How to Hack Wi-Fi and Bluetooth with the Flipper Zero and Wi-Fi Marauder

Introduction

The Flipper Zero is not a Wi-Fi or Bluetooth hacking tool out of the box — its native radio is Sub-GHz and NFC, with no built-in Wi-Fi chipset. But attach the ESP32 Wi-Fi Dev Board to the GPIO header, flash the right firmware, and the Flipper becomes a powerful 802.11 and Bluetooth testing platform. This guide covers the ESP32 Wi-Fi Dev Board setup, Wi-Fi Marauder firmware, Bluetooth Low Energy interaction, and the practical workflows for wireless network assessment and BLE device analysis.

What You Need

• Flipper Zero with latest official or Unleashed firmware
• ESP32 Wi-Fi Dev Board (official Anycubic/Flipper accessory) or ESP32-S2/S3 DevKit
• Wi-Fi Marauder firmware (latest .bin from GitHub)
• USB-C cable for flashing the ESP32
• qFlipper or a serial flasher tool
• Target network or BLE devices (your own for legal testing)

Legal Notice

Wi-Fi attacks can disrupt networks and violate laws:

• Deauthentication attacks are illegal on networks you do not own
• Capturing traffic on encrypted networks without keys is legal (passive monitoring)
• Cracking WPA2 requires the key (offline brute force) and is only legal on your own network
• Bluetooth scanning is legal. Connecting to BLE devices without authorization may not be.

Step 1: Set Up the ESP32 Wi-Fi Dev Board

Physical connection:

1. Power off the Flipper Zero.
2. Slide the ESP32 Wi-Fi Dev Board onto the GPIO header on the top of the Flipper.
3. The 18-pin connector should align with the Flipper's GPIO pins.
4. Power on the Flipper. The ESP32 should boot and show a green LED.

Verify connection:

1. On the Flipper, navigate to GPIO > USB-UART Bridge.
2. Set baud rate to 115200.
3. Open the serial terminal in the WiFi Marauder app (install from App Catalog if needed).
4. You should see the Marauder welcome banner and prompt.

Step 2: Flash Wi-Fi Marauder Firmware

If your ESP32 board does not have Marauder pre-installed, flash it:

Method A: Flipper App (Easiest)

1. Download the ESP Flasher app from the Flipper App Catalog.
2. Download the latest Marauder .bin from the GitHub releases page (justcallmekoko/ESP32Marauder).
3. Copy the .bin to the SD card via qFlipper (apps_data/esp_flasher/ folder).
4. Open ESP Flasher on the Flipper, select the .bin, and flash.

Method B: Web Flasher (No Flipper needed for flashing)

1. Connect the ESP32 to your PC via USB-C.
2. Go to the ESP Web Flasher site (esp.huhn.me).
3. Select the Marauder .bin and your COM port.
4. Click Flash. The browser communicates directly with the ESP32 via WebSerial.

Method C: esptool.py

esptool.py --port COM3 --baud 921600 write_flash -z 0x1000 esp32_marauder_v0_13_3.bin

After flashing:

1. Reset the ESP32 (power cycle the Flipper or press the reset button on the dev board).
2. Open the WiFi Marauder app on the Flipper.
3. You should see the WiFi Marauder welcome message and the > prompt.

Step 3: Wi-Fi Scanning and Reconnaissance

List access points:

scanap

Marauder scans all 2.4 GHz channels and lists detected access points:

• SSID: Network name (hidden networks show as empty or *hidden*)
• BSSID: MAC address of the access point
• Channel: Wi-Fi channel (1-14)
• RSSI: Signal strength in dBm
• Encryption: OPEN, WEP, WPA, WPA2, WPA3

Sort by signal strength:

scanap -s

Select a specific target:

select -a [index_number]

This selects an AP from the scan list for subsequent attacks.

List connected stations (clients):

scansta

This detects Wi-Fi devices (phones, laptops, IoT devices) that are actively transmitting. It shows their MAC addresses and which AP they are connected to.

