{"product_id":"flipper-zero-5ghost-bw16-wifi-devboard-black","title":"5Ghost Placa Wi-Fi para Flipper Zero – BW16 RTL8720DN Negro","description":"\u003cdiv class=\"pq5g\"\u003e\n\u003cstyle\u003e\n.pq5g{--ink:#14181d;--mut:#5c6470;--line:#e2e5ea;--bg:#f6f7f9;--orange:#ff6b00;--teal:#1f8a8a;--mono:\"SF Mono\",ui-monospace,Menlo,Consolas,monospace;color:var(--ink);line-height:1.62;font-size:16px;max-width:880px;margin:0 auto;-webkit-font-smoothing:antialiased}\n.pq5g *{box-sizing:border-box}\n.pq5g h1,.pq5g h2,.pq5g h3,.pq5g p,.pq5g ul,.pq5g ol{margin:0}\n.pq5g .hero{padding:6px 0 22px}\n.pq5g .kicker{font-family:var(--mono);font-size:12px;letter-spacing:2px;text-transform:uppercase;color:var(--teal);font-weight:700}\n.pq5g h1.name{font-size:34px;line-height:1.1;font-weight:800;letter-spacing:-.5px;margin:8px 0 6px}\n.pq5g .sub{font-size:19px;font-weight:600;color:var(--ink)}\n.pq5g .lede{font-size:16px;color:var(--mut);margin-top:12px;max-width:62ch}\n.pq5g .feat{list-style:none;padding:0;margin:20px 0 0;display:grid;grid-template-columns:1fr 1fr;gap:12px 26px}\n.pq5g .feat li{padding-left:20px;position:relative;font-size:15px}\n.pq5g .feat li::before{content:\"›\";position:absolute;left:0;top:-1px;color:var(--orange);font-weight:800;font-family:var(--mono)}\n.pq5g .feat b{font-weight:700}\n.pq5g .cta{margin:22px 0 4px;display:flex;flex-wrap:wrap;gap:10px}\n.pq5g .cta a{display:inline-block;text-decoration:none;font-weight:700;font-size:14px;padding:11px 18px;border-radius:8px}\n.pq5g .cta .primary{background:var(--orange);color:#fff}\n.pq5g .cta .ghost{border:1.5px solid var(--line);color:var(--ink)}\n.pq5g section{border-top:1px solid var(--line);padding:26px 0}\n.pq5g .sechead{font-family:var(--mono);font-size:13px;letter-spacing:.5px;color:var(--teal);font-weight:700}\n.pq5g h2{font-size:22px;font-weight:800;letter-spacing:-.3px;margin:6px 0 0}\n.pq5g .tag{color:var(--mut);font-size:15px;margin-top:3px}\n.pq5g .body{margin-top:14px}\n.pq5g .body p+p{margin-top:10px}\n.pq5g .diagram{font-family:var(--mono);font-size:13px;background:#0f1216;color:#d7dde3;border-radius:10px;padding:16px 18px;margin-top:14px;overflow-x:auto;line-height:1.8}\n.pq5g .diagram .o{color:#ff8c3a}.pq5g .diagram .t{color:#5ccfce}.pq5g .diagram .d{color:#8b94a0}\n.pq5g .tools{list-style:none;padding:0;margin:14px 0 0;display:grid;gap:10px}\n.pq5g .tools li{display:grid;grid-template-columns:128px 1fr;gap:14px;align-items:baseline;padding:11px 0;border-bottom:1px dashed var(--line)}\n.pq5g .tools li:last-child{border-bottom:0}\n.pq5g .tools .tn{font-weight:800;font-size:15px}\n.pq5g .tools .td{color:var(--mut);font-size:14.5px}\n.pq5g .vs{display:grid;grid-template-columns:1fr auto 1fr;gap:0;margin-top:16px;align-items:stretch}\n.pq5g .vs .col{border:1px solid var(--line);border-radius:12px;padding:16px 18px}\n.pq5g .vs .col.bad{background:var(--bg)}\n.pq5g .vs .col.good{border-color:var(--orange);box-shadow:0 0 0 1px var(--orange) inset}\n.pq5g .vs .vlbl{font-family:var(--mono);font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--mut);font-weight:700}\n.pq5g .vs .col.good .vlbl{color:var(--orange)}\n.pq5g .vs h4{font-size:16px;margin:4px 0 8px;font-weight:800}\n.pq5g .vs ul{list-style:none;padding:0;margin:0;font-size:14px;color:var(--mut)}\n.pq5g .vs ul li{padding:4px 0 4px 18px;position:relative}\n.pq5g .vs .bad ul li::before{content:\"\\2715\";position:absolute;left:0;color:#b03a3a;font-size:11px;top:6px}\n.pq5g .vs .good ul li{color:var(--ink)}\n.pq5g .vs .good ul li::before{content:\"\\2713\";position:absolute;left:0;color:var(--teal);font-weight:800;font-size:12px;top:5px}\n.pq5g .vsmid{align-self:center;font-family:var(--mono);font-weight:800;color:var(--mut);padding:0 14px}\n.pq5g ol.steps{list-style:none;padding:0;margin:16px 