> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/wifi-pineapple-pager/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/wifi-pineapple-pager/payloads-1/recon-payloads.md).
# Recon Payloads
Recon payloads are run from the Pager UI after selecting an access point or client from the Pineapple Recon device list.
Recon payloads add new features and actions for discovered devices.
### Recon environment
The Pineapple Recon system collects a large amount of data about the wireless environment.
This data is shared with a recon payload via [environment variables](/wifi-pineapple-pager/payloads-1/speedrunning-payload-dev.md#variables). Environment variables are accessible in a payload by name, such as `${_RECON_SELECTED_AP_CHANNEL}`
**All payloads**
All recon payloads have basic data - such as the directory the payload is installed - added to the environment.
| Variable | Payload | Description |
| ------------- | ------- | ---------------------------------------- |
| PAYLOAD\_HOME | All | Directory where the payload is installed |
**Access point payloads**
When a recon payload is run for a selected access point, all available data from the access point is included:
| Variable | Payload | Description |
| --------------------------------------- | ------------ | ------------------------------------------------------------------- |
| \_RECON\_SELECTED\_AP\_OUI | Access point | OUI / Manufacturer name |
| \_RECON\_SELECTED\_AP\_BEACONED\_SSIDS | Access point | Number of beaconed SSIDs |
| \_RECON\_SELECTED\_AP\_PROBED\_SSIDS | Access point | Number of probed SSIDs (if AP has also acted like a client) |
| \_RECON\_SELECTED\_AP\_RESPONDED\_SSIDS | Access point | Number of responded SSIDs |
| \_RECON\_SELECTED\_AP\_SSID | Access point | Primary SSID (UTF-8) |
| \_RECON\_SELECTED\_AP\_HIDDEN | Access point | Is SSID hidden / decloaeked |
| \_RECON\_SELECTED\_AP\_CHANNEL | Access point | Advertised channel of AP |
| \_RECON\_SELECTED\_AP\_ENCRYPTION\_TYPE | Access point | Advertised encryption of AP |
| \_RECON\_SELECTED\_AP\_CLIENT\_COUNT | Access point | Number of detected clients on AP |
| \_RECON\_SELECTED\_AP\_BEACONED\_SSID | Access point | Primary beaconed SSID |
| \_RECON\_SELECTED\_AP\_PROBED\_SSID | Access point | Primary probed SSID |
| \_RECON\_SELECTED\_AP\_RESPONDED\_SSID | Access point | Primary probe response SSID |
| \_RECON\_SELECTED\_AP\_MAC\_ADDRESS | Access point | MAC address of AP |
| \_RECON\_SELECTED\_AP\_BSSID | Access point | MAC address of AP |
| \_RECON\_SELECTED\_AP\_TIMESTAMP | Access point | Time the AP was first seen |
| \_RECON\_SELECTED\_AP\_RSSI | Access point | Signal of AP |
| \_RECON\_SELECTED\_AP\_FREQ | Access point | Frequency |
| \_RECON\_SELECTED\_AP\_PACKETS | Access point | Number of packets as human-readable unit suffixes (100kK 100M, etc) |
**Wi-Fi client payloads**
A Wi-Fi client payload is given the data about the selected access point, as well as the data about the selected client:
| Variable | Payload | Description |
| ------------------------------------------- | ------- | --------------------------------------------------------------- |
| \_RECON\_SELECTED\_CLIENT\_OUI | Client | OUI / Manufacturer name lookup |
| \_RECON\_SELECTED\_CLIENT\_BEACONED\_SSIDS | Client | Number of beaconed SSIDs (if client has also acted as an AP) |
| \_RECON\_SELECTED\_CLIENT\_PROBED\_SSIDS | Client | Number of probed SSIDs |
| \_RECON\_SELECTED\_CLIENT\_RESPONDED\_SSIDS | Client | Number of responded SSIDs (if client has also acted as an AP) |
| \_RECON\_SELECTED\_CLIENT\_BEACONED\_SSID | Client | Primary beaconed SSID (if client has also acted as an AP) |
| \_RECON\_SELECTED\_CLIENT\_PROBED\_SSID | Client | Primary probed SSID |
| \_RECON\_SELECTED\_CLIENT\_RESPONDED\_SSID | Client | Primary probe response SSID (if client has also acted as an AP) |
| \_RECON\_SELECTED\_CLIENT\_MAC\_ADDRESS | Client | MAC address of client |
| \_RECON\_SELECTED\_CLIENT\_TIMESTAMP | Client | Time the client was first seen |
| \_RECON\_SELECTED\_CLIENT\_RSSI | Client | Signal of client |
| \_RECON\_SELECTED\_CLIENT\_FREQ | Client | Frequency |
| \_RECON\_SELECTED\_CLIENT\_PACKETS | Client | Number of packets as human-readable unit suffixes |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://documentation.hak5.org/wifi-pineapple-pager/payloads-1/recon-payloads.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.