PINGEQUA
BW16 Dual-Band WiFi Devboard for Flipper Zero - Black
BW16 Dual-Band WiFi Devboard for Flipper Zero - Black
Couldn't load pickup availability
5Ghost WiFi Lab
An RTL8720DN (BW16) dual-band board that finally puts the 5 GHz radio to work — shipped preloaded with the 5Ghost WiFi Lab app. Dock it on the Flipper GPIO header: no wiring, no flashing, no serial commands. One clean app does the scanning, the handshake capture, the channel mapping, and the captive portal — on both bands.
- Real 5 GHz. Scan, capture, and map a band 2.4-only tools physically can't see.
- PMF / WPA3-aware. Flags the APs that ignore deauth — up front, not after you waste time.
- Handshake → PCAP, on device. WPA/WPA2 4-way to SD, crackable in hashcat / aircrack-ng.
- Channel Map. Dual-band congestion view that points at the clear channel.
- Evil Portal. Built-in pages, bundled demos, or your own HTML from the SD card.
-
One
.fap, three firmwares. Official · Momentum · Unleashed.
A 5 GHz radio, and an app that knows what to do with it.
Your Flipper Zero has no Wi-Fi radio of its own. 5Ghost adds one — a genuine dual-band RTL8720DN — and drives it entirely from a native Flipper app over the GPIO UART. Nothing runs on a laptop; the Flipper is the host.
│ 5Ghost WiFi Lab .fap
│
▼ GPIO · UART (TX/RX) + 5V/GND
RTL8720DN (BW16) — preloaded firmware
├─ 2.4 GHz radio · 802.11 b/g/n
└─ 5 GHz radio · 802.11 a/n ← the part other tools skip
That GPIO link is the whole install: dock the board, copy one .fap to the SD card, open the app. The board ships with its firmware already flashed.
Seven tools, one clean screen.
- Dual-band ScanLists 2.4 and 5 GHz APs with signal, encryption, precise PMF (capable / required), WPA3 detection, and same-SSID mesh markers.
- Channel MapCongestion view across both bands with the least-busy channel highlighted — pick a clear channel, or find where the targets are.
- Capture HandshakeForces a reconnect and grabs the WPA/WPA2 4-way handshake on 5 GHz, written as a standard PCAP to SD. Drop straight into hashcat (22000) or aircrack-ng.
- Evil PortalCaptive-portal credential capture — built-in pages, a few bundled demo portals, or load your own HTML from the SD card. Auto-opens on iOS.
- PMF-aware DeauthDeauth on 2.4 + 5 GHz that tells you when a target is 802.11w / WPA3-protected (deauth-immune) instead of failing silently. Hits every same-SSID mesh node in one pass.
- Create AP · BeaconStand up a real joinable soft AP with the captive portal, or flood custom / random / Rickroll beacon frames.
-
Everything to SDScans (CSV), captured credentials, and handshakes (PCAP) all save to
/ext/apps_data/5ghost/with on-screen save confirmation.
Most Flipper Wi-Fi tools can't see half the air.
Half the spectrum, blind to the rest
- No 5 GHz radio — can't scan or attack modern 5 GHz networks at all
- No idea which APs are PMF / WPA3 deauth-immune — fails silently
- Handshake capture is hit-or-miss on crowded 2.4 GHz
- Often a wall of serial commands or a separate web UI
Both bands, on one board, in one app
- Native 5 GHz — scan, Channel Map, handshake and deauth all work on 5 GHz
- Parses each beacon's RSN IE to flag WPA3-SAE / 802.11w up front
- Routes handshake capture through 5 GHz, where it reliably lands
- One native Flipper app, three firmwares, nothing to wire
Three steps from box to first scan.
- Dock the board. Seat the 5Ghost module on your Flipper Zero's GPIO header (top pins). The 4-wire UART link is the only connection.
- Copy the app. Download the latest
.fapfrom GitHub Releases and drop it on your Flipper SD card under/ext/apps/GPIO/. - Open it. On the Flipper, go to
Apps → GPIO → 5Ghost WiFi Lab. The header showsOfficialwhen the board is detected — you're live.
Built for one host, runs on every Flipper firmware.
.fap — it avoids the APIs the official firmware disables, so it loads cleanly everywhere.- Flipper Zero (GPIO / UART)
- Official firmware
- Momentum firmware
- Unleashed firmware
- Other BW16 / RTL8720DN boards — different firmware & pinout, not supported
- ESP32 Wi-Fi boards — no 5 GHz radio
- Standalone use — it is a companion module, the Flipper is the host
The numbers that matter.
| Radio | |
| Chipset | RTL8720DN (BW16) |
| Wi-Fi bands | 2.4 GHz + 5 GHz · 802.11 a/b/g/n |
| Bluetooth | BLE 5.0 |
| Antenna | Onboard PCB antenna (compact) |
| Interface | |
| Host link | Flipper Zero GPIO header · UART (TX/RX) + 5V/GND |
| Form factor | Matches the Flipper Zero footprint — pocketable |
| Software | |
| Module firmware | 5Ghost — preloaded (browser re-flash available) |
| Flipper app | 5Ghost WiFi Lab .fap · Official / Momentum / Unleashed |
| App license | MIT (open-source companion app) |
| In the box | |
| Included | 1 × 5Ghost dual-band board (preloaded) |
| Not included | Flipper Zero host device (shown for reference) |
Ships preloaded — recover it from the browser if you ever need to.
