I was trying to make a small useragent collector script that goes like this
1- get the clients from other aps connected to our pineapple using deauth/karma2- grab their user agent from their connection requests(apps and sevices ) or using a captive portal page to get it faster3- store their (device name - mac address - useragent - and the network name that they was connected to or their ssids prob requests ) in a db
or in more details :
1- the same steps as evil twin scripts [ print the available wifi adapters to choose from then ask if they want to scan all channels or a specific channel then after the scan is ended using ctrl + c allow them to choose from the ap list with of course every ap that have clients on it should have a star in the start of the line]   (this what i missing currently i think the rest would be easy)
2- after a network is chosen we log its clients mac address in a file
3- we use probequest -m command with the clients mac file to grab their probes only not other aps .... and for sure mdk3 should be running in the back ground on the ap so the clients devices send probe requests of the saved networks
4- the script then uses the collected probes to launch fake aps so we get the clients to auto connect (karma)
5-   when they auto connect the captive portal pops up and logs the useragent of the device to a txt file with the network name where they came from + client mac address . the page should auto close when fully load and the client gets kicked out the network and maybe black listed
6- there should be an option to automate the process on all available APs with clients or give the user the option to select the network he wants.
7- maybe an passive mode which will be just karma and the captive portal so it targets the unassociated devices only.
the reason i said we collect the clients MACs is so we can collect probes from an specific ap clients only so we can launch the attack on specific APs.
this the most organized way i could think of doing it.