WiFi Pineapple: Evil Twin Attacks, Captive Portals, and Public WiFi's Unsolved Problem

2026-08-09-15 min read

#wifi-pineapple#evil-twin#captive-portal#deauth#802.11#mitm#hak5#credential-capture

The WiFi Pineapple is a small, unremarkable piece of hardware. It looks like a generic wireless router - a black box with antennas. It costs around $100 from Hak5, a security tool manufacturer based in California that also makes the USB Rubber Ducky, the LAN Turtle, and the Packet Squirrel. You can buy it legally, online, and have it delivered to your door. And with it, you can sit in any coffee shop, airport, or hotel lobby, impersonate every open wireless network in range, and capture the credentials of anyone who connects.

The WiFi Pineapple automates what security researchers have called the "evil twin" attack - a category of wireless interception that has existed since the early days of 802.11 networking and which WiFi security has never adequately solved. The Pineapple makes this attack accessible to anyone with $100 and a basic understanding of networking.

◈ interactive artifact

WiFi Pineapple Attack Simulator

Simulate a full WiFi Pineapple engagement: AP reconnaissance, evil twin creation, deauthentication of clients, captive portal deployment, and credential capture.

//The Evil Twin Attack

Your device learns to trust wireless networks. When you connected to "StarBucks_Guest" at a coffee shop last month, your phone stored that SSID - the network name - and set itself to automatically reconnect if it ever sees that network again. This is a feature. It means you don't have to manually reconnect every time you walk into a familiar location.

The problem is how 802.11 - the wireless networking standard - handles authentication. When your device looks for a known network, it does not verify that the access point broadcasting that SSID is legitimate. It connects to whatever device is broadcasting the right name, favouring the strongest signal. An attacker broadcasting a stronger signal with the same SSID as a network you've previously connected to will attract your device automatically, with no action required from you.

This is the evil twin. An access point under the attacker's control, impersonating a network your device trusts, positioned between you and the internet. All your traffic flows through it.

//The Deauthentication Problem

The WiFi Pineapple's most aggressive feature is deauthentication attack support. The 802.11 standard includes management frames - packets that govern connection state, including deauthentication frames that tell a device its connection is being terminated. In the original design of the standard, these frames were unauthenticated: any device could send a deauthentication frame claiming to be from any access point.

This is a design flaw from 1997 that has never been corrected in the mainstream 2.4 GHz and 5 GHz bands. IEEE 802.11w introduced Protected Management Frames in 2009 to address this, but deployment has been slow. WPA3 requires it, but WPA3 adoption has lagged and most devices still support WPA2 fallback.

[WARNING]

The deauthentication attack is particularly potent at airports, hotels, and conference venues. These environments have multiple legitimate access points broadcasting the same SSID for roaming. Devices in these environments are trained to connect and reconnect frequently. A targeted deauth followed by a stronger evil twin signal almost always results in the device connecting to the attacker.

//Captive Portals and Credential Capture

Many public WiFi networks use captive portals - the authentication page that appears when you first connect, asking for a room number, a loyalty card number, or an email address and password before granting internet access. These portals are served over plain HTTP. The user's device has connected to a network before any authentication has happened, and the portal is served before the user has access to the internet.

The WiFi Pineapple can inject a captive portal into the HTTP stream of any connected client. When the client opens a browser - or when any app makes an HTTP request - the Pineapple intercepts it and serves the fake portal instead. The user sees what looks like the network's authentication page. If they enter credentials, those credentials are captured by the Pineapple.

Users are trained to expect captive portals on public WiFi. "Enter your email to continue" is a normal experience in hotels and coffee shops. Social engineering research consistently shows that users in these environments are far more likely to enter credentials into a portal than they would be in any other context. The environment itself is the social engineering mechanism - the attacker does not need to do anything but provide a portal page that looks plausible.

