HaleHound-CYD packs 40+ wireless testing modules for WiFi, Bluetooth, SubGHz, and NFC onto a $7 ESP32 touchscreen board, built for authorized assessments and radio security research.
| Tool | JesseCHale/HaleHound-CYD — multi-protocol offensive security toolkit for the ESP32 Cheap Yellow Display, v4.0 |
| Category | Wireless/RF security testing hardware platform |
| Primary Use | Authorized wireless assessments, radio recon, jam detection, and hardware research using WiFi, BLE, CC1101 SubGHz, NRF24L01, and PN532 NFC radios |
| Safe Use | For penetration testers and security researchers working against systems they own or have explicit written authorization to test; the Jam Detect and tracker-scanning modules also serve purely defensive monitoring roles |
| Telemetry Note | The tool transmits at maximum radio power on target bands, making it loud on RF monitoring: deauth floods, carrier jamming, and BLE advertisement floods are readily visible to WIDS/RIDS sensors and the toolkit's own Jam Detect modules demonstrate the signatures defenders should alert on |
HaleHound-CYD is a firmware project by JesseCHale that turns the Cheap Yellow Display — a family of inexpensive ESP32 dev boards with resistive touchscreens — into a touch-driven, multi-protocol wireless security testing platform. Version v4.0 advertises more than 40 attack and recon modules spanning WiFi, Bluetooth, SubGHz radio, the 2.4GHz band, NFC, drone detection, and even card-skimmer hunting. The repository has accumulated roughly 1,800 stars and carries topic tags like offensive-security, subghz, cc1101, nrf24l01, and cheap-yellow-display, placing it squarely in the recent wave of handheld RF toolkits popularized by devices like the Flipper Zero, but built entirely on hobbyist-accessible parts.
The core architectural insight is that the ESP32 already contains two capable radios — WiFi and Bluetooth — so the base board alone can run the entire WiFi and BLE module set with no external hardware. The README describes an APSTA mode where the station interface scans while the access-point interface injects raw frames, with maximum transmit power at +20.5 dBm. Everything beyond that bolts onto the CYD's breakout pins: a CC1101 module for 300-439 MHz SubGHz work, an NRF24L01+PA+LNA for 2.4GHz, a PN532 in SPI mode for NFC/RFID, and a GT-U7 or NEO-6M GPS for wardriving. The touch UI scales automatically between 240x320 and 320x480 panels across four supported board variants, including the ubiquitous ESP32-2432S028.
Hardware integration is where the README is most instructive for anyone replicating the build. The Ebyte PA modules (E07-433M20S and E01-2G4M27SX) draw more current than the CYD's onboard 3.3V regulator can supply, so the documentation mandates an independent 5V→3.3V buck converter — tapping 5V from USB VBUS before the board's regulator — with all grounds tied together. Signal lines (SPI, CS, CE, GDO0, GDO2, TX_EN, RX_EN) still run directly to ESP32 GPIOs. This is a practical lesson in power budgeting: amplified radio front-ends on dev-board rails cause brownouts and failed radio init, a failure mode every hardware hacker hits eventually.
The WiFi menu shows a coherent attack workflow rather than a grab bag: a Packet Monitor for live 802.11 frame capture, a WiFi Scanner that feeds targets into a Deauther, a Probe Sniffer that captures what nearby devices are searching for and auto-spawns an Evil Twin using the probed SSID, and GARMR, a captive-portal credential harvester combining a fake AP with DNS hijack. There is also an Auth Flood that exhausts AP client tables with frames from randomized MACs, visualized with an 85-bar equalizer. For audit purposes, these are the exact techniques wireless intrusion detection systems are built to catch, which makes the toolkit as useful for red-team demonstration as for tuning blue-team WIDS alerting.
