<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-wifi-pineapple-attacks
description: >-
  Detect Wi-Fi Pineapple and similar rogue AP platforms through behavioral fingerprinting, probe response analysis, KARMA attack detection, and PineAP signature identification.
domain: cybersecurity
subdomain: wireless-security
tags:
  - wifi-pineapple
  - pineap
  - karma
  - rogue-device
  - wireless-defense
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1200", "T1557.002", "T1584.007"]
  nist-csf: ["DE.CM-1", "DE.AE-2"]
  uuid: c453bb4f-76c1-4318-8c49-73c4b61739af
---

# Detecting Wi-Fi Pineapple Attacks

## Overview

Wi-Fi Pineapple devices automate rogue AP attacks using PineAP (probe response spoofing),
KARMA (responding to all client probes), and evil twin capabilities. Detection focuses on
behavioral fingerprinting: identifying devices responding to all probe requests, detecting
MAC OUI signatures of known attack hardware, analyzing probe response patterns, and
monitoring for simultaneous multi-SSID broadcasting from a single source.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Monitor-mode wireless adapter | Required |
| tshark for probe response analysis | Required |
| Kismet with Pineapple detection alerts | Required |
| Known Pineapple MAC OUI database | Required |
| Baseline of legitimate probe response behavior | Required |

## Key Concepts

### Pineapple Attack Techniques

```
Wi-Fi Pineapple Capabilities:
├── PineAP — responds to all client probe requests
│   ├── Harvests SSID from probe requests
│   ├── Creates matching AP for each probed SSID
│   └── Client auto-connects to "remembered" network
├── KARMA — legacy probe response spoofing
│   └── Responds to ALL directed probes with matching SSID
├── Evil Twin — targeted AP impersonation
│   └── Clone specific SSID, BSSID, and security config
├── Deauth — force clients to reconnect
│   └── Deauth legitimate AP, client connects to Pineapple
└── Captive Portal — credential harvesting
    └── Fake portal for login capture
```

### Detection Signatures

```bash
# Detect KARMA/PineAP — device responding to all probes
# A single MAC responding to many different SSIDs is suspicious
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x05" \
  -T fields -e wlan.sa -e wlan.ssid | sort | uniq -c | \
  awk '{print $1, $2, $3}' | sort -rn | head

# Pineapple MAC OUI detection
# Hak5 Wi-Fi Pineapple OUI: 00:13:37 (check recent models)
tshark -i wlan0mon -Y "wlan.sa[0:3] == 00:13:37"

# Multi-SSID from single BSSID
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.sa -e wlan.ssid | sort -u -k1,1 | \
  awk '{a[$1]++; b[$1]=b[$1]" "$2} END {for(i in a) if(a[i]>3) print i, a[i], b[i]}'
```

### Probe Response Anomaly Detection

```bash
# Normal AP: responds to probes for its own SSID only
# Pineapple: responds to probes for ANY SSID

# Count unique SSIDs per source MAC in probe responses
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x05" \
  -T fields -e wlan.sa -e wlan.ssid 2>/dev/null | \
  sort | uniq | awk '{count[$1]++} END {for (mac in count) print count[mac], mac}' | \
  sort -rn | head

# >10 unique SSIDs from one MAC = high confidence Pineapple/KARMA
```

## Workflow

### Step 1: Deploy Monitoring

```bash
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x05" -w probe_responses.pcap
```

### Step 2: OUI Screening

Check all detected device MACs against known attack platform OUIs.

### Step 3: Behavioral Analysis

Identify devices responding to multiple unrelated SSIDs (KARMA/PineAP signature).

### Step 4: Probe Response Correlation

Cross-reference probe responses with legitimate AP inventory.

### Step 5: Alert Generation

Flag high-confidence Pineapple indicators for immediate investigation.

### Step 6: Physical Locate and Remove

Use signal strength triangulation to physically locate suspected device.

## Detection

```yaml
title: Wifi Pineapple Attacks Detection
id: cca9311c-63d5-4979-8b3c-91dbd8fe09b0
status: experimental
description: Detects suspicious activity related to detecting wifi pineapple attacks techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.t1557.002
  - attack.t1584.007
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wifi Pineapple Attacks Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1200, T1557.002, T1584.007 |

## Verification

- [ ] Probe response monitoring active
- [ ] Known attack platform OUI list maintained
- [ ] KARMA/PineAP behavioral detection configured
- [ ] Multi-SSID broadcast anomaly detection active
- [ ] Physical security sweep procedure documented
- [ ] Detection validated with controlled Pineapple test

## References

- MITRE ATT&CK T1200 — Hardware Additions
- Hak5 Wi-Fi Pineapple documentation (for understanding capabilities)
- NIST SP 800-153: Guidelines for Securing WLANs
- IEEE 802.11 Probe Request/Response specification
