5Ghost 2.6.0-beta: Dual-Band Wi-Fi, Clientless PMKID & PMF Detection for the Flipper Zero

PINGEQUA Lab · Wi-Fi research · 6 min read · Updated 2026-07-26

5Ghost WiFi Lab is a dual-band 2.4 / 5 GHz Wi-Fi research tool for the Flipper Zero, built on the Realtek RTL8720DN (BW16) radio. The new 2.6.0-beta release adds clientless PMKID capture (beta) and multi-SSID beacons — here's what changed, why dual-band hardware matters, and an honest look at how it sits next to the popular ESP32 firmwares.

Quick answer The Flipper Zero has no Wi-Fi radio, so every Wi-Fi feature comes from an add-on board — and most of those are 2.4 GHz-only ESP32 boards. The 5Ghost board uses a natively dual-band RTL8720DN (BW16), so 5 GHz scanning, channel mapping, handshake capture and deauth all work on both bands. Version 2.6.0-beta adds clientless PMKID capture (beta) that associates to an AP instead of waiting for a client, plus multi-SSID beacon generation. It also flags which APs are WPA3 / PMF-protected, and does a BLE sweep a bare Flipper can't.

What's new in 2.6.0-beta

Two headline additions, both aimed at getting a usable result faster:

  • Clientless PMKID capture (beta). 5Ghost can now grab a WPA/WPA2 PMKID by associating to the access point itself (AUTHPROBE) — no need to wait for a client to connect and produce a full 4-way handshake. It has an on-device target picker across 2.4 + 5 GHz, a capture-quality gate before it claims success, and it exports both a .22000 file (hashcat mode 22000) and a .json record. It's marked beta: the capture-to-hash pipeline is verified offline, but live-AP end-to-end validation is still ongoing.
  • Multi-SSID beacon generation. Emit multiple named / multi-BSSID beacons for lab work and for testing detectors.

Carried over from 2.5.0-beta: Wi-Fi station recon (list clients on an AP, targeted deauth, focused handshake capture) and BLE recon with multi-round accumulation and de-duplication.

Why dual-band hardware matters

Routers have been steering traffic onto 5 GHz for years — it's faster and less crowded. A 2.4 GHz-only tool simply can't see that half of the air. 5Ghost runs on the Realtek RTL8720DN (BW16), which has a real 5 GHz radio, and it uses that in practical ways: routing WPA/WPA2 handshake capture through 5 GHz, where this class of chip can actually hear the client's reply, and mapping congestion on both bands so you can pick a clear channel or find where the targets are.

An honest caveat on "5 GHz." 5 GHz is no longer unique to one tool. Espressif's ESP32-C5 (dual-band Wi-Fi 6, 2024) can do 5 GHz, and firmwares like GhostESP and Marauder now run on C5 hardware — though 5 GHz attacks there are still early. There are also add-on modules (e.g. Double Barrel 5G) that reach 5 GHz using the same RTL8720DN chip. What 5Ghost focuses on is 5 GHz reliability, PMF/WPA3 awareness, and BLE — not being the only chip that can tune to 5 GHz.

5Ghost vs the popular ESP32 firmwares

This isn't a "one is bad" story — the ESP32 firmwares are excellent, mature, fully open-source projects. They're built for different hardware and different jobs. Here's the straight comparison (versions and sources dated so you can re-check):

Capability 5Ghost (RTL8720DN) ESP32 Marauder Bruce GhostESP
Latest version (2026-07) 2.6.0-beta v1.14.0 1.16 v2.0
5 GHz scan Yes — native C5 hardware only C5, experimental C5 hardware only
2.4 GHz toolkit Yes Yes (mature) Yes Yes
Handshake → PCAP Yes (5 GHz routed) Yes Yes Yes
Clientless PMKID Yes (beta) Passive / deauth* No PMKID Passive*
PMF / WPA3 immunity flagged Yes No No Yes (C5/C6)
BLE scan + tracker detect Yes Yes Yes Yes
Native Flipper app Yes Companion FAP Standalone (M5/CYD) Companion app
Ships preloaded, no flashing Yes No No No
License App MIT; fw closed MIT AGPL-3.0 GPL-3.0

*Marauder and GhostESP can capture a PMKID, but by passive sniffing or by deauthing an existing client — not by self-associating to the AP. Bruce has no dedicated PMKID feature. 5Ghost's clientless PMKID actively associates to elicit the AP's PMKID with no client present. Feature sets evolve — check each project's current docs.

