{"product_id":"flipper-zero-5ghost-antenna","title":"BW16 External Antenna Version for Flipper Zero","description":"\u003cdiv class=\"pq5g\"\u003e\n\u003cstyle\u003e\n.pq5g{--ink:#14181d;--mut:#5c6470;--line:#e2e5ea;--bg:#f6f7f9;--orange:#ff6b00;--teal:#1f8a8a;--mono:\"SF Mono\",ui-monospace,Menlo,Consolas,monospace;color:var(--ink);line-height:1.62;font-size:16px;max-width:880px;margin:0 auto;-webkit-font-smoothing:antialiased}\n.pq5g *{box-sizing:border-box}\n.pq5g h1,.pq5g h2,.pq5g h3,.pq5g p,.pq5g ul,.pq5g ol{margin:0}\n.pq5g .hero{padding:6px 0 22px}\n.pq5g .kicker{font-family:var(--mono);font-size:12px;letter-spacing:2px;text-transform:uppercase;color:var(--teal);font-weight:700}\n.pq5g h1.name{font-size:34px;line-height:1.1;font-weight:800;letter-spacing:-.5px;margin:8px 0 6px}\n.pq5g .sub{font-size:19px;font-weight:600;color:var(--ink)}\n.pq5g .lede{font-size:16px;color:var(--mut);margin-top:12px;max-width:62ch}\n.pq5g .feat{list-style:none;padding:0;margin:20px 0 0;display:grid;grid-template-columns:1fr 1fr;gap:12px 26px}\n.pq5g .feat li{padding-left:20px;position:relative;font-size:15px}\n.pq5g .feat li::before{content:\"›\";position:absolute;left:0;top:-1px;color:var(--orange);font-weight:800;font-family:var(--mono)}\n.pq5g .feat b{font-weight:700}\n.pq5g .cta{margin:22px 0 4px;display:flex;flex-wrap:wrap;gap:10px}\n.pq5g .cta a{display:inline-block;text-decoration:none;font-weight:700;font-size:14px;padding:11px 18px;border-radius:8px}\n.pq5g .cta .primary{background:var(--orange);color:#fff}\n.pq5g .cta .ghost{border:1.5px solid var(--line);color:var(--ink)}\n.pq5g section{border-top:1px solid var(--line);padding:26px 0}\n.pq5g .sechead{font-family:var(--mono);font-size:13px;letter-spacing:.5px;color:var(--teal);font-weight:700}\n.pq5g h2{font-size:22px;font-weight:800;letter-spacing:-.3px;margin:6px 0 0}\n.pq5g .tag{color:var(--mut);font-size:15px;margin-top:3px}\n.pq5g .body{margin-top:14px}\n.pq5g .body p+p{margin-top:10px}\n.pq5g .diagram{font-family:var(--mono);font-size:13px;background:#0f1216;color:#d7dde3;border-radius:10px;padding:16px 18px;margin-top:14px;overflow-x:auto;line-height:1.8}\n.pq5g .diagram .o{color:#ff8c3a}.pq5g .diagram .t{color:#5ccfce}.pq5g .diagram .d{color:#8b94a0}\n.pq5g .tools{list-style:none;padding:0;margin:14px 0 0;display:grid;gap:10px}\n.pq5g .tools li{display:grid;grid-template-columns:128px 1fr;gap:14px;align-items:baseline;padding:11px 0;border-bottom:1px dashed var(--line)}\n.pq5g .tools li:last-child{border-bottom:0}\n.pq5g .tools .tn{font-weight:800;font-size:15px}\n.pq5g .tools .td{color:var(--mut);font-size:14.5px}\n.pq5g .vs{display:grid;grid-template-columns:1fr auto 1fr;gap:0;margin-top:16px;align-items:stretch}\n.pq5g .vs .col{border:1px solid var(--line);border-radius:12px;padding:16px 18px}\n.pq5g .vs .col.bad{background:var(--bg)}\n.pq5g .vs .col.good{border-color:var(--orange);box-shadow:0 0 0 1px var(--orange) inset}\n.pq5g .vs .vlbl{font-family:var(--mono);font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--mut);font-weight:700}\n.pq5g .vs .col.good .vlbl{color:var(--orange)}\n.pq5g .vs h4{font-size:16px;margin:4px 0 8px;font-weight:800}\n.pq5g .vs ul{list-style:none;padding:0;margin:0;font-size:14px;color:var(--mut)}\n.pq5g .vs ul li{padding:4px 0 4px 18px;position:relative}\n.pq5g .vs .bad ul li::before{content:\"\\2715\";position:absolute;left:0;color:#b03a3a;font-size:11px;top:6px}\n.pq5g .vs .good ul li{color:var(--ink)}\n.pq5g .vs .good ul li::before{content:\"\\2713\";position:absolute;left:0;color:var(--teal);font-weight:800;font-size:12px;top:5px}\n.pq5g .vsmid{align-self:center;font-family:var(--mono);font-weight:800;color:var(--mut);padding:0 14px}\n.pq5g ol.steps{list-style:none;padding:0;margin:16px 0 0;counter-reset:s;display:grid;gap:14px}\n.pq5g ol.steps li{counter-increment:s;display:grid;grid-template-columns:34px 1fr;gap:14px;align-items:baseline}\n.pq5g ol.steps li::before{content:counter(s,decimal-leading-zero);font-family:var(--mono);font-weight:800;color:var(--orange);font-size:15px}\n.pq5g ol.steps b{font-weight:700}\n.pq5g