//The Pineapple's Architecture

The WiFi Pineapple runs a custom Linux distribution built on OpenWrt. It has multiple wireless interfaces: one for broadcasting the evil twin networks (or multiple networks simultaneously), one for management access, and optionally one for upstream internet connectivity. The web management interface is accessible via the management interface from an attacker's laptop.

The Pineapple includes modules - plugins that extend its capabilities. PineAP is the core evil twin module, which handles broadcasting SSIDs, capturing probe requests from nearby devices, and responding to those probes with the appropriate SSID. A probe request is the signal your device sends when it's actively looking for known networks - the Pineapple captures these and broadcasts each remembered network back at the device that asked for it.

Other modules handle packet capture, DNS manipulation, SSL stripping, and credential harvesting. The hardware is designed to be deployed passively - it can run on USB power or a small battery pack, making concealment straightforward.

//SSL and HTTPS

The widespread adoption of HTTPS has substantially reduced the effectiveness of traditional man-in-the-middle attacks. If all traffic between a client and a server is encrypted end-to-end, intercepting it at the network level reveals only metadata - which domains are being accessed, not the content of the requests or responses.

However, HTTPS does not help when the attacker controls the captive portal that the user is entering credentials into. If the attacker serves a fake login page over HTTPS using a self-signed certificate - or, more effectively, over plain HTTP for sites where users do not expect the padlock - the credentials entered are captured in plaintext. Many users do not check for HTTPS before entering credentials on a captive portal page.

[INFO]

HSTS (HTTP Strict Transport Security) prevents browsers from downgrading HTTPS connections to HTTP for enrolled domains, and is an effective countermeasure against SSL stripping. Major websites use HSTS. However, the WiFi Pineapple's attack surface for credential capture is primarily captive portals and HTTP traffic, where HSTS is typically not in play.

//Who Uses WiFi Pineapples

The WiFi Pineapple was designed for penetration testers conducting wireless security assessments. A pentester tasked with evaluating a corporate office's wireless security posture might use a Pineapple to test whether employees can be tricked into connecting to a rogue access point, whether credentials are captured through the captive portal, and whether security monitoring detects the rogue AP.

In practice, the same tool is also used for less scrupulous purposes. Conference venues, airports, and hotels are high-value targets because they concentrate a large number of users who are accustomed to connecting to unfamiliar networks. The risk is highest on networks with no per-device encryption - most public WiFi - where there is no mechanism to detect or prevent a more powerful access point from attracting clients.

Corporate espionage scenarios have been documented where conference WiFi was compromised or spoofed during industry events, allowing passive capture of email and application traffic from attending executives. Physical proximity to target environments is the primary constraint on these attacks.

//Protection

The most effective protection against WiFi Pineapple-style attacks is a VPN that encrypts all traffic before it leaves the device. With a functional VPN, the evil twin can capture the connection but sees only encrypted VPN traffic, not the contents of individual sessions.

WPA3 and Protected Management Frames (802.11w) provide protection against deauthentication attacks. Devices that support WPA3 and that connect to WPA3 networks are not affected by deauth-based evil twin attacks. However, WPA3 coverage is uneven, and many public networks still use open authentication with no encryption.

Disabling automatic network reconnection for public networks is a behavioural countermeasure. If your device does not automatically reconnect to remembered public networks, it is not susceptible to probe request harvesting. This creates friction - you have to manually reconnect to networks you've used before - but eliminates the passive reconnection vector the Pineapple exploits.

The Unsolved Problem

The underlying issue that makes the WiFi Pineapple effective has existed since 802.11 was designed, and the wireless networking ecosystem has not solved it. Management frames are still largely unauthenticated in deployed networks. SSID verification does not exist in the standard - there is no cryptographic binding between an SSID and a specific access point. The concept of trusted networks in operating systems is based on a name that anyone can broadcast.

The Pineapple is not a vulnerability in itself - it is a tool that exploits protocol design choices made in 1997. As long as public WiFi exists, and as long as devices automatically trust networks by name, evil twin attacks will remain viable. The Pineapple just makes them easier.