0 0;counter-reset:s;display:grid;gap:14px}\n.pq5g ol.steps li{counter-increment:s;display:grid;grid-template-columns:34px 1fr;gap:14px;align-items:baseline}\n.pq5g ol.steps li::before{content:counter(s,decimal-leading-zero);font-family:var(--mono);font-weight:800;color:var(--orange);font-size:15px}\n.pq5g ol.steps b{font-weight:700}\n.pq5g code{font-family:var(--mono);font-size:.9em;background:var(--bg);padding:1px 6px;border-radius:5px}\n.pq5g .compat{display:grid;grid-template-columns:1fr 1fr;gap:18px;margin-top:14px}\n.pq5g .compat .yes li::before{content:\"\\2713 \";color:var(--teal);font-weight:800}\n.pq5g .compat .no li::before{content:\"\\2715 \";color:#b03a3a;font-weight:700}\n.pq5g .compat ul{list-style:none;padding:0;margin:6px 0 0}\n.pq5g .compat li{padding:3px 0;font-size:14.5px}\n.pq5g .compat .clbl{font-family:var(--mono);font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--mut);font-weight:700}\n.pq5g table.spec{width:100%;border-collapse:collapse;margin-top:14px;font-size:14.5px}\n.pq5g table.spec tr{border-bottom:1px solid var(--line)}\n.pq5g table.spec .grp td{font-family:var(--mono);font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--teal);font-weight:700;padding-top:16px;border-bottom:0}\n.pq5g table.spec td{padding:7px 0;vertical-align:top}\n.pq5g table.spec td.k{color:var(--mut);width:42%}\n.pq5g table.spec td.v{font-weight:600}\n.pq5g .limits{list-style:none;padding:0;margin:14px 0 0;display:grid;gap:11px}\n.pq5g .limits li{padding-left:22px;position:relative;font-size:14.5px}\n.pq5g .limits li::before{content:\"!\";position:absolute;left:0;top:0;width:15px;height:15px;line-height:15px;text-align:center;background:var(--ink);color:#fff;border-radius:3px;font-family:var(--mono);font-size:11px;font-weight:800}\n.pq5g .limits b{font-weight:700}\n.pq5g .box{list-style:none;padding:0;margin:14px 0 0;display:grid;gap:8px}\n.pq5g .box li{display:grid;grid-template-columns:54px 1fr;gap:14px;align-items:baseline;padding:8px 0;border-bottom:1px dashed var(--line)}\n.pq5g .box .q{font-family:var(--mono);font-size:12px;font-weight:800;color:var(--orange)}\n.pq5g .box .bd{color:var(--mut);font-size:14px}\n.pq5g details{border-bottom:1px solid var(--line);padding:2px 0}\n.pq5g summary{cursor:pointer;list-style:none;padding:13px 26px 13px 0;font-weight:700;font-size:15.5px;position:relative}\n.pq5g summary::-webkit-details-marker{display:none}\n.pq5g summary::after{content:\"+\";position:absolute;right:2px;top:11px;font-family:var(--mono);font-size:20px;color:var(--orange);font-weight:700}\n.pq5g details[open] summary::after{content:\"\\2013\"}\n.pq5g summary .qn{font-family:var(--mono);color:var(--teal);font-size:13px;margin-right:8px}\n.pq5g details .ans{padding:0 0 15px;color:var(--mut);font-size:15px;max-width:66ch}\n.pq5g details .ans p+p{margin-top:8px}\n.pq5g .gallery{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:16px}\n.pq5g .gallery figure{margin:0}\n.pq5g .gallery img{width:100%;height:auto;border:1px solid var(--line);border-radius:10px;display:block;background:#0f1216}\n.pq5g .gallery figcaption{font-size:12.5px;color:var(--mut);margin-top:5px;font-family:var(--mono)}\n.pq5g .legal{font-size:12.5px;color:var(--mut);line-height:1.5;border-top:1px solid var(--line);padding-top:18px;margin-top:8px}\n.pq5g .legal b{color:var(--ink)}\n.pq5g .sig{font-family:var(--mono);font-size:13px;color:var(--mut);text-align:center;padding-top:22px}\n.pq5g .sig a{color:var(--orange);text-decoration:none;font-weight:700}\n@media(max-width:640px){.pq5g .feat,.pq5g .compat,.pq5g .gallery{grid-template-columns:1fr}.pq5g .vs{grid-template-columns:1fr}.pq5g .vsmid{padding:6px 0}.pq5g .tools li{grid-template-columns:1fr}.pq5g h1.name{font-size:28px}}\n\u003c\/style\u003e\n\u003cdiv class=\"hero\"\u003e\n  \u003cdiv class=\"kicker\"\u003ePINGEQUA · Dual-Band Wi-Fi Lab\u003c\/div\u003e\n  \u003ch1 class=\"name\"\u003e5Ghost WiFi Lab\u003c\/h1\u003e\n  \u003cdiv class=\"sub\"\u003eReal 2.4 GHz + 5 GHz Wi-Fi recon for Flipper Zero. Preloaded. Plug in and go.