code{font-family:var(--mono);font-size:.9em;background:var(--bg);padding:1px 6px;border-radius:5px}\n.pq5g .compat{display:grid;grid-template-columns:1fr 1fr;gap:18px;margin-top:14px}\n.pq5g .compat .yes li::before{content:\"\\2713 \";color:var(--teal);font-weight:800}\n.pq5g .compat .no li::before{content:\"\\2715 \";color:#b03a3a;font-weight:700}\n.pq5g .compat ul{list-style:none;padding:0;margin:6px 0 0}\n.pq5g .compat li{padding:3px 0;font-size:14.5px}\n.pq5g .compat .clbl{font-family:var(--mono);font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--mut);font-weight:700}\n.pq5g table.spec{width:100%;border-collapse:collapse;margin-top:14px;font-size:14.5px}\n.pq5g table.spec tr{border-bottom:1px solid var(--line)}\n.pq5g table.spec .grp td{font-family:var(--mono);font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--teal);font-weight:700;padding-top:16px;border-bottom:0}\n.pq5g table.spec td{padding:7px 0;vertical-align:top}\n.pq5g table.spec td.k{color:var(--mut);width:42%}\n.pq5g table.spec td.v{font-weight:600}\n.pq5g .limits{list-style:none;padding:0;margin:14px 0 0;display:grid;gap:11px}\n.pq5g .limits li{padding-left:22px;position:relative;font-size:14.5px}\n.pq5g .limits li::before{content:\"!\";position:absolute;left:0;top:0;width:15px;height:15px;line-height:15px;text-align:center;background:var(--ink);color:#fff;border-radius:3px;font-family:var(--mono);font-size:11px;font-weight:800}\n.pq5g .limits b{font-weight:700}\n.pq5g .box{list-style:none;padding:0;margin:14px 0 0;display:grid;gap:8px}\n.pq5g .box li{display:grid;grid-template-columns:54px 1fr;gap:14px;align-items:baseline;padding:8px 0;border-bottom:1px dashed var(--line)}\n.pq5g .box .q{font-family:var(--mono);font-size:12px;font-weight:800;color:var(--orange)}\n.pq5g .box .bd{color:var(--mut);font-size:14px}\n.pq5g details{border-bottom:1px solid var(--line);padding:2px 0}\n.pq5g summary{cursor:pointer;list-style:none;padding:13px 26px 13px 0;font-weight:700;font-size:15.5px;position:relative}\n.pq5g summary::-webkit-details-marker{display:none}\n.pq5g summary::after{content:\"+\";position:absolute;right:2px;top:11px;font-family:var(--mono);font-size:20px;color:var(--orange);font-weight:700}\n.pq5g details[open] summary::after{content:\"\\2013\"}\n.pq5g summary .qn{font-family:var(--mono);color:var(--teal);font-size:13px;margin-right:8px}\n.pq5g details .ans{padding:0 0 15px;color:var(--mut);font-size:15px;max-width:66ch}\n.pq5g details .ans p+p{margin-top:8px}\n.pq5g .gallery{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:16px}\n.pq5g .gallery figure{margin:0}\n.pq5g .gallery img{width:100%;height:auto;border:1px solid var(--line);border-radius:10px;display:block;background:#0f1216}\n.pq5g .gallery figcaption{font-size:12.5px;color:var(--mut);margin-top:5px;font-family:var(--mono)}\n.pq5g .legal{font-size:12.5px;color:var(--mut);line-height:1.5;border-top:1px solid var(--line);padding-top:18px;margin-top:8px}\n.pq5g .legal b{color:var(--ink)}\n.pq5g .sig{font-family:var(--mono);font-size:13px;color:var(--mut);text-align:center;padding-top:22px}\n.pq5g .sig a{color:var(--orange);text-decoration:none;font-weight:700}\n@media(max-width:640px){.pq5g .feat,.pq5g .compat,.pq5g .gallery{grid-template-columns:1fr}.pq5g .vs{grid-template-columns:1fr}.pq5g .vsmid{padding:6px 0}.pq5g .tools li{grid-template-columns:1fr}.pq5g h1.name{font-size:28px}}\n\u003c\/style\u003e\n\n\u003c!-- ========== HERO ========== --\u003e\n\u003cdiv class=\"hero\"\u003e\n  \u003cdiv class=\"kicker\"\u003ePINGEQUA · Dual-Band Wi-Fi Lab\u003c\/div\u003e\n  \u003ch1 class=\"name\"\u003e5Ghost WiFi Lab\u003c\/h1\u003e\n  \u003cdiv class=\"sub\"\u003eReal 2.4 + 5 GHz Wi-Fi recon for Flipper Zero. Preloaded. Plug in and go.\u003c\/div\u003e\n  \u003cp class=\"lede\"\u003eAn RTL8720DN (BW16) dual-band board that finally puts the \u003cb\u003e5 GHz radio to work\u003c\/b\u003e — shipped preloaded with the \u003cb\u003e5Ghost WiFi Lab\u003c\/b\u003e app. Dock it on the Flipper GPIO header: no wiring, no flashing, no serial commands. One clean app does the scanning, the handshake capture, the channel mapping, and the captive portal — on both bands.