Recon Payloads
Recon payloads are run from the Pager UI after selecting an access point or client from the Pineapple Recon device list.
Recon payloads add new features and actions for discovered devices.
Recon environment
The Pineapple Recon system collects a large amount of data about the wireless environment.
This data is shared with a recon payload via environment variables. Environment variables are accessible in a payload by name, such as ${_RECON_SELECTED_AP_CHANNEL}
All payloads
All recon payloads have basic data - such as the directory the payload is installed - added to the environment.
| Variable | Payload | Description |
|---|---|---|
| PAYLOAD_HOME | All | Directory where the payload is installed |
Access point payloads
When a recon payload is run for a selected access point, all available data from the access point is included:
| Variable | Payload | Description |
|---|---|---|
| _RECON_SELECTED_AP_OUI | Access point | OUI / Manufacturer name |
| _RECON_SELECTED_AP_BEACONED_SSIDS | Access point | Number of beaconed SSIDs |
| _RECON_SELECTED_AP_PROBED_SSIDS | Access point | Number of probed SSIDs (if AP has also acted like a client) |
| _RECON_SELECTED_AP_RESPONDED_SSIDS | Access point | Number of responded SSIDs |
| _RECON_SELECTED_AP_SSID | Access point | Primary SSID (UTF-8) |
| _RECON_SELECTED_AP_HIDDEN | Access point | Is SSID hidden / decloaeked |
| _RECON_SELECTED_AP_CHANNEL | Access point | Advertised channel of AP |
| _RECON_SELECTED_AP_ENCRYPTION_TYPE | Access point | Advertised encryption of AP |
| _RECON_SELECTED_AP_CLIENT_COUNT | Access point | Number of detected clients on AP |
| _RECON_SELECTED_AP_BEACONED_SSID | Access point | Primary beaconed SSID |
| _RECON_SELECTED_AP_PROBED_SSID | Access point | Primary probed SSID |
| _RECON_SELECTED_AP_RESPONDED_SSID | Access point | Primary probe response SSID |
| _RECON_SELECTED_AP_MAC_ADDRESS | Access point | MAC address of AP |
| _RECON_SELECTED_AP_BSSID | Access point | MAC address of AP |
| _RECON_SELECTED_AP_TIMESTAMP | Access point | Time the AP was first seen |
| _RECON_SELECTED_AP_RSSI | Access point | Signal of AP |
| _RECON_SELECTED_AP_FREQ | Access point | Frequency |
| _RECON_SELECTED_AP_PACKETS | Access point | Number of packets as human-readable unit suffixes (100kK 100M, etc) |
Wi-Fi client payloads
A Wi-Fi client payload is given the data about the selected access point, as well as the data about the selected client:
| Variable | Payload | Description |
|---|---|---|
| _RECON_SELECTED_CLIENT_OUI | Client | OUI / Manufacturer name lookup |
| _RECON_SELECTED_CLIENT_BEACONED_SSIDS | Client | Number of beaconed SSIDs (if client has also acted as an AP) |
| _RECON_SELECTED_CLIENT_PROBED_SSIDS | Client | Number of probed SSIDs |
| _RECON_SELECTED_CLIENT_RESPONDED_SSIDS | Client | Number of responded SSIDs (if client has also acted as an AP) |
| _RECON_SELECTED_CLIENT_BEACONED_SSID | Client | Primary beaconed SSID (if client has also acted as an AP) |
| _RECON_SELECTED_CLIENT_PROBED_SSID | Client | Primary probed SSID |
| _RECON_SELECTED_CLIENT_RESPONDED_SSID | Client | Primary probe response SSID (if client has also acted as an AP) |
| _RECON_SELECTED_CLIENT_MAC_ADDRESS | Client | MAC address of client |
| _RECON_SELECTED_CLIENT_TIMESTAMP | Client | Time the client was first seen |
| _RECON_SELECTED_CLIENT_RSSI | Client | Signal of client |
| _RECON_SELECTED_CLIENT_FREQ | Client | Frequency |
| _RECON_SELECTED_CLIENT_PACKETS | Client | Number of packets as human-readable unit suffixes |