\u003c\/div\u003e\n  \u003cp class=\"lede\"\u003eAn RTL8720DN (BW16) dual-band board that finally puts the \u003cb\u003e5 GHz radio to work\u003c\/b\u003e — shipped preloaded with the \u003cb\u003e5Ghost WiFi Lab\u003c\/b\u003e app. Dock it on the Flipper GPIO header: no wiring, no flashing, no serial commands. One clean app does the scanning, the handshake capture, the channel mapping, and the captive portal on both bands.\u003c\/p\u003e\n  \u003cul class=\"feat\"\u003e\n    \u003cli\u003e\n\u003cb\u003eReal 5 GHz.\u003c\/b\u003e Scan, capture, and map a band 2.4 GHz-only tools physically cannot see.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003ePMF \/ WPA3-aware.\u003c\/b\u003e Flags the APs that ignore deauth up front, not after you waste time.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eHandshake → PCAP, on device.\u003c\/b\u003e WPA\/WPA2 4-way to SD, crackable in hashcat \/ aircrack-ng.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eChannel Map.\u003c\/b\u003e Dual-band congestion view that points at the clear channel.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eEvil Portal.\u003c\/b\u003e Built-in pages, bundled demos, or your own HTML from the SD card.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eOne \u003ccode\u003e.fap\u003c\/code\u003e, three firmwares.\u003c\/b\u003e Official · Momentum · Unleashed.\u003c\/li\u003e\n  \u003c\/ul\u003e\n  \u003cdiv class=\"cta\"\u003e\n    \u003ca class=\"primary\" href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\/releases\" target=\"_blank\" rel=\"noopener\"\u003eGet the app (.fap) →\u003c\/a\u003e\n    \u003ca class=\"ghost\" href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\" target=\"_blank\" rel=\"noopener\"\u003eSource \u0026amp; docs on GitHub\u003c\/a\u003e\n  \u003c\/div\u003e\n\u003c\/div\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 01 · How it works\u003c\/div\u003e\n  \u003ch2\u003eA 5 GHz radio, and an app that knows what to do with it.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eTwo halves of one tool — the board does the radio, the Flipper runs the brains.\u003c\/div\u003e\n  \u003cdiv class=\"body\"\u003e\n    \u003cp\u003eYour Flipper Zero has no Wi-Fi radio of its own. 5Ghost adds one, a genuine dual-band RTL8720DN, and drives it entirely from a native Flipper app over GPIO UART. Nothing runs on a laptop; the Flipper is the host.\u003c\/p\u003e\n    \u003cdiv class=\"diagram\"\u003e\n\u003cspan class=\"t\"\u003eFLIPPER ZERO\u003c\/span\u003e \u003cspan class=\"d\"\u003e— host, 128×64 UI\u003c\/span\u003e\u003cbr\u003e\n  │  \u003cspan class=\"d\"\u003e5Ghost WiFi Lab .fap\u003c\/span\u003e\u003cbr\u003e\n  │\u003cbr\u003e\n  ▼  \u003cspan class=\"d\"\u003eGPIO · UART (TX\/RX) + 5V\/GND\u003c\/span\u003e\u003cbr\u003e\n\u003cspan class=\"o\"\u003eRTL8720DN (BW16)\u003c\/span\u003e \u003cspan class=\"d\"\u003e— preloaded firmware\u003c\/span\u003e\u003cbr\u003e\n  ├─ \u003cspan class=\"t\"\u003e2.4 GHz\u003c\/span\u003e \u003cspan class=\"d\"\u003eradio · 802.11 b\/g\/n\u003c\/span\u003e\u003cbr\u003e\n  └─ \u003cspan class=\"t\"\u003e5 GHz\u003c\/span\u003e \u003cspan class=\"d\"\u003eradio · 802.11 a\/n\u003c\/span\u003e  ← \u003cspan class=\"o\"\u003ethe part other tools skip\u003c\/span\u003e\n    \u003c\/div\u003e\n    \u003cp\u003eThat GPIO link is the whole install: dock the board, copy one \u003ccode\u003e.fap\u003c\/code\u003e to the SD card, and open the app. The board ships with its firmware already flashed.