\u003c\/p\u003e\n  \u003cul class=\"feat\"\u003e\n    \u003cli\u003e\n\u003cb\u003eReal 5 GHz.\u003c\/b\u003e Scan, capture, and map a band 2.4-only tools physically can't see.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003ePMF \/ WPA3-aware.\u003c\/b\u003e Flags the APs that ignore deauth — up front, not after you waste time.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eHandshake → PCAP, on device.\u003c\/b\u003e WPA\/WPA2 4-way to SD, crackable in hashcat \/ aircrack-ng.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eChannel Map.\u003c\/b\u003e Dual-band congestion view that points at the clear channel.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eEvil Portal.\u003c\/b\u003e Built-in pages, bundled demos, or your own HTML from the SD card.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eOne \u003ccode\u003e.fap\u003c\/code\u003e, three firmwares.\u003c\/b\u003e Official · Momentum · Unleashed.\u003c\/li\u003e\n  \u003c\/ul\u003e\n  \u003cdiv class=\"cta\"\u003e\n    \u003ca class=\"primary\" href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\/releases\" target=\"_blank\" rel=\"noopener\"\u003eGet the app (.fap) →\u003c\/a\u003e\n    \u003ca class=\"ghost\" href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\" target=\"_blank\" rel=\"noopener\"\u003eSource \u0026amp; docs on GitHub\u003c\/a\u003e\n  \u003c\/div\u003e\n\u003c\/div\u003e\n\n\u003c!-- ========== 01 · ARCHITECTURE ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 01 · How it works\u003c\/div\u003e\n  \u003ch2\u003eA 5 GHz radio, and an app that knows what to do with it.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eTwo halves of one tool — the board does the radio, the Flipper runs the brains.\u003c\/div\u003e\n  \u003cdiv class=\"body\"\u003e\n    \u003cp\u003eYour Flipper Zero has no Wi-Fi radio of its own. 5Ghost adds one — a genuine dual-band RTL8720DN — and drives it entirely from a native Flipper app over the GPIO UART. Nothing runs on a laptop; the Flipper is the host.\u003c\/p\u003e\n    \u003cdiv class=\"diagram\"\u003e\n\u003cspan class=\"t\"\u003eFLIPPER ZERO\u003c\/span\u003e \u003cspan class=\"d\"\u003e— host, 128×64 UI\u003c\/span\u003e\u003cbr\u003e\n  │  \u003cspan class=\"d\"\u003e5Ghost WiFi Lab .fap\u003c\/span\u003e\u003cbr\u003e\n  │\u003cbr\u003e\n  ▼  \u003cspan class=\"d\"\u003eGPIO · UART (TX\/RX) + 5V\/GND\u003c\/span\u003e\u003cbr\u003e\n\u003cspan class=\"o\"\u003eRTL8720DN (BW16)\u003c\/span\u003e \u003cspan class=\"d\"\u003e— preloaded firmware\u003c\/span\u003e\u003cbr\u003e\n  ├─ \u003cspan class=\"t\"\u003e2.4 GHz\u003c\/span\u003e \u003cspan class=\"d\"\u003eradio · 802.11 b\/g\/n\u003c\/span\u003e\u003cbr\u003e\n  └─ \u003cspan class=\"t\"\u003e5 GHz\u003c\/span\u003e   \u003cspan class=\"d\"\u003eradio · 802.11 a\/n\u003c\/span\u003e  ← \u003cspan class=\"o\"\u003ethe part other tools skip\u003c\/span\u003e\n    \u003c\/div\u003e\n    \u003cp\u003eThat GPIO link is the whole install: dock the board, copy one \u003ccode\u003e.fap\u003c\/code\u003e to the SD card, open the app. The board ships with its firmware already flashed.\u003c\/p\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 02 · INSIDE THE APP ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 02 · Inside the app\u003c\/div\u003e\n  \u003ch2\u003eSeven tools, one clean screen.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003ePurpose-built for the 128×64 display — not a wall of serial commands.\u003c\/div\u003e\n  \u003cul class=\"tools\"\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eDual-band Scan\u003c\/span\u003e\u003cspan class=\"td\"\u003eLists 2.4 \u003cb\u003eand 5 GHz\u003c\/b\u003e APs with signal, encryption, \u003cb\u003eprecise PMF\u003c\/b\u003e (capable \/ required), \u003cb\u003eWPA3 detection\u003c\/b\u003e, and same-SSID mesh markers.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eChannel Map\u003c\/span\u003e\u003cspan class=\"td\"\u003eCongestion view across both bands with the least-busy channel highlighted — pick a clear channel, or find where the targets are.