WiFi Pineapple Tutorials

Wi-Fi Pineapple Tutorials
Table of Contents
Pineapple Setup…………………………………………………………………………………………………….2
Evil Portal Tutorial……………………………………………………………………………………………….…4
WPA2 Handshake Capture Tutorial..…………………………………………………………………………9
HTTPeek Tutorial……………………………………………………………………………………………….…15
1
Pineapple Setup
Step 1:
Plug the HDMI-C cable into a laptop to power the Pineapple on. The blue light will blink until the
device is fully powered up. Wait until the blue light is solid as shown in the picture below.
Step 2:
Navigate to http://172.16.42.1:1471/ in your browser, and log in with the following credentials:
• Username: root
• Password: A@P1n632myn
2
You may now choose from any of the attacks and run them according to their instructions
in this document.
3
Evil Portal Tutorial
Overview
This attack allows the malicious actor to use the Wi-Fi Pineapple to gain access to a user’s
credentials. When a new user attempts to connect to the Pineapple’s network, they are greeted with
a legitimate-looking login screen for a platform of the attacker’s choosing (i.e. Facebook, Instagram,
Google, etc). If the user does not realize it is a fake portal, they will attempt to log in, thus giving their
credentials to the attacker.
Execution
Step 1: Click on the Evil Portal module (which is currently pinned to the left taskbar, but can also
be found in the “Modules” section).
4
Step 2: Activate the portal that you want to use in your attack by clicking the “Activate” button,
here we chose the Instagram login portal.
Step 3: Scroll to the top and click the “Start” button on the Evil Portal page.
5
The screen should now look as below:
Now your attack should be up and running, so it is time to have your victims navigate to the SSID
you have set up with your pineapple. In this case, we are using “FreeWiFi”.
Step 4: Victim attempts to connect to the “FreeWiFi” by selecting it from available networks.
6
Step 5: Upon attempting to connect, a captive portal will be launched displaying a login screen of
the portal we selected previously (Instagram in this case). Instruct the “victims” to input fake
credentials into this screen, so we can show the pineapples’ ability to capture them in the next
step:
7
Step 6: Back on the Pineapple’s board, click on “View Log” in the portal library next to the portal
you chose (in this case Instagram)
Step 7: A window will pop open that will show all the attempted logins, an example below:
8
WPA2 Handshake Capture
Overview
This attack allows the malicious actor to use the Wi-Fi Pineapple to gain access to a user’s
network through cracking the password. The attacker will capture the handshake of the
victim’s device connecting to the target network, and then decrypt the handshake. Once
decrypted, the attacker will have the password to the Wi-Fi network and be able to launch a
variety of attacks, including impersonating the network.
Execution
Step 1: Click on the Recon switch in the left taskbar (as shown below).
Step 2: Toggle the “Scan” switch to the “on” position, with the timer set to 1 minute. (The
timer may be adjusted if there is not enough data gathered during this timeframe).
9
Step 3: After the scan completes, find the target network SSID in the “Results” section,
and click on it. In this case, the target network is “sheep”, as seen in the third network
listed.
Click on the “+” icon located to the left of “sheep” to see the devices connected to the
network. (The MAC address of the connected device is blacked out).
Then click on the SSID name, in this case: “sheep”

Step 4: In the pop menu, select the “Capture WPA Handshakes” option. Now the
Pineapple is waiting for a device to connect to the “sheep” network so it can capture the
handshake. To speed up this process, you can de-authenticate all of the currently
connected clients using the “Deauthenticate All Clients” button. Once that client tries to
reconnect, the handshake will be captured.
10
As shown in the picture below, the handshake has been captured.
Step 5: Click on the “Handshakes” tab to see the collected handshakes.
11
Step 6: Click on the download icon to the right of the handshake that you want to
download. In this case, we need the PCAP version.
Step 7: Navigate to the following website: https://wpa-sec.stanev.org/?submit or use

Hashcat to crack the password. If using the website, you will first need to make a key, so
click on the “Get Key” button in the top bar. Here you will put in your email to have a private
key sent.
Step 8: After getting the key, click on the “Submit” tab and upload the PCAP file that was
downloaded previously.
12
Step 9: The screen below should display. Navigate to the “My nets” tab to see any cracked
passwords. Password cracking may take some time, depending on the complexity of the
password.
Step 10: Here we have the successfully cracked password for the network listed under the
“WPA key” section.
13
14
HTTPeek Tutorial
Overview
This attack allows the malicious actor to use the Wi-Fi Pineapple to spy on unencrypted
traffic. This means that if any of the clients use an “http” website and no VPN, the attacker
can see what websites they have been visiting and some of the content they are viewing.
Execution
Step 1: Click on the HTTPeek module (which is currently pinned to the left taskbar)
Step 2: Click the button that says “Enable”
15
Step 3: Click the “Start” Button. The pineapple is now set up for listening.
Step 4: Have the target device connect to “FreeWiFi”. You should see the device listed in
the “Clients” tab of the “PineAP Suite”
Step 5: Have your target navigate to a website that is unencrypted, such as the following:
• http://www.dougj.net/
• http://www.renewaloffaith.org
• http://pageometry.weebly.com/
• www.motosportsapps.com
The pineapple will display any images or text it discovers while the victims are on the
websites.
16

WiFi Pineapple Tutorials

Uploaded by

Copyright:

Available Formats

WiFi Pineapple Tutorials

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

WiFi Pineapple Tutorials

Uploaded by

Copyright:

Available Formats

Wi-Fi Pineapple Tutorials

Then click on the SSID name, in this case: “sheep”

Step 5: Click on the “Handshakes” tab to see the collected handshakes.

Step 7: Navigate to the following website: https://wpa-sec.stanev.org/?submit or use

Step 2: Click the button that says “Enable”

You might also like