\u003c\/p\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 02 · Inside the app\u003c\/div\u003e\n  \u003ch2\u003eSeven tools, one clean screen.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003ePurpose-built for the 128×64 display, not a wall of serial commands.\u003c\/div\u003e\n  \u003cul class=\"tools\"\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eDual-band Scan\u003c\/span\u003e\u003cspan class=\"td\"\u003eLists 2.4 GHz and \u003cb\u003e5 GHz\u003c\/b\u003e APs with signal, encryption, \u003cb\u003eprecise PMF\u003c\/b\u003e (capable \/ required), \u003cb\u003eWPA3 detection\u003c\/b\u003e, and same-SSID mesh markers.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eChannel Map\u003c\/span\u003e\u003cspan class=\"td\"\u003eCongestion view across both bands with the least-busy channel highlighted. Pick a clear channel, or find where the targets are.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eCapture Handshake\u003c\/span\u003e\u003cspan class=\"td\"\u003eForces a reconnect and grabs the WPA\/WPA2 4-way handshake on \u003cb\u003e5 GHz\u003c\/b\u003e, written as a standard PCAP to SD. Drop straight into hashcat (22000) or aircrack-ng.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eEvil Portal\u003c\/span\u003e\u003cspan class=\"td\"\u003eCaptive-portal credential capture with built-in pages, bundled demo portals, or \u003cb\u003eyour own HTML\u003c\/b\u003e from the SD card. Auto-opens on iOS.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003ePMF-aware Deauth\u003c\/span\u003e\u003cspan class=\"td\"\u003eDeauth on 2.4 GHz + 5 GHz that \u003cb\u003etells you\u003c\/b\u003e when a target is 802.11w \/ WPA3-protected (deauth-immune) instead of failing silently. Hits every same-SSID mesh node in one pass.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eCreate AP · Beacon\u003c\/span\u003e\u003cspan class=\"td\"\u003eStand up a real joinable soft AP with the captive portal, or flood custom \/ random \/ Rickroll beacon frames.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eEverything to SD\u003c\/span\u003e\u003cspan class=\"td\"\u003eScans (CSV), captured credentials, and handshakes (PCAP) all save to \u003ccode\u003e\/ext\/apps_data\/5ghost\/\u003c\/code\u003e with on-screen save confirmation.\u003c\/span\u003e\n\u003c\/li\u003e\n  \u003c\/ul\u003e\n  \u003cdiv class=\"gallery\"\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/home.png\" alt=\"5Ghost WiFi Lab home menu on Flipper Zero showing firmware status and tool list\" loading=\"lazy\"\u003e\u003cfigcaption\u003eHome · firmware status + tools\u003c\/figcaption\u003e\u003c\/figure\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/scan-list.png\" alt=\"Dual-band Wi-Fi scan list with lock icon, SSID, RSSI and mesh markers\" loading=\"lazy\"\u003e\u003cfigcaption\u003eScan · 2.4 GHz + 5 GHz, PMF flags\u003c\/figcaption\u003e\u003c\/figure\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/ap-detail.png\" alt=\"Access point detail screen showing encryption, channel, band, MAC and actions\" loading=\"lazy\"\u003e\u003cfigcaption\u003eAP detail · encryption, band, MAC\u003c\/figcaption\u003e\u003c\/figure\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/channel-map.png\" alt=\"Channel Map showing 2.4 GHz and 5 GHz band congestion and the best channel\" loading=\"lazy\"\u003e\u003cfigcaption\u003eChannel Map · best channel\u003c\/figcaption\u003e\u003c\/figure\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 03 · Why 5 GHz changes the game\u003c\/div\u003e\n  \u003ch2\u003eMost Flipper Wi-Fi tools cannot see half the air.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eThe popular ESP32 boards have no 5 GHz radio. That is a hardware limit, not a setting.