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eCapture Handshake\u003c\/span\u003e\u003cspan class=\"td\"\u003eForces a reconnect and grabs the WPA\/WPA2 4-way handshake on \u003cb\u003e5 GHz\u003c\/b\u003e, written as a standard PCAP to SD. Drop straight into hashcat (22000) or aircrack-ng.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eEvil Portal\u003c\/span\u003e\u003cspan class=\"td\"\u003eCaptive-portal credential capture — built-in pages, a few bundled demo portals, or \u003cb\u003eload your own HTML\u003c\/b\u003e from the SD card. Auto-opens on iOS.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003ePMF-aware Deauth\u003c\/span\u003e\u003cspan class=\"td\"\u003eDeauth on 2.4 + 5 GHz that \u003cb\u003etells you\u003c\/b\u003e when a target is 802.11w \/ WPA3-protected (deauth-immune) instead of failing silently. Hits every same-SSID mesh node in one pass.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eCreate AP · Beacon\u003c\/span\u003e\u003cspan class=\"td\"\u003eStand up a real joinable soft AP with the captive portal, or flood custom \/ random \/ Rickroll beacon frames.\u003c\/span\u003e\n\u003c\/li\u003e\n    \u003cli\u003e\n\u003cspan class=\"tn\"\u003eEverything to SD\u003c\/span\u003e\u003cspan class=\"td\"\u003eScans (CSV), captured credentials, and handshakes (PCAP) all save to \u003ccode\u003e\/ext\/apps_data\/5ghost\/\u003c\/code\u003e with on-screen save confirmation.\u003c\/span\u003e\n\u003c\/li\u003e\n  \u003c\/ul\u003e\n  \u003cdiv class=\"gallery\"\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/home.png\" alt=\"5Ghost WiFi Lab home menu on Flipper Zero showing firmware status and tool list\" loading=\"lazy\"\u003e\u003cfigcaption\u003eHome · firmware status + tools\u003c\/figcaption\u003e\u003c\/figure\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/scan-list.png\" alt=\"Dual-band Wi-Fi scan list with lock icon, SSID, RSSI and mesh markers\" loading=\"lazy\"\u003e\u003cfigcaption\u003eScan · 2.4 + 5 GHz, PMF flags\u003c\/figcaption\u003e\u003c\/figure\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/ap-detail.png\" alt=\"Access point detail screen showing encryption, channel, band, MAC and actions\" loading=\"lazy\"\u003e\u003cfigcaption\u003eAP detail · encryption, band, MAC\u003c\/figcaption\u003e\u003c\/figure\u003e\n    \u003cfigure\u003e\u003cimg src=\"https:\/\/raw.githubusercontent.com\/pingequalab\/5ghost-wifi-lab\/main\/assets\/screenshots\/channel-map.png\" alt=\"Channel Map showing 2.4 and 5 GHz band congestion and the best channel\" loading=\"lazy\"\u003e\u003cfigcaption\u003eChannel Map · best channel\u003c\/figcaption\u003e\u003c\/figure\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 03 · WHY 5 GHZ ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 03 · Why 5 GHz changes the game\u003c\/div\u003e\n  \u003ch2\u003eMost Flipper Wi-Fi tools can't see half the air.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eThe popular ESP32 boards have no 5 GHz radio — it's a hardware limit, not a setting.\u003c\/div\u003e\n  \u003cdiv class=\"vs\"\u003e\n    \u003cdiv class=\"col bad\"\u003e\n      \u003cdiv class=\"vlbl\"\u003e2.4 GHz tool · ESP32 \/ Marauder-class\u003c\/div\u003e\n      \u003ch4\u003eHalf the spectrum, blind to the rest\u003c\/h4\u003e\n      \u003cul\u003e\n        \u003cli\u003eNo 5 GHz radio — can't scan or attack modern 5 GHz networks at all\u003c\/li\u003e\n        \u003cli\u003eNo idea which APs are PMF \/ WPA3 deauth-immune — fails silently\u003c\/li\u003e\n        \u003cli\u003eHandshake capture is hit-or-miss on crowded 2.4 GHz\u003c\/li\u003e\n        \u003cli\u003eOften a wall of serial commands or a separate web UI\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n    \u003cdiv class=\"vsmid\"\u003eVS\u003c\/div\u003e\n    \u003cdiv class=\"col good\"\u003e\n      \u003cdiv class=\"vlbl\"\u003e5Ghost · RTL8720DN (BW16)\u003c\/div\u003e\n      \u003ch4\u003eBoth bands, on one board, in one app\u003c\/h4\u003e\n      \u003cul\u003e\n        \u003cli\u003eNative 5 GHz — scan, Channel Map, handshake and deauth all work on 5 GHz\u003c\/li\u003e\n        \u003cli\u003eParses each beacon's RSN IE to flag WPA3-SAE \/ 802.11w up front\u003c\/li\u003e\n        \u003cli\u003eRoutes handshake capture through 5 GHz, where it reliably lands\u003c\/li\u003e\n        \u003cli\u003eOne native Flipper app, three firmwares, nothing to wire\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 04 · QUICK START ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 04 · Quick start\u003c\/div\u003e\n  \u003ch2\u003eThree steps from box to first scan.