BLE, the Pager has its place. For everything else, the Pi wins on flexibility and price.

What you need (hardware)

• Raspberry Pi 4 (4 GB) or Pi 5 (8 GB, ideal) — the brain. A single image works for both.
• USB WiFi adapter with monitor mode + injection — the key piece. Recommended: the Alfa AWUS036ACH (RTL8812AU); a low-power alternative that plugs straight in without a hub: AWUS036NHA / AR9271 (driver already in the kernel). Avoid the WN722N v2/v3 (won't inject without patches).
• Powered USB hub — essential with the AWUS036ACH (see the warning below).
• USB microSD reader — to flash from a laptop that has no SD slot.
• USB-C PD power bank — makes it portable like the Pager. 5 V/3 A for the Pi 4, 5 V/5 A for the Pi 5.
• microSD of at least 32 GB (class A1/A2); 64 GB is better for tools, wordlists and captures.
• Optional: a 3.5"/5" touchscreen and a case with a fan (the Pi 5 will thank you).

The arsenal

This is what replicates the Pineapple. It all installs in one command with the step 3 script, but so you know what we're talking about:

• hostapd + dnsmasq → Evil Twin / Rogue AP (this is PineAP).
• aircrack-ng → handshake capture and cracking.
• wifite → automated WPA/WPS attacks.
• bettercap → MITM, recon and caplets (captive portal).
• kismet → network and client detector/sniffer.
• hcxdumptool → clientless PMKID capture.
• mdk4 → deauth, beacon flood, stress.
• reaver / bully → WPS attack.

And here's where the Pi pulls ahead, with what the Pager doesn't include: eaphammer (WPA-Enterprise Evil Twin), airgeddon (all-in-one suite), wifiphisher (captive portal/phishing), Wireshark with a graphical desktop and the rockyou wordlist for cracking locally without relying on the cloud.

Step 1 · Prepare and flash the Pi

The first script does all the dirty work: it downloads the image (Kali ARM by default), verifies the SHA-256, decompresses it, bakes in the auto-connect (so the Pi joins your WiFi on its own with key-based SSH), auto-detects the microSD and writes it with double confirmation. It even auto-detects your WiFi and recovers the password from the laptop, so for most fields you just hit Enter.

chmod +x 1-instalar.sh
./1-instalar.sh

The script elevates to sudo internally when it needs to (mounting the image and writing). Before the dd it asks for two confirmations: type the disk number from the list, then type CONFIRMAR in uppercase. When it finishes, it re-reads the card and compares the SHA-256 against the image: if they don't match, it aborts warning that the microSD is damaged (this catches the brownout-corrupted card before you lose an hour).

Step 2 · Hunt down the Pi on your network

The Pi boots, joins your WiFi on its own and announces itself over mDNS. The second script hunts it down from the laptop without you knowing its IP:

./2-cazar.sh                 # find the Pi and open an SSH session
./2-cazar.sh --run remote    # find it and run a block directly

It first tries mDNS for ~1 minute; if your router filters multicast between clients (very common), it falls back to a network sweep prioritizing Raspberry Pi MACs (arp-scan/nmap) and trying the SSH key. You need avahi-utils and the daemon running on the laptop:

sudo apt install -y avahi-utils
sudo systemctl start avahi-daemon

Step 3 · Set up the arsenal

Once you have a session on the Pi, the third script installs and configures everything in blocks. It always runs with sudo:

sudo ./pineapple-killer.sh            # interactive menu
sudo ./pineapple-killer.sh all        # all blocks in sequence
sudo ./pineapple-killer.sh wifi-tools # just one block

Step 4 · Remote control from 20 km away (optional)

Here the Pi does something the Pager only pulls off with an extra payload: controlling it from anywhere even when it's behind CGNAT, without opening ports. The remote block sets up Tailscale (WireGuard), hardens SSH and leaves an anti-lockout watchdog so you don't get locked out:

sudo ./pineapple-killer.sh remote
# unattended, with a Tailscale key:
TS_AUTHKEY=tskey-auth-xxxx sudo -E ./pineapple-killer.sh remote

From your phone (on mobile data): ssh kali@pi-pineapple, VNC at pi-pineapple:5901 or the portal at http://pi-pineapple:<puerto>.

Quick demos

Recon (tied with the Pager):

sudo airmon-ng start wlan1
sudo airodump-ng wlan1mon

Evil Twin / Rogue AP (= PineAP): the rogue-ap block leaves a start-ap.sh ready to go. Bring up the "FreeWiFi_Lab" network:

cd /opt/wifi-tools/rogue-ap
sudo ./start-ap.sh

Local cracking (this is where the Pi wins, no cloud needed):

sudo gunzip -k /usr/share/wordlists/rockyou.txt.gz
aircrack-ng -w /usr/share/wordlists/rockyou.txt captura-01.cap

If something breaks

• The Pi doesn't show up: almost always it's the router filtering mDNS between clients. Turn off "AP client isolation" on your lab network or let 2-cazar.sh run the sweep.
• Kali changes the hostname and password on first boot, and ships with SSH disabled. The step 1 baking already handles this (it applies them during firstboot).
• No country, no 5 GHz: the chip boots in the worldwide 00 domain and blocks a good chunk of 5 GHz. We bake in cfg80211.ieee80211_regdom=ES at boot.
• The Pi's internal WiFi is useless for monitor mode/injection: that's why the USB adapter is essential.
• Golden rule of dd: always target the disk (/dev/sdb), never a partition (/dev/sdb1). The script protects your system disk and demands double confirmation.

Useful links

• Kali ARM (image for Raspberry Pi 2/3/4/5 64-bit): kali.org/get-kali
• Raspberry Pi Imager: raspberrypi.com/software
• eaphammer: github.com/s0lst1c3/eaphammer
• airgeddon: github.com/v1s1t0r1sh3r3/airgeddon
• wifiphisher: github.com/wifiphisher/wifiphisher
• Tailscale: tailscale.com

---

Part of my series on building your own "Pineapple" with a Raspberry Pi. The video with the full build is on the way on my YouTube channel.