GhostESP is an ESP-IDF-native firmware platform turning ESP32 hardware into a multi-radio Wi-Fi, BLE, NFC, and SubGHz research and assessment tool for authorized professionals.
| Tool | GhostESP-Revival/GhostESP — open-source ESP-IDF-native wireless research platform for ESP32 boards, currently at v2.2 |
| Category | Embedded wireless security firmware / hardware hacking platform |
| Primary Use | Wi-Fi and BLE assessment, capture-to-PCAP/hc22000, wardriving, NFC/RFID research, and SubGHz signal analysis on ESP32 hardware |
| Safe Use | Intended for authorized penetration tests, owned lab networks, RF-isolated research environments, and defensive detection research only |
| Telemetry Note | Offensive radio behavior (deauth frames, karma beacons, BLE spam bursts) is highly visible to WIDS/WIPS, PineAP and surveillance detectors; GhostESP itself ships detection modes that flag exactly these signatures |
GhostESP describes itself less as a single tool and more as a platform: a full firmware image, written in C against Espressif's ESP-IDF rather than the Arduino core, that turns an ESP32-class board into a multi-radio research instrument. The README is explicit about why that distinction matters — working directly against the vendor SDK means lower-level control of radios, memory, and partitions, and earlier access to new silicon capabilities like 802.15.4, Zigbee, and 5 GHz on the ESP32-C5, without an abstraction layer in the way. The project sits at roughly a thousand stars under the GhostESP-Revival organization, is licensed GPL-3.0, and the current v2.2 badge claims support for 62 board targets, which is an unusually wide hardware footprint for this category.
The Wi-Fi feature set is the deepest layer of the platform. It spans reconnaissance (AP/STA scans, scanall, multi-select of APs and stations, RSSI tracking with a live meter), capture (handshake and PMKID capture with on-device PCAP browsing and hc22000 export), and assessment functions aimed squarely at authorized testing — deauth/disassoc, channel switch, GTK abuse and client-isolation testing, Karma with custom SSID lists and portal chaining, beacon spam, DHCP starvation, and Evil Portal with custom HTML pushed over serial. What is notable architecturally is that the same command set drives every front end: on-device LVGL UI, serial CLI, WebUI, the Flipper Zero app, the Android app, or a GhostLink-paired second device.
Capture quality is where the ESP-IDF-native claim pays off. v2.2 adds per-frame signal, channel, and rate metadata into Wireshark exports, 802.1Q/QinQ VLAN tag preservation, and control frames (RTS/CTS/ACK) in both EAPOL and Wireshark captures. The device can act as a USB dongle in extcap mode, streaming live traffic into Wireshark, and captures in PCAP, hc22000, WiGLE, and 802.15.4 formats can be browsed and converted on the device itself. There is also a Pwnagotchi-style automated capture mode (Capture PWN) for hands-off handshake collection in lab environments.
The BLE stack is equally broad. Beyond general and raw scan modes, it includes an AirTag-focused scanner, Flipper finder with RSSI, GATT/service enumeration with per-device tracking, BLE packet capture streaming to Wireshark, and BLE wardriving. The v2.2 bledetect scan is a device-classification engine that can list, track, and spoof tags in the Tile, SmartTag, Chipolo, FindMy, Fast Pair, and hearing-aid families — framed in the README alongside skimmer detection and drone/OpenDroneID scanning, which are genuinely defensive-facing capabilities. On the flip side, the same radio supports BLE spam modes targeting Apple, Microsoft, Samsung, and Google advertisement formats, which is the kind of feature that only belongs on networks and devices you are authorized to test.
GhostLink is the platform's most interesting architectural idea: pair two ESP32s so one remotely drives the other's radio, keyboard, and display, with a BLE bridge to the Android companion app, split-channel wardriving, and peer OTA updates. Combined with the wardriving exports (WiFi/BLE/GPS CSV, sweep mode covering 802.15.4, and dual-band dualwd coexistence scanning on PSRAM boards), this positions GhostESP as a serious field-survey instrument, with mdnssniff passively collecting mDNS/LLMNR/SSDP/NetBIOS names per ARP-discovered host — a quiet, useful discovery technique for internal authorized assessments.