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eThe board is preloaded — there is nothing to flash.\u003c\/div\u003e\n  \u003col class=\"steps\"\u003e\n    \u003cli\u003e\u003cspan\u003e\u003cb\u003eDock the board.\u003c\/b\u003e Seat the 5Ghost module on your Flipper Zero's GPIO header (top pins). The 4-wire UART link is the only connection.\u003c\/span\u003e\u003c\/li\u003e\n    \u003cli\u003e\u003cspan\u003e\u003cb\u003eCopy the app.\u003c\/b\u003e Download the latest \u003ccode\u003e.fap\u003c\/code\u003e from \u003ca href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\/releases\" target=\"_blank\" rel=\"noopener\"\u003eGitHub Releases\u003c\/a\u003e and drop it on your Flipper SD card under \u003ccode\u003e\/ext\/apps\/GPIO\/\u003c\/code\u003e.\u003c\/span\u003e\u003c\/li\u003e\n    \u003cli\u003e\u003cspan\u003e\u003cb\u003eOpen it.\u003c\/b\u003e On the Flipper, go to \u003ccode\u003eApps → GPIO → 5Ghost WiFi Lab\u003c\/code\u003e. The header shows \u003ccode\u003eOfficial\u003c\/code\u003e when the board is detected — you're live.\u003c\/span\u003e\u003c\/li\u003e\n  \u003c\/ol\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 05 · COMPATIBILITY ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 05 · Compatibility\u003c\/div\u003e\n  \u003ch2\u003eBuilt for one host, runs on every Flipper firmware.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eOne universal \u003ccode\u003e.fap\u003c\/code\u003e — it avoids the APIs the official firmware disables, so it loads cleanly everywhere.\u003c\/div\u003e\n  \u003cdiv class=\"compat\"\u003e\n    \u003cdiv class=\"yes\"\u003e\n      \u003cdiv class=\"clbl\"\u003eVerified on\u003c\/div\u003e\n      \u003cul\u003e\n        \u003cli\u003eFlipper Zero (GPIO \/ UART)\u003c\/li\u003e\n        \u003cli\u003eOfficial firmware\u003c\/li\u003e\n        \u003cli\u003eMomentum firmware\u003c\/li\u003e\n        \u003cli\u003eUnleashed firmware\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n    \u003cdiv class=\"no\"\u003e\n      \u003cdiv class=\"clbl\"\u003eNot a fit for\u003c\/div\u003e\n      \u003cul\u003e\n        \u003cli\u003eOther BW16 \/ RTL8720DN boards — different firmware \u0026amp; pinout, not supported\u003c\/li\u003e\n        \u003cli\u003eESP32 Wi-Fi boards — no 5 GHz radio\u003c\/li\u003e\n        \u003cli\u003eStandalone use — it is a companion module, the Flipper is the host\u003c\/li\u003e\n      \u003c\/ul\u003e\n    \u003c\/div\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 06 · SPECIFICATIONS ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 06 · Specifications\u003c\/div\u003e\n  \u003ch2\u003eThe numbers that matter.\u003c\/h2\u003e\n  \u003ctable class=\"spec\"\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eRadio\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eChipset\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eRTL8720DN (BW16)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eWi-Fi bands\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e2.4 GHz + 5 GHz · 802.11 a\/b\/g\/n\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eBluetooth\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eBLE 5.0\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eAntenna\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eOnboard PCB antenna (compact)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eInterface\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eHost link\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eFlipper Zero GPIO header · UART (TX\/RX) + 5V\/GND\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eForm