\u003c\/div\u003e\n  \u003cdiv class=\"vs\"\u003e\n    \u003cdiv class=\"col bad\"\u003e\n      \u003cdiv class=\"vlbl\"\u003e2.4 GHz tool · ESP32 \/ Marauder-class\u003c\/div\u003e\n      \u003ch4\u003eHalf the spectrum, blind to the rest\u003c\/h4\u003e\n      \u003cul\u003e\n        \u003cli\u003eNo 5 GHz radio, so they cannot scan or target modern 5 GHz networks at all\u003c\/li\u003e\n        \u003cli\u003eNo clear indication of which APs are PMF \/ WPA3 deauth-immune\u003c\/li\u003e\n        \u003cli\u003eHandshake capture is often unreliable on crowded 2.4 GHz\u003c\/li\u003e\n        \u003cli\u003eOften a wall of serial commands or a separate web UI\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n    \u003cdiv class=\"vsmid\"\u003eVS\u003c\/div\u003e\n    \u003cdiv class=\"col good\"\u003e\n      \u003cdiv class=\"vlbl\"\u003e5Ghost · RTL8720DN (BW16)\u003c\/div\u003e\n      \u003ch4\u003eBoth bands, on one board, in one app\u003c\/h4\u003e\n      \u003cul\u003e\n        \u003cli\u003eNative 5 GHz scan, Channel Map, handshake capture, and deauth support\u003c\/li\u003e\n        \u003cli\u003eParses each beacon's RSN IE to flag WPA3-SAE \/ 802.11w up front\u003c\/li\u003e\n        \u003cli\u003eRoutes handshake capture through 5 GHz, where it lands more reliably\u003c\/li\u003e\n        \u003cli\u003eOne native Flipper app, three firmwares, nothing to wire\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 04 · Quick start\u003c\/div\u003e\n  \u003ch2\u003eThree steps from box to first scan.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eThe board is preloaded. There is nothing to flash.\u003c\/div\u003e\n  \u003col class=\"steps\"\u003e\n    \u003cli\u003e\u003cspan\u003e\u003cb\u003eDock the board.\u003c\/b\u003e Seat the 5Ghost module on your Flipper Zero GPIO header (top pins). The 4-wire UART link is the only connection.\u003c\/span\u003e\u003c\/li\u003e\n    \u003cli\u003e\u003cspan\u003e\u003cb\u003eCopy the app.\u003c\/b\u003e Download the latest \u003ccode\u003e.fap\u003c\/code\u003e from \u003ca href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\/releases\" target=\"_blank\" rel=\"noopener\"\u003eGitHub Releases\u003c\/a\u003e and place it on your Flipper SD card under \u003ccode\u003e\/ext\/apps\/GPIO\/\u003c\/code\u003e.\u003c\/span\u003e\u003c\/li\u003e\n    \u003cli\u003e\u003cspan\u003e\u003cb\u003eOpen it.\u003c\/b\u003e On the Flipper, go to \u003ccode\u003eApps → GPIO → 5Ghost WiFi Lab\u003c\/code\u003e. The header shows \u003ccode\u003eOfficial\u003c\/code\u003e when the board is detected.\u003c\/span\u003e\u003c\/li\u003e\n  \u003c\/ol\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 05 · Compatibility\u003c\/div\u003e\n  \u003ch2\u003eBuilt for one host, runs on every Flipper firmware.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eOne universal \u003ccode\u003e.fap\u003c\/code\u003e that avoids the APIs disabled by official firmware, so it loads cleanly everywhere.\u003c\/div\u003e\n  \u003cdiv class=\"compat\"\u003e\n    \u003cdiv class=\"yes\"\u003e\n      \u003cdiv class=\"clbl\"\u003eVerified on\u003c\/div\u003e\n      \u003cul\u003e\n        \u003cli\u003eFlipper Zero (GPIO \/ UART)\u003c\/li\u003e\n        \u003cli\u003eOfficial firmware\u003c\/li\u003e\n        \u003cli\u003eMomentum firmware\u003c\/li\u003e\n        \u003cli\u003eUnleashed firmware\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n    \u003cdiv class=\"no\"\u003e\n      \u003cdiv class=\"clbl\"\u003eNot a fit for\u003c\/div\u003e\n      \u003cul\u003e\n        \u003cli\u003eOther BW16 \/ RTL8720DN boards with different firmware or pinout\u003c\/li\u003e\n        \u003cli\u003eESP32 Wi-Fi boards with no 5 GHz radio\u003c\/li\u003e\n        \u003cli\u003eStandalone use, because the Flipper is the host\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 06 · Specifications\u003c\/div\u003e\n  \u003ch2\u003eThe numbers that matter.