Please sign in to access this page

PiFi

PiFi Used AI

33 devlogs
55h 18m
•  Ship certified
Created by Gabrijel

🔓 PiFi: The Ultimate Pocket-Sized Wi-Fi Pentesting Toolkit for Hackers & Makers!

Turn your Raspberry Pi Zero 2 W into a powerful wireless hacking gadget — all with one command. PiFi is a lightweight firmware that transforms your Pi into a portable pentesting tool capable of:

💥 Deauthing devices off networks

🎭 Running an Evil Twin access point

🕵️‍♂️ DNS + ARP spoofing for MITM

📡 Scanning for nearby networks & clients

🌐 All through a sleek Flask-based web UI

Whether you're a CTF warrior, infosec student, or just a curious hacker, PiFi gives you a tactical edge — in your pocket.

✨ Why PiFi?

Zero setup headaches — one-line install

Built specifically for the Pi Zero 2 W

Runs headless, boots into attack mode

100% open-source and modular

🔥 Think Kali, but tiny — and built for your hoodie pocket.

Timeline

Ship 1

0 payouts of shell 0 shells

Gabrijel

11 days ago

Gabrijel Covers 33 devlogs and 55h 18m

I am ready to commit first ship and also made pifi to connect to network PiFi on boot with wlan0 so you can control it, also wrote installer script and wrote better readme, the same with project description.

Update attachment

Now when someone connects they will automaticly get redirected to the captive portal (thats a captive portal), and also when someone tries to access http web site they will get greated with that login, after that they can browse and use http websites like nothing happened, also the good thing is that they have internet access all the time so its less suspicius.

Update attachment

Finally coded out the backend, I am using socketIO so I can update web UI in real time, also tested it and it works

Update attachment

I fixed the DHCP server issue, the problem was in handling dnsmasq as a process.

Update attachment

I finally added internet connection feature, now when client tries to visit http web site he will be redirected to captive portal, and all of this time he will have internet connection which helps with captive portal detection (now its more sneaky and looks more legit). While doing this I found out that i have problem with starting this script two times in a row and now I am fixing that.

Update attachment

I finally made captive portal work, now when someone tries to visit http web site they will be greeted by captive portal. In future i will probably make this captive portal also work with giving internet connection to the user after filling out the form and I will add this same thing but for https

Update attachment

I found out that I have a big issue with captive portal when I restart it without rebooting the whole pi, also found out that I will need to make captive portal with whole different approach.

Update attachment

I finally implemented captive portal to the evil twin. Now when someone tries to visit some web page via http or https they will first get greated with captive portal that is like a google login page

Update attachment

After 3 and a half hours I finally made a choice that i will use wlan1 for all sorts of attacks and all sorts of scanning. ive adjusted firmware to that and now wlan0 is used for control over rpi, while wlan1 is for attacks and scans. All of those features work and also added a feature to change to which AP is wlan1 connected to.

Update attachment

I finally found out why i couldnt connect my pi to other networks. Whole time a was trying to do that with wpa_supplicant, but my pi was using NetworkManager. Also started working on settings tab.

Update attachment

so I connected backend and the script for creation of evil twin. Tested it and it works, now i am implementing a feature to change name of evil twin and password (if evil twins network isnt opened).

Update attachment

started coding out the evil twin. Just found out that hostapd and dnsmasq should run async

Update attachment

so i created evil twin part of the page. Also (finally) configured rpi to broadcast AP through wifi adapter.

Update attachment

now arp poisoning is complete, it redirects traffic to the actuall gateway

Update attachment

I finally seted up my kali machine to host an AP, and i also tested my ARP poisoning on vuln gateway (kali machine) and on vuln host (other rpi) and it worked

Update attachment

now also arp poisoning works

Update attachment

Done some polishing of GUI, also started working on ARP poisoning MiTM attack.

Update attachment

i added a feature to deauth a single client, i used scapy

Update attachment

Now it can also verify encription type of nearby network

Update attachment

Now i also get BSSID of APs

Update attachment

I found a bug, it was a typo...

Update attachment

Now it can scan for local hosts on local networks

Update attachment

finally found my wifi adapter and finally automated setting up that adapter into monitor mode

Update attachment

started with AP attacks, currently implementing deauth for single host

Update attachment

i fixed vuln scanning

Update attachment

I added some features

Update attachment

Added a few more features

Update attachment

just added a first button(automated feature).

Update attachment

I finished it. Now this shell acts like a real bash shell.

Update attachment

currently upgrading terminal for tools like airmon-ng and nmap.

Update attachment

the terminal is working!!!

Update attachment

I started implementing terminal

Update attachment

Started making web page. I am using flask for backend managment. Also implemented host discovery and also installed airmon-ng, nmap, wireshark

Update attachment