The Bluetooth section is the deepest and references several real CVEs. Airoha RACE implements CVE-2025-20700/20701/20702, unauthenticated BLE GATT access to Airoha chipsets found in headphones from Sony, Marshall, JBL, and Jabra, capable of extracting link keys and BD_ADDR without pairing. WhisperPair probes Google Fast Pair devices for the unauthorized-pairing flaw in CVE-2025-36911. BLE Predator runs a three-phase workflow — scan with threat classification, GATT service enumeration, then a honeypot clone that captures credentials written by victims — while SkeletonKey extends that recon into GATT fuzzing of writable characteristics. For operators, this menu is essentially a survey of the 2025 BLE vulnerability landscape compressed into a touchscreen.
The Lunatic Fringe hub deserves its own note because it is one of the few places where offense and defense genuinely meet in the same menu. Alongside offensive options like Phantom Flood (fake FindMy advertisement spam) and AirTag Replay, it includes Tracker Scan and AirTag Detect — multi-platform scanning for AirTags, Samsung SmartTags, Tile, and Chipolo. In other words, the same hardware that can impersonate a tracker can also detect stalking hardware, and KARR follows the same pattern: it scans for a specific brand of BLE car alarm, fingerprints its generation, and reports an exploitability verdict without transmitting commands.
SubGHz capabilities revolve around the CC1101: replay capture across 300-439 MHz, brute-force code generation for legacy fixed-code protocols (Princeton, CAME, Nice, PT2262), a 33-bar spectrum analyzer with peak-hold and noise-floor calibration, and a .sub file browser compatible with Flipper Zero captures stored on SD. Notably, the menu includes a Tesla Charge module that opens Tesla charge ports — a capability that has drawn regulatory attention elsewhere and should remind authorized users that even 'harmless' demos against property you do not own can cross legal lines. The 2.4GHz side covers MouseJack keystroke injection, promiscuous sniffing, and a visual spectrum analyzer across 2400-2525 MHz.
What elevates the project defensively is the dedicated Jam Detect menu: WiFi Guardian for deauth floods, SubGHz Sentinel for carrier jamming, a 2.4GHz Watchdog for broadband jamming, and a Full Spectrum combined mode. The SIGINT menu adds EAPOL/PMKID capture, GPS-tagged Wardriving logs to SD, an IoT Recon LAN scanner, and Flock You, a detector for Flock Safety ALPR cameras — a privacy-audit tool with obvious civil-liberties relevance. A Skimmer Hunt module rounds out the defensive set by hunting Bluetooth-equipped card skimmers.
From an operational-security standpoint, the README is blunt that 'all radios transmit at maximum power' and there are 'no training wheels.' That loudness is a double-edged sword: in an authorized engagement it ensures demonstrations are unambiguous, but it also means the toolkit is trivially detectable — deauth floods, BLE ad-channel carriers, and SubGHz wideband transmissions light up any competent RF monitoring stack. Defenders can use the tool's own attack modes as a reference for what their sensors should catch, ideally in a lab.
Deployment is unusually frictionless: a browser-based flasher at the project's site uses Chrome or Edge's Web Serial support, so you plug in the board, pick your variant (esp32-cyd, esp32-e32r35t, esp32-e32r28t, or esp32-cyd-hat), and flash without installing a toolchain. Firmware updates can also be applied over the air from an SD card, and a Radio Test module with wiring diagrams verifies hardware before field use. A 4-digit boot PIN provides minimal at-rest protection for a device whose SD card holds captured 'loot.'
Caveats worth noting: the repository license is marked NOASSERTION, so commercial use and redistribution terms are unclear, and the README's aggressive positioning means prospective users should verify local radio regulations — transmitting on many of these bands at +20 dBm requires authorization in most jurisdictions. The license text isn't reproduced in the README, which is something to check before building a red-team kit around it. For the target audience — consultants, hardware researchers, and defenders building RF-detection labs — HaleHound-CYD is one of the most complete open frameworks for understanding just how much attack surface lives in a seven-dollar board and a handful of radio modules.
JesseCHale/HaleHound-CYD.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.