A wireless-protocol security research platform built on the ESP32. It captures, analyzes, and replays signals across infrared, RFID/NFC, sub-GHz, WiFi, and BLE to study how insecure or legacy protocols fail — replay attacks, unauthenticated card cloning, fixed-code RF, and wireless recon.
Built as a hands-on complement to offensive-security practice (HTB / vulnerability research), the focus is protocol depth: Wiegand, MIFARE Classic, consumer IR encodings, and OOK/ASK sub-GHz. Not a polished consumer gadget — a research bench where each attack surface is a separate, inspectable module.
⚠️ Authorized testing only. This toolkit is for security research and testing against hardware you own or are explicitly permitted to test. See docs/LEGAL.md.
Each capability is framed by its security relevance and its honest limits — the toolkit deliberately does not attempt attacks that require breaking modern cryptography.
| Surface | Research use | Honest limit |
|---|---|---|
| Infrared | Capture/replay of consumer IR (NEC / SIRC / RC5 / Samsung). Replay-attack study on TV/AC/projector control. | Line-of-sight; range limited until IR driver stage added. |
| RFID / NFC | 125 kHz + MIFARE Classic read/clone research; Wiegand & UID study. | Unencrypted / unauthenticated sectors only — no encrypted-sector key cracking. |
| Sub-GHz | Fixed-code OOK/ASK capture + replay of legacy remotes (e.g. old garage/gate). | Not rolling-code. Blocked until CC1101 transceiver acquired. |
| WiFi | Deauthentication, evil-portal, recon (ESP32 built-in radio). | 2.4 GHz only. |
| BLE | Advertisement spam, scanning, BLE-HID study (built-in radio). | USB-side BadUSB out of scope — this board has no native USB. |
| Module | State |
|---|---|
| Infrared capture/replay | Buildable now — next up |
| RFID/NFC (PN532) | Buildable now |
| WiFi / BLE | Buildable now (no extra hardware) |
| Sub-GHz | Blocked — pending CC1101 transceiver |
Classic ESP32 (ESP-WROOM-32) with a modular, per-capability firmware approach — one focused build per attack surface, kept independently inspectable rather than fused into one opaque firmware. Hardware, wiring, and pin maps live in docs/HARDWARE.md.
- docs/ARCHITECTURE.md — firmware model, tool/library stack, data flow
- docs/HARDWARE.md — platform, bill of materials, pin map, power
- docs/ROADMAP.md — phased build plan with acceptance criteria
- docs/DECISIONS.md — architecture decision log
- docs/LEGAL.md — authorized-use scope and responsible disclosure