5Ghost 2.6.0-beta: dual-band Wi-Fi, clientless PMKID and PMF detection on the Flipper Zero
5Ghost WiFi Lab is a dual-band 2.4 / 5 GHz Wi-Fi research tool for the Flipper Zero, built on the Realtek RTL8720DN (BW16) radio. It pairs a native Flipper app with a preloaded companion board, so a Flipper — which has no Wi-Fi radio of its own — gains real 5 GHz scanning, WPA/WPA2 handshake capture and clientless PMKID capture (beta), PMF / WPA3 detection, and BLE reconnaissance. This is the 2.6.0-beta release; below is what it does, what changed, and an honest comparison with the popular ESP32 firmwares.
Quick answer. Most Flipper Wi-Fi add-ons run on an ESP32, and the classic ESP32 parts have no 5 GHz radio. 5Ghost uses the natively dual-band RTL8720DN instead, and focuses on the things that are hard on single-band or ESP32 hardware: reliable 5 GHz captures, knowing which access points are deauth-immune, and a general BLE scanner a bare Flipper can't offer. For authorized testing and education only.
What is 5Ghost WiFi Lab?
5Ghost is two parts working together:
- A board — a Realtek RTL8720DN (BW16) dual-band module that docks on the Flipper Zero's GPIO header and does the radio work. PINGEQUA boards ship preloaded, so there's nothing to flash.
- A native Flipper app — a single
.fapthat drives the board over UART and presents everything on the Flipper's 128×64 screen. One build runs on Official, Momentum and Unleashed (API 87.1).
The point of the RTL8720DN is that it is genuinely dual-band. Modern routers push most traffic to 5 GHz, and a 2.4 GHz-only tool is blind to that half of the spectrum. On 5Ghost, 5 GHz isn't a checkbox — scanning, channel mapping, handshake capture and deauth all work on both bands.
What's new in 2.6.0-beta
Clientless PMKID capture (beta). 5Ghost can now capture a WPA/WPA2 PMKID by associating to the access point itself (AUTHPROBE), instead of waiting for a client to connect and produce a 4-way handshake. It includes an on-device target picker across 2.4 + 5 GHz, a capture-quality gate before it claims success, and exports both a .22000 file (hashcat mode 22000) and a .json capture record. It is marked beta: the capture-to-hash pipeline is verified offline, but live-AP end-to-end validation is still ongoing, so treat PMKID results as experimental.
Multi-SSID beacon generation. 5Ghost can emit multiple named / multi-BSSID beacons for lab work and for testing detectors.
Carried over from 2.5.0-beta: Wi-Fi station recon (list clients associated to an AP, targeted deauth, focused handshake capture on 2.4 + 5 GHz) and BLE recon with multi-round accumulation and cross-scan de-duplication.
The dual-band difference — stated precisely
It would be easy, and wrong, to say "only 5Ghost does 5 GHz." Here is the accurate 2026 picture:
- The classic ESP32 / S2 / S3 / C3 / C6 have no 5 GHz radio. On that hardware, Marauder, Bruce and GhostESP are 2.4 GHz only — a firmware can't add a radio the silicon doesn't have.
- Espressif's ESP32-C5 (dual-band Wi-Fi 6, 2024) does have a 5 GHz radio. GhostESP documents 5 GHz scan and deauth on the C5, and Marauder runs on C5 modules such as Apex 5 — but 5 GHz attacks are still early, with deauth crashes and no-ops tracked in those projects' own issue trackers.
- There are also add-on modules like Double Barrel 5G that reach 5 GHz using the same RTL8720DN chip 5Ghost uses.
So 5 GHz is no longer exclusive to any one tool. What 5Ghost concentrates on is 5 GHz link reliability — for example, routing WPA/WPA2 handshake capture through 5 GHz, where this class of chip can actually hear the client's uplink frames — plus PMF / WPA3 awareness and a BLE scanner, on one preloaded board.
