Five Minutes and an Empty Port Part 4: WiFi Pineapple, Flipper Zero, and the ESP32 Marauder
Parts 2 and 3 both needed physical contact with something: a switch port, a USB port, a cable. This part doesn’t. Wireless tools only need proximity to the air a target’s devices are already broadcasting into, which is a lower bar than either of the first two families and the reason this family gets its own part rather than a footnote.
WiFi Pineapple: the platform this category is built around
The WiFi Pineapple has been Hak5’s dedicated wireless auditing platform since 2008, and the core of what it does today is a suite called PineAP. The Recon module is the passive half: it monitors WiFi channels continuously and builds a live, parent-child table of every access point and every client seen, associating clients to the APs they’re talking to, so an operator gets a real map of the wireless landscape in the area rather than a single scan snapshot.
The active half is what used to be called Karma and now lives inside PineAP as an “Allow Associations” feature. The mechanism: when a client device sends a probe request for a network it remembers, an SSID from a coffee shop, a previous employer, a hotel, the WiFi Pineapple answers on behalf of that network and lets the client associate with it directly, believing it’s reconnecting to something it already trusts. Once associated, the operator controls that client’s traffic completely.
This is also where honesty matters more than most write-ups on this topic bother with. Karma-style attacks were devastating when they were introduced, and they’re much less reliable against a modern phone in 2026 than most explanations of the technique let on. Two changes killed most of it. First, starting with iOS 8 in 2014 and followed gradually by Android and Windows, devices stopped broadcasting directed probe requests naming every network they remember, switching to anonymous wildcard probes that give an attacker nothing to impersonate in the first place. Second, per-network MAC address randomization, standard on iOS since version 14 (2020) and Android since version 10 (2019), means even a successful Karma association doesn’t reveal a device’s real hardware identity or let it be tracked across sessions. Academic research into randomization’s real-world gaps confirms it isn’t airtight, timing-based fingerprinting of the intervals between probe frames can still cluster requests from the same device, but “walk up and a modern iPhone instantly reconnects to your fake network” is largely a thing of the past decade, not the current one.
Flipper Zero and the ESP32 Marauder
The Flipper Zero is a general-purpose pentesting and hardware-hacking multi-tool on its own, and one of its most popular add-ons is the ESP32 Marauder, a GPIO-attached ESP32-S3 module running dedicated Wi-Fi and Bluetooth firmware, controlled entirely from the Flipper’s screen and buttons. It’s open source, actively maintained, and genuinely capable: it can run classic deauthentication attacks against selected access points, beacon-spam fake SSIDs into a target’s network list, run an Evil Portal captive-page phishing flow, and sniff beacon, probe, deauth, and PMKID frames, saving anything captured to an SD card as a standard PCAP for analysis in Wireshark. Capturing a WPA/WPA2 four-way handshake or a PMKID this way doesn’t crack anything on the spot, it hands the same kind of file this site’s own Password Cracking and Wordlist Engineering series starts from, offline hashcat work from there. A Wardrive mode pairs scanning with GPS coordinates to build a geolocated map of nearby networks, and the Bluetooth side adds sniffing, BLE spam, and detection of trackers like AirTags and Tile.
Bare ESP32 and ESP8266 deauthers
Below even the Flipper Zero sits a tier of standalone open-source projects running directly on bare ESP32 or ESP8266 development boards, no Flipper required. These typically cost under $10 in board alone, run community firmware built around the same 802.11 management-frame attacks (deauth, beacon spam) as the Marauder, and are small enough to hide almost anywhere with a USB power source. They’re the clearest illustration of this series’ cost argument from Part 1: a functional wireless attack tool, at the hardware level, costs less than a takeaway coffee.
Comparing the three
| WiFi Pineapple | Flipper Zero + ESP32 Marauder | Bare ESP32/ESP8266 | |
|---|---|---|---|
| Primary strength | Full recon platform, client/AP mapping | Portable, screen-driven, Bluetooth too | Cheapest possible entry point |
| Karma/evil-twin still reliable? | Reduced by MAC randomization, situational | Same limitation, same caveat | Deauth still works regardless |
| Handshake/PMKID capture | Yes | Yes, direct to PCAP on SD card | Varies by firmware |
| Rough cost | Nano to Enterprise, ~$100 to ~$850 | ~$170 Flipper + ~$30-70 add-on | Under $10 |
The one attack in this part that MAC randomization does nothing to stop is deauthentication itself: a deauth frame is a management frame targeting a device already associated to a known AP by its real, currently-connected MAC address, not a probe an attacker is trying to bait. Every tool in this part can still knock a client off its legitimate network at will, which matters for Part 4’s defensive counterpart in Part 9: wireless IDS exists specifically to catch this pattern, not to catch a Karma association that mostly doesn’t work anymore anyway.
Where the three families leave us
Parts 2 through 4 covered the entire attack surface this series is built around: the wired network port, the USB port, and the open air. Part 5 turns to building one of these from scratch on cheap hardware, a real Raspberry Pi 4 dropbox, tested live rather than documented from someone else’s write-up. Part 6 then chains a selection of everything covered so far into one attack narrative before the series turns fully to defense.