> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/wifi-pineapple-pager/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/wifi-pineapple-pager/alert-payloads.md).

# Alert Payloads

Alerts on the WiFi Pineapple Pager are generated by *alert payloads*, small easy-to-write scripts which react to events.

Alerts offer a fast way to display events on your device or fire off more complex behavior in the background.

### Adding alert payloads  <a href="#adding-alert-payloads" id="adding-alert-payloads"></a>

Alert payloads are placed in the `/root/payloads/alerts/` directory in the appropriate category:

| Catgory                         | Description                                                                                                                                                                                                                                              |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| deauth\_flood\_detected         | Recon detected a flood of deauthentication packets. A small amount of deauthentication/disassocation is normal as clients move between networks, but a flood of these packets can indicate a denial-of-service attack.                                   |
| handshake\_captured             | A WPA-PSK or WPA2-PSK handshake has been captured. Handshakes can be found in `/root/loot/handshakes/` and can be used for offline attacks against a WPA-PSK network. Learn more [about handshakes here](/wifi-pineapple-pager/handshake-collection.md)! |
| pineapple\_client\_connected    | A client connected to a WiFi Pineapple access point (such as open or WPA)                                                                                                                                                                                |
| pineapple\_client\_disconnected | A client disconnected from a WiFi Pineapple access point                                                                                                                                                                                                 |

### Running alert payloads  <a href="#running-alert-payloads" id="running-alert-payloads"></a>

Alert payloads are automatically triggered when an event happens in the recon system.

All enabled alerts in a category are run when an event occurs.

### Controlling alerts  <a href="#controlling-alerts" id="controlling-alerts"></a>

Alerts can be listed, enabled, and disabled from the Alerts category of the dashboard.

Each alert payload can be individually enabled or disabled. Disabled payloads will not be run.

### Developing alert payloads  <a href="#developing-alert-payloads" id="developing-alert-payloads"></a>

Alert payloads are bash scripts with DuckyScript commands: Learn more about [developing payloads](/wifi-pineapple-pager/payloads-1/speedrunning-payload-dev.md) and [how alert payloads work](/wifi-pineapple-pager/alert-payloads.md).

<figure><img src="/files/17WWUGnxSpLC1v1ptGtC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/VKRIuMnEvVjVHvn65X1n" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/W5efpvbMluXeuqjfw2mJ" alt=""><figcaption></figcaption></figure>

<br>