factor\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eMatches the Flipper Zero footprint — pocketable\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eSoftware\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eModule firmware\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e5Ghost — preloaded (browser re-flash available)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eFlipper app\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e5Ghost WiFi Lab \u003ccode\u003e.fap\u003c\/code\u003e · Official \/ Momentum \/ Unleashed\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eApp license\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eMIT (open-source companion app)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr class=\"grp\"\u003e\u003ctd colspan=\"2\"\u003eIn the box\u003c\/td\u003e\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eIncluded\u003c\/td\u003e\n\u003ctd class=\"v\"\u003e1 × 5Ghost dual-band board (preloaded)\u003c\/td\u003e\n\u003c\/tr\u003e\n    \u003ctr\u003e\n\u003ctd class=\"k\"\u003eNot included\u003c\/td\u003e\n\u003ctd class=\"v\"\u003eFlipper Zero host device (shown for reference)\u003c\/td\u003e\n\u003c\/tr\u003e\n  \u003c\/table\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 07 · FIRMWARE \u0026 RECOVERY ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 07 · Firmware \u0026amp; recovery\u003c\/div\u003e\n  \u003ch2\u003eShips preloaded — recover it from the browser if you ever need to.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eYou won't normally flash anything. This is the safety net, not a setup step.\u003c\/div\u003e\n  \u003cdiv class=\"body\"\u003e\n    \u003cp\u003eThe board leaves the factory with 5Ghost firmware already on it — the only thing you install is the Flipper \u003ccode\u003e.fap\u003c\/code\u003e (see Quick Start). But if the module firmware is ever interrupted mid-update, corrupted, or you simply want to restore it to factory, you can re-flash it from a \u003cb\u003eweb browser\u003c\/b\u003e — no Arduino, no toolchain, no command line.\u003c\/p\u003e\n    \u003col class=\"steps\"\u003e\n      \u003cli\u003e\u003cspan\u003e\u003cb\u003eOpen the recovery flasher.\u003c\/b\u003e Go to \u003ca href=\"https:\/\/flash.pingequa.com\/devices\/bw16-5ghost\" target=\"_blank\" rel=\"noopener\"\u003eflash.pingequa.com\/devices\/bw16-5ghost\u003c\/a\u003e in \u003cb\u003eChrome or Edge\u003c\/b\u003e on a desktop (or Chrome on Android). Safari and Firefox can't flash — they lack the Web Serial API.\u003c\/span\u003e\u003c\/li\u003e\n      \u003cli\u003e\u003cspan\u003e\u003cb\u003eConnect the board.\u003c\/b\u003e Plug the 5Ghost board into your computer with a \u003cb\u003eUSB-C data cable\u003c\/b\u003e, click \u003ccode\u003eConnect\u003c\/code\u003e, and pick the port. If your OS needs it, install the CH340 serial driver.\u003c\/span\u003e\u003c\/li\u003e\n      \u003cli\u003e\u003cspan\u003e\u003cb\u003eFlash.\u003c\/b\u003e Click \u003ccode\u003eFlash\u003c\/code\u003e. It enters download mode automatically; if that ever fails, hold \u003ccode\u003eBOOT\u003c\/code\u003e, tap \u003ccode\u003eRESET\u003c\/code\u003e, release \u003ccode\u003eBOOT\u003c\/code\u003e, and click Connect again. A full image takes a few minutes at 115200 baud — let it finish.\u003c\/span\u003e\u003c\/li\u003e\n    \u003c\/ol\u003e\n    \u003cp style=\"margin-top:12px\"\u003eThe flasher and firmware image are hosted by PINGEQUA; the recovery page always shows the current device-specific steps and status.\u003c\/p\u003e\n    \u003cdiv class=\"cta\"\u003e\u003ca class=\"ghost\" href=\"https:\/\/flash.pingequa.com\/devices\/bw16-5ghost\" target=\"_blank\" rel=\"noopener\"\u003eOpen the browser recovery flasher →\u003c\/a\u003e\u003c\/div\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 08 · HONEST LIMITS ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 08 · Honest limits\u003c\/div\u003e\n  \u003ch2\u003eWhat it can't do — straight talk.\u003c\/h2\u003e\n  \u003cdiv class=\"tag\"\u003eTools that overpromise waste your time and earn refunds. Here's the real boundary.