5Ghost WiFi Lab: Every Feature & How to Use It on Flipper Zero (2026)
Share
PINGEQUA Lab · Flipper Wi-Fi · 12 min read · Updated 2026-08-08
The 5Ghost WiFi Lab turns a Flipper Zero into a real dual-band 2.4 / 5 GHz Wi-Fi and Bluetooth-LE workbench. Here is every tool in the current build, what each one actually does, and the exact steps to run it.
.fap to the SD card. It does NOT crack WPA3 and does NOT have onboard GPS.
What the 5Ghost WiFi Lab actually is
The Flipper Zero has no Wi-Fi radio of its own. 5Ghost adds one — a genuine dual-band RTL8720DN (BW16) chip that speaks both 2.4 GHz and 5 GHz (802.11 a/b/g/n) plus BLE 5.0 — and drives it entirely from a native Flipper app over the GPIO header. Two halves make one tool:
- The board does the radio. It docks on the Flipper GPIO header and talks over UART (TX/RX + 5V/GND). It ships preloaded, so there is nothing to flash to use it.
-
The app (
5ghost_wifi_lab.fap) is the brains, running on the Flipper's 128×64 screen. It is open-source under the MIT license, and one universal build loads on Official, Momentum, and Unleashed firmware.
This guide covers the current release, v2.7.0 ("BLE recon & injection expansion"), published on the project's GitHub Releases. Feature names and file paths below match that build; check Releases for the exact current tag and date, since betas move.
Every feature at a glance
All tools live in one menu, grouped here by what they're for. Each row links to the step-by-step below.
| Tool | What it does | Saves to |
|---|---|---|
| Dual-band Scan | Lists 2.4 + 5 GHz APs with signal, encryption, PMF/WPA3 flags, mesh markers | CSV |
| Channel Map | Congestion across both bands, least-busy channel highlighted | — |
| Station recon | Lists the clients connected to a chosen AP | CSV |
| PMF / WPA3 detection | Parses each beacon's RSN IE, flags deauth-immune APs up front | in scan |
| Capture Handshake | WPA/WPA2 4-way handshake over 5 GHz, standard PCAP for hashcat / aircrack-ng | PCAP · .22000 |
| Clientless PMKID (beta) | AUTHPROBE-associates to elicit the AP's PMKID with no client present | .22000 · JSON |
| PMF-aware Deauth | Deauth on 2.4 + 5 GHz that reports 802.11w/WPA3 protection instead of failing silently | — |
| BLE suite | Tracker detection, nearby-Flipper detect, GATT recon, iBeacon spoof, BadBLE HID | BLE logs |
| Evil Portal | Captive portal with built-in, bundled, or your own HTML page | credentials |
| Create AP · Beacon | Joinable soft AP, or flood custom / random / Rickroll beacon frames | — |
Everything writes to /ext/apps_data/5ghost/ on the Flipper SD card with an on-screen save confirmation and atomic writes, so an interrupted capture doesn't corrupt the file.
Wi-Fi reconnaissance
Dual-band Scan
What it does. Enumerates access points on both 2.4 GHz and 5 GHz — the band most Flipper Wi-Fi boards physically can't see — showing SSID, signal (RSSI), channel, band, encryption, precise PMF state (capable vs required), WPA3 detection, and same-SSID markers so you can spot a mesh.
How to use it. Launch the app, open Scan Wi-Fi, and let it sweep both bands. Scroll the list and press the center button on any AP to open its detail card (encryption, channel, band, MAC, and the actions available for it). The full list exports to CSV automatically.
Channel Map
What it does. Shows how busy every channel is across both bands and highlights the least-congested one. Two jobs: pick a clean channel for your own soft AP, or see where the target networks cluster.
How to use it. Open Channel Map after a scan. Read the congestion bars per channel; the clear channel is flagged. Note the channel of a target here before you capture — capture works best when you know where the AP lives.
Station reconnaissance
What it does. For a chosen AP, lists the stations (clients) currently associated with it. This is what turns a broad deauth into a surgical one and tells you whether a handshake capture is even possible (no clients = no 4-way handshake to catch — that's where PMKID comes in).
How to use it. From an AP's detail card, choose Stations. The app lists connected client MACs. Select one to scope a targeted deauth or a focused handshake capture at that single client instead of the whole network.
PMF / WPA3 detection
What it does. Reads each beacon's RSN Information Element and tells you up front which APs are WPA3-SAE or 802.11w (PMF) protected — i.e. deauth-immune and offline-uncrackable — so you don't burn time attacking a target that can't be touched.
How to use it. It's automatic in the scan and AP detail views. Read the PMF flag (capable / required) and the WPA3 tag before choosing an action. If it says required, deauth won't work and no crackable hash exists — that's physics, not a bug (see Honest limits).