\u003c\/h2\u003e\n  \u003ctable class=\"spec\"\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eRadio\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eChipset\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eRTL8720DN (BW16)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eWi-Fi bands\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e2.4 GHz + 5 GHz · 802.11 a\/b\/g\/n\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eBluetooth\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eBLE 5.0\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eAntenna\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eOnboard PCB antenna (compact)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eInterface\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eHost link\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eFlipper Zero GPIO header · UART (TX\/RX) + 5V\/GND\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eForm factor\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eMatches the Flipper Zero footprint\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eSoftware\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eModule firmware\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e5Ghost, preloaded (browser re-flash available)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eFlipper app\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e5Ghost WiFi Lab \u003ccode\u003e.fap\u003c\/code\u003e · Official \/ Momentum \/ Unleashed\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eApp license\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eMIT (open-source companion app)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eIn the box\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eIncluded\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e1 × 5Ghost dual-band board (preloaded)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eNot included\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eFlipper Zero host device (shown for reference)\u003c\/td\u003e\n\u003c\/tr\u003e\n  \u003c\/table\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 07 · Firmware \u0026amp; recovery\u003c\/div\u003e\n  \u003ch2\u003eShips preloaded, with browser recovery if you ever need it.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eYou normally do not need to flash anything. This is the safety net.\u003c\/div\u003e\n  \u003cdiv class=\"body\"\u003e\n    \u003cp\u003eThe board leaves the factory with 5Ghost firmware already installed. The only thing you normally add is the Flipper \u003ccode\u003e.fap\u003c\/code\u003e from Quick Start. If the module firmware is interrupted mid-update, corrupted, or needs to be restored, you can re-flash it from a \u003cb\u003eweb browser\u003c\/b\u003e with no Arduino toolchain or command line.\u003c\/p\u003e\n    \u003col class=\"steps\"\u003e\n      \u003cli\u003e\u003cspan\u003e\u003cb\u003eOpen the recovery flasher.\u003c\/b\u003e Visit \u003ca href=\"https:\/\/flash.pingequa.com\/devices\/bw16-5ghost\" target=\"_blank\" rel=\"noopener\"\u003eflash.pingequa.com\/devices\/bw16-5ghost\u003c\/a\u003e in \u003cb\u003eChrome or Edge\u003c\/b\u003e on desktop, or Chrome on Android. Safari and Firefox do not support the required Web Serial API.\u003c\/span\u003e\u003c\/li\u003e\n      \u003cli\u003e\u003cspan\u003e\u003cb\u003eConnect the board.\u003c\/b\u003e Plug the 5Ghost board into your computer with a \u003cb\u003eUSB-C data cable\u003c\/b\u003e, click \u003ccode\u003eConnect\u003c\/code\u003e, and choose the port. If required by your OS, install the CH340 serial driver.\u003c\/span\u003e\u003c\/li\u003e\n      \u003cli\u003e\u003cspan\u003e\u003cb\u003eFlash.