How 5Ghost compares
5Ghost is a preloaded board + native Flipper app; the three tools below are firmwares you flash onto ESP32 hardware you supply. All are legitimate projects with active communities.
| Capability | 5Ghost (RTL8720DN) | ESP32 Marauder | Bruce | GhostESP |
|---|---|---|---|---|
| Latest version (2026-07) | 2.6.0-beta | v1.14.0 | 1.16 | v2.0 |
| 5 GHz scan | ✅ native | C5 hardware only | C5, experimental | C5 hardware only |
| 2.4 GHz toolkit | ✅ | ✅ mature | ✅ | ✅ |
| Handshake → PCAP | ✅ (5 GHz routed) | ✅ | ✅ | ✅ |
| Clientless PMKID (self-associate) | ✅ beta | — passive / deauth | — none | — passive |
| PMF / WPA3 deauth-immunity flagged | ✅ | — | — | ✅ (on C5 / C6) |
| BLE scan + tracker / Flipper detect | ✅ | ✅ | ✅ | ✅ |
| Native Flipper app | ✅ purpose-built | via companion FAP | — standalone (M5 / CYD) | ✅ companion app |
| Ships preloaded, no flashing | ✅ | — | — | — |
| License | app MIT · fw closed | MIT | AGPL-3.0 | GPL-3.0 |
PMKID nuance: Marauder and GhostESP can obtain a PMKID, but by passive sniffing or by deauthing an existing client — not by self-associating; Bruce has no dedicated PMKID feature. 5Ghost's clientless PMKID actively associates (AUTHPROBE) to elicit the AP's PMKID with no client present, and is marked beta.
What it honestly can't do
A comparison is only useful if it's straight about what nothing in this category can do:
- WPA3-SAE can't be cracked offline — by any tool. SAE (Dragonfly) is designed so a captured handshake has no offline-crackable hash. 5Ghost detects WPA3 and says it's out of reach rather than pretending otherwise.
- PMF / WPA3 access points can't be deauthenticated. That's 802.11w working as designed, on every tool. The value 5Ghost adds is flagging those APs up front.
- Clientless PMKID is beta, and PMKID only exists on APs that include it in their first EAPOL message — it's not universal.
- Mesh roaming is hard for any single-radio device.
FAQ
Can a Flipper Zero do 5 GHz Wi-Fi? Not on its own — the Flipper has no Wi-Fi radio, and the common ESP32 add-on boards (ESP32, S2, S3, C3, C6) are 2.4 GHz only. 5Ghost adds real 5 GHz with a dual-band Realtek RTL8720DN (BW16) board. Since 2024, ESP32-C5 boards can also do 5 GHz, so 5 GHz is no longer unique to one tool.
What is clientless PMKID capture? It grabs a WPA/WPA2 PMKID by associating to the AP (AUTHPROBE) instead of waiting for a client handshake, then exports a hashcat mode-22000 file. In 2.6.0-beta it's marked beta: the capture-to-hash path is verified offline; live-AP end-to-end validation is ongoing.
Can 5Ghost crack WPA3? No, and neither can any other tool offline. WPA3-SAE is designed so a captured handshake carries no offline-crackable hash. 5Ghost detects WPA3 / PMF and tells you it's out of scope.
Can a bare Flipper Zero scan Bluetooth LE? No. Flipper's official firmware doesn't expose a general BLE scanner to third-party apps (feature request #2906 is closed, unimplemented). 5Ghost's BW16 radio does the BLE sweep — advertisers, Find My / AirTag trackers, nearby Flipper Zeros, and vendor names.
Which Flipper firmware does it need? One universal .fap runs on Official, Momentum and Unleashed (API 87.1).
Get 5Ghost
The 5Ghost app is on GitHub (MIT-licensed .fap). PINGEQUA boards ship preloaded; if a board's module firmware is ever corrupted, you can re-flash it right here — see Flash 5Ghost on the BW16. For a feature-by-feature look at the ESP32 firmwares, see which firmware should I flash?.
Sources (accessed 2026-07-26): ESP32 Marauder v1.14.0 (MIT) · Bruce 1.16 (AGPL-3.0) · GhostESP v2.0 (GPL-3.0) and C5 5 GHz docs · ESP32-C5 dual-band Espressif · Double Barrel 5G (RTL8720DN) HoneyHoneyTeam · Flipper Wi-Fi Dev Board (ESP32-S2) developer.flipper.net · Flipper BLE-scanner limitation issue #2906.
For authorized security testing and education only. Test only networks and devices you own or have explicit written permission to test. You are responsible for compliance with all applicable laws and radio regulations (e.g. FCC Part 15 in the US). "Flipper Zero", "ESP32", "ESP32 Marauder", "Bruce" and "GhostESP" are referenced for compatibility and comparison; PINGEQUA is independent and not affiliated with or endorsed by their respective owners.