BLE: something a bare Flipper can't do

The Flipper's own firmware never exposes a general BLE scanner to third-party apps — the request for one has sat unimplemented for years. 5Ghost's BW16 radio does the sweep instead: it lists advertising devices with signal and vendor, and flags Find My / AirTag trackers and nearby Flipper Zeros, with a per-device detail page and CSV export. Multi-round accumulation means the list fills in over several passes instead of resetting each scan.

The honest limits (true of any tool)

  • WPA3-SAE can't be cracked offline — by any tool. SAE is designed so a captured handshake carries no offline-crackable hash. 5Ghost detects WPA3 and tells you it's out of reach rather than pretending otherwise.
  • PMF / WPA3 access points can't be deauthed. That's 802.11w working as designed. The difference is whether the tool tells you before you try.
  • Clientless PMKID is beta, and PMKID only exists on APs that include it in their first EAPOL message — it isn't universal.

Get dual-band 5 GHz on your Flipper Zero

The 5Ghost board ships preloaded — dock it on the GPIO header, copy one app to the SD card, and you're scanning both bands. Two antenna options: compact onboard, or a high-gain 8 dBi for range.

Get the 5Ghost board →
See the open-source app on GitHub →

FAQ

What's new in 5Ghost 2.6.0-beta?
Clientless PMKID capture (beta) with an on-device target picker and capture-quality gate, exporting .22000 + .json; and multi-SSID / multi-BSSID beacon generation for lab and detector testing. Wi-Fi station recon and BLE accumulation carry over from 2.5.0-beta.
What is clientless PMKID capture?
It grabs a WPA/WPA2 PMKID by associating to the access point (AUTHPROBE) instead of waiting for a client's 4-way handshake, then exports a hashcat mode-22000 file. In 2.6.0-beta it's marked beta — the capture-to-hash path is verified offline, but live-AP end-to-end validation is ongoing.
Can a Flipper Zero do 5 GHz Wi-Fi?
Not on its own — the Flipper has no Wi-Fi radio, and the common ESP32 add-on boards (ESP32, S2, S3, C3, C6) are 2.4 GHz only. 5Ghost adds real 5 GHz with a dual-band RTL8720DN board. Since 2024, ESP32-C5 boards can also do 5 GHz, so it's no longer unique to one tool.
Can 5Ghost crack WPA3?
No, and no other tool can crack WPA3-SAE offline either. SAE is designed so a captured handshake carries no offline-crackable hash. 5Ghost detects WPA3 / PMF and tells you it's out of scope.
Can a bare Flipper Zero scan Bluetooth LE?
No. Flipper's official firmware doesn't expose a general BLE scanner to third-party apps. 5Ghost's BW16 radio does the sweep — listing advertisers, flagging Find My / AirTag trackers and other Flipper Zeros, and naming vendors.
Which Flipper firmware do I need?
One universal .fap runs on all three major firmwares — Official, Momentum and Unleashed (API 87.1). The board ships preloaded, so there's nothing to flash on it.

Sources & further reading (accessed 2026-07-26): ESP32 Marauder v1.14.0 (MIT); Bruce 1.16 (AGPL-3.0); GhostESP v2.0 (GPL-3.0) and C5 5 GHz docs; ESP32-C5 dual-band Espressif; Double Barrel 5G (RTL8720DN) HoneyHoneyTeam; Flipper Wi-Fi Dev Board (ESP32-S2) developer.flipper.net. Related: Can a Flipper Zero do 5 GHz Wi-Fi? 5Ghost vs the ESP32 Marauder.

For authorized security testing and education only. Test only networks and devices you own or have explicit written permission to test. You are responsible for compliance with all applicable laws and radio regulations (e.g. FCC Part 15 in the US). "Flipper Zero", "ESP32", "ESP32 Marauder", "Bruce" and "GhostESP" are referenced for compatibility and comparison; PINGEQUA is independent and not affiliated with or endorsed by their respective owners.

Retour au blog