On the NFC/RFID side, GhostESP supports the PN532 (NTAG, MIFARE Classic) and, since v2.1, an ST25R3916 backend covering EMV payment-card reads, DESFire application trees, PicoPass, and iCLASS. MIFARE Classic tooling includes dictionary attacks (default plus user dictionaries, session key reuse, sector sweep) and hardnested recovery, plus a Flipper .nfc import/export path and a large parser set for transit and access card formats (CharlieCard, Troika, Saflok, Gallagher, and many more). Chameleon Ultra integration rounds out the HF/LF reader emulation story. The SubGHz subsystem talks to CC1101 hardware, scans 64 channels across 315–915 MHz bands, decodes 20+ protocols derived from Flipper community firmware, and saves signals as .sub files compatible with Flipper key formats.
The USB capabilities deserve caution from a policy standpoint: a BadUSB script runner with spoofable VID/PID identity options, a mouse jiggler, trackpad control, and HID keystroke forwarding are classic offensive payload-delivery primitives. In an authorized engagement these are legitimate HID-testing tools for physical-social-engineering assessments; outside that envelope they are a direct compromise vector, so treat any device flashing this firmware as untrusted hardware on your network. The same reasoning applies to the IR subsystem (learn mode, universal library transmit, Flipper .ir support) which targets consumer IR protocols rather than infrastructure.
Where GhostESP genuinely diverges from predecessors like Marauder and Bruce — both named explicitly in the README — is the app ecosystem. v2.0 introduced native SD apps with their own permissions and scoped storage, scaffolded by the gbt build tool and installable from an on-device Cloud Store; v2.1 added on-device OTA with rollback protection and GhostScript, a sandboxed Lua 5.4 runtime. The Apps Gallery organizes tools into Tools, System, Games, Communication, Media, and Sensors folders, and the plugin SDK ships examples like Device Inspector and ESP32Finder. This is the shape of a maintained platform with a developer community, not a weekend firmware dump.
For defenders, GhostESP is worth studying precisely because it doubles as a detection reference. Its own feature list includes PineAP detection, a Flock/surveillance detector, WPS detection, drone detection with threat classification, BLE skimmer detection, an Airspace Monitor with real-time packet/threat insights and suspect device cards, and a DNS Sinkhole with blocklist-based NXDOMAIN blocking. Those are the signatures that matter: deauth bursts, probe-response anomalies, and advertisement floods from this class of hardware are exactly what the tool itself teaches you to spot.
Operational hygiene notes from the README: the maintainers warn to flash only via the official flasher at ghostesp.net or bins from GitHub releases, since they cannot verify third-party mirrors — sensible given how often malicious firmware repackaging targets popular hardware projects. The project publishes a CHANGELOG.md, documentation at docs.ghost.net-adjacent resources, and an active Discord. v2.2 also adds LoRa dual-stack support (Meshtastic and MeshCore on SX1262, runtime-switchable, with official apps over BLE) on Heltec V3, T-Deck, and CrowPanel boards, extending the platform into mesh-network research.
The bottom line for an authorized professional: GhostESP consolidates what used to require a Flipper Zero, a Pwnagotchi, a wardriving rig, and a handful of SDR tools into one GPL-licensed, ESP-IDF-native firmware with 62 board targets and a real extensibility story. Its offensive features are prominent and demand strict engagement scoping, but its capture quality, detection tooling, and app architecture make it equally valuable as a research and defensive-validation platform. If your work involves wireless assessment, RF research, or building detection for exactly this class of device, it belongs on your bench — inside a Faraday cage or an authorized test environment, not anywhere else.
GhostESP-Revival/GhostESP.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.