\u003c\/b\u003e Click \u003ccode\u003eFlash\u003c\/code\u003e. It enters download mode automatically; if that fails, hold \u003ccode\u003eBOOT\u003c\/code\u003e, tap \u003ccode\u003eRESET\u003c\/code\u003e, release \u003ccode\u003eBOOT\u003c\/code\u003e, and reconnect. A full image takes a few minutes at 115200 baud.\u003c\/span\u003e\u003c\/li\u003e\n    \u003c\/ol\u003e\n    \u003cp style=\"margin-top:12px\"\u003eThe flasher and firmware image are hosted by PINGEQUA, and the recovery page shows the latest device-specific steps and status.\u003c\/p\u003e\n    \u003cdiv class=\"cta\"\u003e\u003ca class=\"ghost\" href=\"https:\/\/flash.pingequa.com\/devices\/bw16-5ghost\" target=\"_blank\" rel=\"noopener\"\u003eOpen the browser recovery flasher →\u003c\/a\u003e\u003c\/div\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 08 · Honest limits\u003c\/div\u003e\n  \u003ch2\u003eWhat it cannot do, stated clearly.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eOverpromising creates refunds. Here is the actual boundary.\u003c\/div\u003e\n  \u003cul class=\"limits\"\u003e\n    \u003cli\u003e\n\u003cb\u003eWPA3-SAE cannot be cracked offline.\u003c\/b\u003e SAE (Dragonfly) is designed so a captured handshake has no offline-crackable hash. 5Ghost \u003cb\u003edetects\u003c\/b\u003e WPA3 and tells you when it is out of reach.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003ePMF \/ WPA3 APs cannot be deauthed.\u003c\/b\u003e That is 802.11w working as designed. 5Ghost tells you instead of failing silently.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eMesh roaming is hard.\u003c\/b\u003e Same-channel mesh nodes are hit in one pass; cross-channel 802.11r roaming is still difficult to suppress fully on single-radio hardware.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eHandshake capture runs on 5 GHz.\u003c\/b\u003e On 2.4 GHz, this chip often cannot hear the client uplink consistently, so capture uses 5 GHz.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eAndroid captive auto-open\u003c\/b\u003e can be blocked by Private DNS \/ DoH; the portal still appears when the user opens any HTTP page.\u003c\/li\u003e\n  \u003c\/ul\u003e\n\u003c\/section\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 09 · FAQ\u003c\/div\u003e\n  \u003ch2\u003eReal questions, straight answers.\u003c\/h2\u003e\n  \u003cdiv class=\"body\" style=\"margin-top:8px\"\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.01\u003c\/span\u003eDoes it really do 5 GHz, or is that just marketing?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eReally. The RTL8720DN (BW16) has a native 5 GHz radio, so 5Ghost scans, maps congestion, captures handshakes, and deauths on 5 GHz. Popular ESP32-based Flipper Wi-Fi tools cannot do this because their chips have no 5 GHz radio.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.02\u003c\/span\u003eDo I have to flash firmware or wire anything?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eNo. The board ships preloaded with 5Ghost firmware. Dock it on the Flipper GPIO header and copy one \u003ccode\u003e.fap\u003c\/code\u003e file to the SD card. No soldering, jumper wires, or toolchain are required.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.03\u003c\/span\u003eWhich Flipper Zero firmwares does it work on?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eAll three major firmwares: \u003cb\u003eOfficial\u003c\/b\u003e, \u003cb\u003eMomentum\u003c\/b\u003e, and \u003cb\u003eUnleashed\u003c\/b\u003e. It is a single universal \u003ccode\u003e.fap\u003c\/code\u003e build.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.04\u003c\/span\u003eCan it crack WPA3?