\u003c\/div\u003e\n  \u003cul class=\"limits\"\u003e\n    \u003cli\u003e\n\u003cb\u003eWPA3-SAE can't be cracked offline — by any tool.\u003c\/b\u003e SAE (Dragonfly) is designed so a captured handshake has no offline-crackable hash. No firmware or hardware breaks pure WPA3-SAE. 5Ghost \u003cb\u003edetects\u003c\/b\u003e WPA3 and tells you it's out of reach. (Networks in WPA3 \u003ci\u003etransition\u003c\/i\u003e mode, which still accept WPA2, are a separate advanced path.)\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003ePMF \/ WPA3 APs can't be deauthed.\u003c\/b\u003e That's 802.11w working as designed, on any tool. 5Ghost's value is that it \u003cb\u003etells you\u003c\/b\u003e instead of letting you guess.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eMesh roaming is hard.\u003c\/b\u003e Same-channel mesh nodes are hit in one pass; cross-channel 802.11r roaming is difficult to fully suppress on single-radio hardware. No tool truly solves this.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eHandshake capture runs on 5 GHz.\u003c\/b\u003e On 2.4 GHz this chip often can't hear the client's uplink — so capture uses 5 GHz, which is exactly what dual-band hardware is for.\u003c\/li\u003e\n    \u003cli\u003e\n\u003cb\u003eAndroid captive auto-open\u003c\/b\u003e can be blocked by Private DNS \/ DoH; the portal still appears when the user opens any HTTP page.\u003c\/li\u003e\n  \u003c\/ul\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== 09 · FAQ ========== --\u003e\n\u003csection\u003e\n  \u003cdiv class=\"sechead\"\u003e\/\/ 09 · FAQ\u003c\/div\u003e\n  \u003ch2\u003eReal questions, straight answers.\u003c\/h2\u003e\n  \u003cdiv class=\"body\" style=\"margin-top:8px\"\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.01\u003c\/span\u003eDoes it really do 5 GHz, or is that just marketing?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eReally. The RTL8720DN (BW16) has a native 5 GHz radio, so 5Ghost scans, maps congestion, captures handshakes, and deauths on 5 GHz — not just 2.4. The popular ESP32-based Flipper Wi-Fi tools \u003ci\u003ecan't\u003c\/i\u003e do this, because their chip has no 5 GHz radio at all.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.02\u003c\/span\u003eDo I have to flash firmware or wire anything?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eNo. The board ships \u003cb\u003epreloaded\u003c\/b\u003e with 5Ghost firmware. You dock it on the Flipper GPIO header and copy one \u003ccode\u003e.fap\u003c\/code\u003e file to the SD card — that's the entire setup. No soldering, no jumper wires, no toolchain. If the module firmware is ever corrupted, it can be re-flashed from a web browser over USB.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.03\u003c\/span\u003eWhich Flipper Zero firmwares does it work on?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eAll three major firmwares: \u003cb\u003eOfficial\u003c\/b\u003e, \u003cb\u003eMomentum\u003c\/b\u003e, and \u003cb\u003eUnleashed\u003c\/b\u003e. It's a single universal \u003ccode\u003e.fap\u003c\/code\u003e build — it deliberately avoids the APIs the official firmware disables, so it loads cleanly on each one with no separate version to pick.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.04\u003c\/span\u003eCan it crack WPA3?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eNo — and neither can any other tool, offline. WPA3-SAE is designed so a captured handshake carries no crackable hash. 5Ghost \u003cb\u003edetects\u003c\/b\u003e WPA3 and labels it as out of reach instead of pretending otherwise. For WPA\/WPA2 networks, it captures the 4-way handshake to a standard PCAP you can run through hashcat or aircrack-ng on your own machine.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.05\u003c\/span\u003eOnboard antenna or 8 dBi external — which should I buy?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eSame board, same firmware, same app — only the antenna differs. The \u003cb\u003eonboard PCB antenna\u003c\/b\u003e (this listing) keeps the compact Flipper footprint for everyday pocket use. The \u003cb\u003e8 dBi external-antenna version\u003c\/b\u003e trades size for range — better for long-range survey and capture. Pick by whether you want pocketability or reach.