Capture & authorized offensive tools
Capture Handshake (WPA/WPA2 → PCAP)
What it does. Grabs the WPA/WPA2 4-way handshake and writes it as a standard PCAP to the SD card, ready for offline password testing in hashcat (mode 22000) or aircrack-ng. Capture is routed over the 5 GHz path, where this chip hears the client uplink more reliably than on crowded 2.4 GHz.
How to use it. Pick a WPA/WPA2 target (ideally one with at least one associated station from Station recon), choose Capture Handshake, and let the app force a brief client reconnect to elicit the 4-way. On success it saves a .pcap (and a .22000) to /ext/apps_data/5ghost/. Move the file to your computer and run hashcat -m 22000 capture.22000 wordlist.txt. Mode 22000 handles both handshakes and PMKID in one unified format.
Clientless PMKID via AUTHPROBE — beta
What it does. Captures a crackable hash from a WPA/WPA2-PSK AP with no client connected and no deauth noise. The board actively associates (AUTHPROBE) to elicit the AP's PMKID from the RSN IE in a single frame — the clientless technique first shown by hashcat's Jens Steube in 2018. On-device capture-quality gating tells you when the grab is usable, and it exports directly to .22000 and JSON.
How to use it. Select a WPA/WPA2-PSK AP, choose PMKID, and let the board associate. If the AP is vulnerable, the PMKID lands in seconds — no waiting for a client, no deauth. Crack it the same way: hashcat -m 22000. This is beta: not every AP exposes a PMKID, and coverage varies by router — treat a miss as "this AP doesn't offer one," then fall back to a full handshake.
PMF-aware Deauth
What it does. Sends deauthentication frames on 2.4 GHz and 5 GHz, and — unlike most tools — tells you when the target is 802.11w/WPA3-protected and therefore immune, instead of failing silently. It hits every same-SSID mesh node in one pass, and can be scoped to a single client from Station recon.
How to use it. From an AP (or a specific station) choose Deauth. Watch the PMF indicator: if the target is PMF-required, the app says so and you move on. On an unprotected legacy network, deauth is what forces the reconnect that feeds Capture Handshake. Only ever run this on a network you're authorized to test.
Bluetooth-LE suite (new in v2.7.0)
v2.7.0 expanded 5Ghost well beyond Wi-Fi. The BW16's BLE 5.0 radio now powers a passive-plus-active Bluetooth toolkit. Because we have a dedicated walkthrough for the detection side, here's the summary — the full field guide is Flipper Zero BLE Scanner: Detect AirTags, Trackers & Nearby Flippers.
- Passive BLE sweep — multi-round accumulation with cross-scan deduplication, so a device seen across sweeps is listed once, not fifty times.
- Tracker detection — flags trackers from all four big ecosystems: Apple AirTag, Tile, Samsung SmartTag, and Google Find My. These broadcast BLE advertisements continuously, which is exactly what makes them detectable — useful for anti-stalking sweeps of your own space.
- Nearby Flipper detection — spots other Flipper Zeros in range with vendor-name identification.
- GATT reconnaissance — actively connects to a device and enumerates its GATT services, including the Device Information profile (manufacturer, model, firmware).
- iBeacon spoofing — advertises a custom iBeacon (your own UUID / major / minor) on 30, 60, or 120-second windows, for testing beacon-aware apps and detectors.
- BadBLE HID — advertises as a BLE HID keyboard with a keystroke payload, the Bluetooth analogue of BadUSB, for authorized input-injection testing.
How to use it. Open the Bluetooth menu, start with a passive BLE Scan to build the device list, then select a device to run GATT recon, or pick iBeacon / BadBLE from the menu to switch into an advertising role. Detection is passive and safe to run anywhere you're allowed to listen; GATT connect, iBeacon spoof, and BadBLE are active — authorized targets only.
Network operations
Evil Portal
What it does. Stands up a captive portal for authorized phishing-awareness and credential-capture testing, using a built-in page, one of the bundled demos, or your own self-contained HTML from the SD card. It auto-opens on iOS the way real captive portals do.
How to use it. Drop your .html on the SD card, open Evil Portal, pick the page, and start it. Captured input saves to SD. For page structure, the file layout, and the Android auto-open caveat, follow the dedicated Flipper Zero Evil Portal setup guide.
Create AP · Multi-SSID Beacon
What it does. Two modes. Create AP brings up a real, joinable soft access point (pair it with Evil Portal for an end-to-end captive-portal lab). Beacon floods custom, random, or Rickroll SSID frames — handy for testing how scanners, detectors, and client devices react to beacon spam.
How to use it. Choose Create AP to host a network with a name you set, or Beacon to emit multiple SSIDs at once. Use Channel Map first to sit on a clear channel. Keep beacon floods to a shielded bench or your own space — it's noisy RF.