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eNo. WPA3-SAE is designed so a captured handshake has no crackable offline hash. For WPA\/WPA2 networks, 5Ghost captures the standard 4-way handshake to PCAP for use in tools like hashcat or aircrack-ng.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.05\u003c\/span\u003eOnboard antenna or 8 dBi external, which should I buy?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eSame board, same firmware, same app. The onboard PCB antenna version keeps a compact Flipper footprint, while the external-antenna version trades size for more reach.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.06\u003c\/span\u003eDoes it work on its own, without a Flipper Zero?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eNo. It is a companion module. The Flipper Zero is the host and is not included in this listing.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.07\u003c\/span\u003eCan I use my own captive-portal page?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eYes. Place a self-contained \u003ccode\u003e.html\u003c\/code\u003e file on the Flipper SD card and serve it through Evil Portal.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.08\u003c\/span\u003eMy deauth did not work on some networks. Is it broken?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eAlmost certainly not. Those networks are usually PMF (802.11w) or WPA3 protected, which makes them immune to deauth by design.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.09\u003c\/span\u003eIs this legal to use?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eThe device is sold for authorized security testing and education. You are responsible for using it lawfully and complying with local radio regulations.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.10\u003c\/span\u003eHow do I restore the firmware if the board stops responding?\u003c\/summary\u003e\u003cdiv class=\"ans\"\u003e\u003cp\u003eUse the browser recovery flasher at \u003ca href=\"https:\/\/flash.pingequa.com\/devices\/bw16-5ghost\" target=\"_blank\" rel=\"noopener\"\u003eflash.pingequa.com\/devices\/bw16-5ghost\u003c\/a\u003e in Chrome or Edge, connect the board with a USB-C data cable, then click Connect and Flash.\u003c\/p\u003e\u003c\/div\u003e\u003c\/details\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\u003cdiv class=\"legal\"\u003e\n  \u003cb\u003eFor authorized security testing, network administration, and education only.\u003c\/b\u003e Only test networks and devices you own or have explicit written permission to test. Unauthorized interception or disruption of networks is illegal in most jurisdictions. End users are solely responsible for compliance with all applicable laws and radio regulations — \u003cb\u003eFCC Part 15\u003c\/b\u003e (US), \u003cb\u003eCE \/ RED\u003c\/b\u003e (EU), and local equivalents. Sold as-is, with no warranty. \"Flipper Zero\" is a trademark of Flipper Devices Inc.; this is an independent companion product and is not affiliated with or endorsed by Flipper Devices.\n\u003c\/div\u003e\n\u003cdiv class=\"sig\"\u003ePINGEQUA · \u003ca href=\"https:\/\/pingequa.com\" target=\"_blank\" rel=\"noopener\"\u003epingequa.com\u003c\/a\u003e · \u003ca href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\" target=\"_blank\" rel=\"noopener\"\u003egithub.com\/pingequalab\/5ghost-wifi-lab\u003c\/a\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e","brand":"PINGEQUA","offers":[{"title":"Default Title","offer_id":40815640641600,"sku":"FZ-BW16-BLK","price":39.99,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0595\/6753\/8240\/files\/6_8724f266-7229-46e4-b09d-a8ec00a1a533.jpg?v=1776675838","url":"https:\/\/www.pingequa.com\/es\/products\/flipper-zero-5ghost-bw16-wifi-devboard-black","provider":"PINGEQUA","version":"1.0","type":"link"}