# 🍍📟 Payloads: Alerts - WiFi Pineapple Pager

Source: https://www.youtube.com/watch?v=tmDMbpnVJd4
Recap page: https://rapidrecap.app/video/tmDMbpnVJd4
Generated: 2025-12-19T18:32:04.385+00:00

---
## Quick Overview

The video demonstrates how to create and implement custom alert payloads for the WiFi Pineapple Pager using Bash shell scripts, showing that these scripts can be placed in specific directory structures (like /payloads/alerts/pineapple_client_connected/example/) and can execute arbitrary commands, such as running 'nmap' or 'FIND_CLIENT_IP', when a corresponding event like a client connection occurs.

**Key Points:**
- The video focuses on customizing WiFi Pineapple Pager alerts using Bash shell scripts located in the official payload repository at hak5.org/pager-payloads.
- Alert payloads are categorized by event type, such as 'deauth_flood_detected', 'handshake_captured', and 'pineapple_client_connected'.
- The structure for custom alerts involves creating a directory named after the alert type (e.g., 'pineapple_client_connected') and placing an executable shell script named 'payload.sh' inside it.
- The custom payload script can utilize internal variables (like $ALERT_CLIENT_CONNECTED_SUMMARY or $ALERT_CLIENT_CONNECTED_MAC_ADDRESS) to generate dynamic alert messages.
- The presenter demonstrates creating an 'example' directory within the 'pineapple_client_connected' alert structure and placing a custom 'payload.sh' inside it.
- The custom payload demonstrates executing external commands like 'FIND_CLIENT_IP [mac] [timeout]' to get information about a connected client.
- The presenter notes that directory names starting with an all-caps underscore, like 'DISABLED.example', will prevent the payload from executing.

![Screenshot at 00:06: The virtual Pager interface displays an active 'ALERTS' screen showing four active alert categories, including 'New Client Connected', demonstrating the device's real-time monitoring capabilities.](https://ss.rapidrecap.app/screens/tmDMbpnVJd4/00-00-06.png)

**Context:** This video serves as a technical demonstration and tutorial focused on extending the functionality of the Hak5 WiFi Pineapple Pager device through custom alert payloads. The Pager is a portable hardware device used for monitoring nearby Wi-Fi activity, and its alerts can be customized via scripts to execute specific actions or commands when certain network events are detected, such as a new device connecting to the Pineapple's access point.

## Detailed Analysis

The video explains how users can create custom alert payloads for the WiFi Pineapple Pager using Bash shell scripts, referencing the official payload repository hosted on GitHub (hak5/wifi-pineapple-pager-payloads). The presenter navigates the directory structure, showing that alerts are categorized (e.g., 'deauth_flood_detected', 'pineapple_client_connected'), and custom actions require placing an executable script named 'payload.sh' within a corresponding, specifically named directory. The demonstration focuses on the 'pineapple_client_connected' event, where the presenter creates an 'example' directory and populates it with a custom 'payload.sh'. This script utilizes internal variables like $ALERT_CLIENT_CONNECTED_SUMMARY to generate descriptive alerts and also executes external commands, such as 'FIND_CLIENT_IP [mac] [timeout]', to actively gather information about the connecting client. The presenter shows that simply having a directory name start with 'DISABLED.' (like 'DISABLED.example') prevents the script from running. The video confirms that when a simulated client connects to the Pineapple's AP ('Nestin_Guest'), the customized alert triggers, displaying the human-readable summary generated by the payload, thus proving the custom scripting functionality works.

### Payload Structure and Location

- Alert payloads reside in the /payloads directory
- Subdirectories are named after alert types (e.g., 'alerts/pineapple_client_connected')
- Custom actions go into a 'payload.sh' script within a sub-directory like 'example'

### Custom Alert Logic

- Payloads use Bash scripts to execute actions when an event occurs
- Internal variables (e.g., $ALERT_CLIENT_CONNECTED_MAC_ADDRESS) populate the alert message
- Directory names starting with 'DISABLED.' prevent execution

### Demonstration of Execution

- The presenter creates a 'payload.sh' in a 'example' directory for the 'pineapple_client_connected' event
- The script executes the 'FIND_CLIENT_IP' command using the client's MAC address parameter
- When a client connects, the Pager displays the custom alert summary generated by the script

![Screenshot at 00:01: The presenter holding the yellow WiFi Pineapple Pager device while explaining the concept of alert payloads.](https://ss.rapidrecap.app/screens/tmDMbpnVJd4/00-00-01.png)
![Screenshot at 00:09: The virtual Pager display shows the Alerts screen listing four categories: Evil AP Auth Captured, Deauth Flood Detected, New Client Connected, and Handshake Captured.](https://ss.rapidrecap.app/screens/tmDMbpnVJd4/00-00-09.png)
![Screenshot at 00:53: The GitHub repository page for the WiFi Pineapple Pager Payloads is displayed, showing the directory structure including 'alerts' and 'user'.](https://ss.rapidrecap.app/screens/tmDMbpnVJd4/00-00-53.png)
![Screenshot at 01:10: The contents of a client connection example payload script \(payload.sh\) are shown in a terminal/editor, detailing available internal variables like $ALERT\_CLIENT\_CONNECTED\_SUMMARY.](https://ss.rapidrecap.app/screens/tmDMbpnVJd4/00-01-10.png)
![Screenshot at 06:08: The Pager screen shows the custom alert triggered, displaying a blue dialogue box reading: 'client 4E:D0:36:06:44:EC connected to SSID Nestin\_Guest'.](https://ss.rapidrecap.app/screens/tmDMbpnVJd4/00-06-08.png)