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.06\u003c\/span\u003eDoes it work on its own, without a Flipper Zero?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eNo. It's a companion module: the Flipper Zero is the host that runs the app and the screen. The Flipper is not included in this listing.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.07\u003c\/span\u003eCan I use my own captive-portal page?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eYes. Drop any self-contained \u003ccode\u003e.html\u003c\/code\u003e file on the Flipper SD card and serve it through the Evil Portal tool. A few playful demo portals come bundled with the app, and the built-in pages are there too.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.08\u003c\/span\u003eMy deauth didn't work on some networks — is it broken?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eAlmost certainly not. Those networks are PMF (802.11w) or WPA3 protected, which makes them immune to deauth \u003ci\u003eby design\u003c\/i\u003e — on every tool, not just this one. 5Ghost flags those APs in the scan list so you know up front instead of guessing.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.09\u003c\/span\u003eIs this legal to use?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eThe device is sold for \u003cb\u003eauthorized security testing and education\u003c\/b\u003e. Testing networks you don't own or have written permission to test is illegal in most countries. You are responsible for using it lawfully and for complying with local radio regulations. See the note below.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n    \u003cdetails\u003e\u003csummary\u003e\u003cspan class=\"qn\"\u003eQ.10\u003c\/span\u003eHow do I restore the firmware if the board stops responding?\u003c\/summary\u003e\n      \u003cdiv class=\"ans\"\u003e\u003cp\u003eUse the browser recovery flasher at \u003ca href=\"https:\/\/flash.pingequa.com\/devices\/bw16-5ghost\" target=\"_blank\" rel=\"noopener\"\u003eflash.pingequa.com\/devices\/bw16-5ghost\u003c\/a\u003e. Open it in Chrome or Edge, connect the board with a USB-C data cable, then click Connect and Flash — it re-installs the factory 5Ghost firmware in a few minutes, with no Arduino or toolchain. See the \u003cb\u003eFirmware \u0026amp; recovery\u003c\/b\u003e section above for the full steps.\u003c\/p\u003e\u003c\/div\u003e\n    \u003c\/details\u003e\n  \u003c\/div\u003e\n\u003c\/section\u003e\n\n\u003c!-- ========== LEGAL ========== --\u003e\n\u003cdiv class=\"legal\"\u003e\n  \u003cb\u003eFor authorized security testing, network administration, and education only.\u003c\/b\u003e Only test networks and devices you own or have explicit written permission to test. Unauthorized interception or disruption of networks is illegal in most jurisdictions. End users are solely responsible for compliance with all applicable laws and radio regulations — \u003cb\u003eFCC Part 15\u003c\/b\u003e (US), \u003cb\u003eCE \/ RED\u003c\/b\u003e (EU), and local equivalents. Sold as-is, with no warranty. \"Flipper Zero\" is a trademark of Flipper Devices Inc.; this is an independent companion product and is not affiliated with or endorsed by Flipper Devices.\n\u003c\/div\u003e\n\n\u003cdiv class=\"sig\"\u003ePINGEQUA · \u003ca href=\"https:\/\/pingequa.com\" target=\"_blank\" rel=\"noopener\"\u003epingequa.com\u003c\/a\u003e · \u003ca href=\"https:\/\/github.com\/pingequalab\/5ghost-wifi-lab\" target=\"_blank\" rel=\"noopener\"\u003egithub.com\/pingequalab\/5ghost-wifi-lab\u003c\/a\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n","brand":"PINGEQUA","offers":[{"title":"Default Title","offer_id":40834825748544,"sku":"FZ-BW16-ANT","price":39.98,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0595\/6753\/8240\/files\/6a862da9f8258514d9a0216b8102ea51.jpg?v=1774431139","url":"https:\/\/www.pingequa.com\/products\/flipper-zero-5ghost-antenna","provider":"PINGEQUA","version":"1.0","type":"link"}