The board leaves the factory with 5Ghost firmware already on it — the only thing you install is the Flipper .fap (see Quick Start). But if the module firmware is ever interrupted mid-update, corrupted, or you simply want to restore it to factory, you can re-flash it from a web browser — no Arduino, no toolchain, no command line.
- Open the recovery flasher. Go to flash.pingequa.com/devices/bw16-5ghost in Chrome or Edge on a desktop (or Chrome on Android). Safari and Firefox can't flash — they lack the Web Serial API.
- Connect the board. Plug the 5Ghost board into your computer with a USB-C data cable, click
Connect, and pick the port. If your OS needs it, install the CH340 serial driver. - Flash. Click
Flash. It enters download mode automatically; if that ever fails, holdBOOT, tapRESET, releaseBOOT, and click Connect again. A full image takes a few minutes at 115200 baud — let it finish.
The flasher and firmware image are hosted by PINGEQUA; the recovery page always shows the current device-specific steps and status.
What it can't do — straight talk.
- WPA3-SAE can't be cracked offline — by any tool. SAE (Dragonfly) is designed so a captured handshake has no offline-crackable hash. No firmware or hardware breaks pure WPA3-SAE. 5Ghost detects WPA3 and tells you it's out of reach. (Networks in WPA3 transition mode, which still accept WPA2, are a separate advanced path.)
- PMF / WPA3 APs can't be deauthed. That's 802.11w working as designed, on any tool. 5Ghost's value is that it tells you instead of letting you guess.
- Mesh roaming is hard. Same-channel mesh nodes are hit in one pass; cross-channel 802.11r roaming is difficult to fully suppress on single-radio hardware. No tool truly solves this.
- Handshake capture runs on 5 GHz. On 2.4 GHz this chip often can't hear the client's uplink — so capture uses 5 GHz, which is exactly what dual-band hardware is for.
- Android captive auto-open can be blocked by Private DNS / DoH; the portal still appears when the user opens any HTTP page.
Real questions, straight answers.
Q.01Does it really do 5 GHz, or is that just marketing?
Really. The RTL8720DN (BW16) has a native 5 GHz radio, so 5Ghost scans, maps congestion, captures handshakes, and deauths on 5 GHz — not just 2.4. The popular ESP32-based Flipper Wi-Fi tools can't do this, because their chip has no 5 GHz radio at all.
Q.02Do I have to flash firmware or wire anything?
No. The board ships preloaded with 5Ghost firmware. You dock it on the Flipper GPIO header and copy one .fap file to the SD card — that's the entire setup. No soldering, no jumper wires, no toolchain. If the module firmware is ever corrupted, it can be re-flashed from a web browser over USB.
Q.03Which Flipper Zero firmwares does it work on?
All three major firmwares: Official, Momentum, and Unleashed. It's a single universal .fap build — it deliberately avoids the APIs the official firmware disables, so it loads cleanly on each one with no separate version to pick.
Q.04Can it crack WPA3?
No — and neither can any other tool, offline. WPA3-SAE is designed so a captured handshake carries no crackable hash. 5Ghost detects WPA3 and labels it as out of reach instead of pretending otherwise. For WPA/WPA2 networks, it captures the 4-way handshake to a standard PCAP you can run through hashcat or aircrack-ng on your own machine.
Q.05Onboard antenna or 8 dBi external — which should I buy?
Same board, same firmware, same app — only the antenna differs. The onboard PCB antenna (this listing) keeps the compact Flipper footprint for everyday pocket use. The 8 dBi external-antenna version trades size for range — better for long-range survey and capture. Pick by whether you want pocketability or reach.
Q.06Does it work on its own, without a Flipper Zero?
No. It's a companion module: the Flipper Zero is the host that runs the app and the screen. The Flipper is not included in this listing.
Q.07Can I use my own captive-portal page?
Yes. Drop any self-contained .html file on the Flipper SD card and serve it through the Evil Portal tool. A few playful demo portals come bundled with the app, and the built-in pages are there too.
Q.08My deauth didn't work on some networks — is it broken?
Almost certainly not. Those networks are PMF (802.11w) or WPA3 protected, which makes them immune to deauth by design — on every tool, not just this one. 5Ghost flags those APs in the scan list so you know up front instead of guessing.
Q.09Is this legal to use?
The device is sold for authorized security testing and education. Testing networks you don't own or have written permission to test is illegal in most countries. You are responsible for using it lawfully and for complying with local radio regulations. See the note below.
Q.10How do I restore the firmware if the board stops responding?
Use the browser recovery flasher at flash.pingequa.com/devices/bw16-5ghost. Open it in Chrome or Edge, connect the board with a USB-C data cable, then click Connect and Flash — it re-installs the factory 5Ghost firmware in a few minutes, with no Arduino or toolchain. See the Firmware & recovery section above for the full steps.
Shipping & Delivery
Shipping & Delivery
We ship globally. Orders are typically processed within 48 hours. Estimated delivery: 7-15 business days depending on your region.
Warranty & Returns
Warranty & Returns
14-day return policy for unused items. Our hardware is backed by a limited warranty against manufacturing defects. (Note: Damage from improper flashing or overvoltage is not covered).