Where your data goes
Every tool that produces evidence writes it to /ext/apps_data/5ghost/ on the Flipper SD card, with an on-screen confirmation and atomic writes:
-
Scans & station lists →
CSV -
Handshakes & PMKID →
PCAP,.22000(hashcat), and.json - Evil Portal → captured credentials, and BLE logs for the Bluetooth sweeps
Pull the SD card (or use qFlipper) to copy files to your computer for cracking or reporting.
Quick start: box to first scan in three steps
The board is preloaded — there is nothing to flash to get going.
- Dock the board. Seat the 5Ghost module on the Flipper Zero GPIO header (top pins). If you have the 8 dBi external-antenna variant, thread the antenna on first. The 4-wire UART link is the only connection.
-
Copy the app. Download the latest
5ghost_wifi_lab.fapfrom GitHub Releases and place it on the SD card under/ext/apps/GPIO/. -
Open it. On the Flipper, go to
Apps → GPIO → 5Ghost WiFi Lab. When the board is detected the header shows the firmware, and you can start withScan Wi-FiorChannel Map.
Only need to re-flash the board itself (recovery, or a firmware update)? That's a browser job — no toolchain — at flash.pingequa.com/devices/bw16-5ghost in Chrome or Edge with a USB-C data cable.
Firmware compatibility
One universal .fap deliberately avoids the APIs disabled by official firmware, so the same file loads cleanly on all three major builds:
| Firmware | 5Ghost WiFi Lab | Notes |
|---|---|---|
| Official | Supported | No custom firmware needed to run the app |
| Momentum | Supported | Same universal build |
| Unleashed | Supported | Same universal build |
Still choosing a fork? See our Unleashed vs Momentum firmware comparison. Note that 5Ghost is Wi-Fi/BLE only — for Sub-GHz work like Subdriving, that stays the Flipper's own CC1101 radio's job.
Honest limits — what it can't do
Overpromising creates refunds. Here's the real boundary:
- It can't crack WPA3. WPA3-SAE (Dragonfly) is designed so a captured handshake has no offline-crackable hash — by any tool. 5Ghost detects WPA3 and tells you when a target is out of reach.
- It can't deauth PMF / WPA3 APs. 802.11w signs deauth/disassoc frames, so spoofed ones are dropped. That's the standard working as designed; 5Ghost reports it instead of failing silently.
- Clientless PMKID is beta and AP-dependent. Not every router exposes a PMKID; a miss usually means that AP doesn't offer one, not that the tool broke.
- Handshake capture runs on 5 GHz. On 2.4 GHz this chip often can't hear the client uplink consistently, so capture uses the 5 GHz path.
- No onboard GPS. 5Ghost is a scanning/capture board, not a wardriving rig. GPS-tagged Wi-Fi wardriving needs a GPS-equipped board — see the 2026 GPS + WiGLE wardriving guide and the ESP32-C5 dual-band explainer.
- Android captive auto-open can be blocked by Private DNS / DoH; the portal still appears when the user opens any HTTP page.
Get the 5Ghost board
The dual-band BW16 (RTL8720DN) board that runs everything above, preloaded and ready. Choose the compact onboard antenna or the 8 dBi external for more reach — same board, same app. From $44.99.
Shop 5Ghost for Flipper Zero → Need onboard GPS? Scout Lite →FAQ
Does the 5Ghost WiFi Lab really do 5 GHz?
What's the difference between Capture Handshake and Clientless PMKID?
Can it crack Wi-Fi passwords by itself?
Which Flipper firmwares does the app run on?
My deauth did nothing on some networks. Is it broken?
Can it detect AirTags and other trackers?
Onboard antenna or 8 dBi external — which should I buy?
Does it need a Flipper Zero to work?
Related reading: BLE scanner & tracker detection · Evil Portal setup · Wi-Fi wardriving with GPS + WiGLE (2026) · Best Flipper firmware 2026 · ESP32-C5 single-chip dual-band
Sources & further reading: 5Ghost WiFi Lab — source & README (GitHub) · Releases (v2.7.0 changelog) · hashcat wiki — cracking WPA/WPA2 (mode 22000) · hashcat forum — PMKID clientless attack (Jens Steube, 2018) · evilsocket — PMKID client-less attack (2019) · "False Sense of Security on Protected Wi-Fi Networks" (arXiv, 2025) · Cisco — 802.11w Protected Management Frames
For authorized security testing, network administration, and education only. Test only networks and devices you own or have explicit written permission to test. Unauthorized interception or disruption of networks is illegal in most jurisdictions, and you are solely responsible for compliance with all applicable laws and radio regulations — FCC Part 15 (US), CE / RED (EU), and local equivalents. "Flipper Zero" is a trademark of Flipper Devices Inc.; "hashcat", "aircrack-ng", "AirTag", "Tile", "SmartTag" and other names are referenced for compatibility only. PINGEQUA is an independent companion product and is not affiliated with or endorsed by their owners.