Continuous scanning:

sniffraw

This puts the ESP32 into monitor mode and captures raw 802.11 frames. It is the equivalent of airodump-ng on a laptop. Use this to map the wireless landscape of an area.

Step 4: Deauthentication Attack

A deauthentication (deauth) attack sends spoofed management frames that force a client to disconnect from an access point. It is used to:

• Test network resilience
• Capture WPA handshakes (when the client reconnects, the 4-way handshake is transmitted)
• Test if an access point implements 802.11w (management frame protection)

Run a deauth attack:

deauth

This sends deauth frames to the selected target AP and all its connected clients. Clients will disconnect and automatically reconnect within seconds.

Target a specific client:

deauth -c [client_mac]

Check for 802.11w protection:

Networks with 802.11w enabled ignore deauth frames from unauthenticated sources. If the deauth has no effect, the AP is protected.

Capture the WPA handshake:

sniffpmkid

This captures the PMKID or the full 4-way handshake when a client reconnects after deauth. The captured file (.pcap) can be analyzed with Wireshark or cracked with hashcat.

Step 5: Probe Sniffing and Tracking

Wi-Fi devices constantly broadcast probe requests looking for networks they have previously connected to. These probes contain the SSIDs of saved networks.

sniffprobes

Marauder captures these probes and displays:

• Device MAC address
• SSID being probed for
• Signal strength
• Timestamp

What this reveals:

• Home network names (can be used to find the person's address via WiGLE.net)
• Corporate network names (reconnaissance for targeted attacks)
• Hotel or conference networks the device has joined

Wi-Fi tracking:

Even when not connected, Wi-Fi devices transmit probe requests with their unique MAC address. By placing multiple ESP32s around a building, you can track device movement through triangulation. The Marauder firmware has a probe logging mode for this purpose.

Step 6: Evil Portal (Captive Portal Attack)

An evil portal creates a fake access point that mimics a legitimate network. When users connect, they see a login page where they enter their credentials.

Warning: This is illegal to run on public networks or without explicit authorization. Demonstrate only on your own test network.

1. Configure the evil portal:

setap -s [SSID_to_clone] setap -c [channel]

1. Start the access point and captive portal:

evilportal

This creates an open access point with the cloned SSID. Connected devices are redirected to a login page. Credentials entered are logged on the ESP32.

Retrieving captured credentials:

loot

Displays any credentials captured by the evil portal.

Step 7: Beacon Spam and SSID Flooding

Beacon spam transmits fake beacon frames for hundreds of SSIDs. This floods the Wi-Fi scan list of nearby devices.

beaconspam -l [list_file]

The list file contains SSIDs to broadcast, one per line. Marauder cycles through them rapidly.

Rickroll mode:

beaconspam -r

Broadcasts SSIDs named after lyrics to a certain song. Harmless but demonstrates the capability.

SSID random flooding:

beaconspam -f

Generates random SSID names and floods the spectrum. This can be used to test how devices handle large numbers of visible networks.

Step 8: Bluetooth Low Energy (BLE) Scanning and Interaction

The ESP32 has a Bluetooth 4.2/5.0 radio with BLE support. Marauder includes BLE tools.

Scan for BLE devices:

blescan

Lists nearby BLE devices with:

• MAC address
• Device name (if advertised)
• RSSI (signal strength)
• Advertised services
• Manufacturer data

Common BLE devices you will find:

• Smartwatches and fitness trackers (heart rate, step count)
• Wireless headphones and earbuds
• Smart home devices (thermostats, sensors)
• Car key fobs (some use BLE for proximity unlocking)
• Medical devices (glucose monitors, pulse oximeters)

Connect to a BLE device:

bleconnect -t [mac_address]

Connects to the target device and enumerates its GATT services and characteristics.

Read a GATT characteristic:

bleread -s [service_uuid] -c [char_uuid]

Reads the value of a specific BLE characteristic. This can reveal sensor data, configuration values, or debug information.

Write to a GATT characteristic:

blewrite -s [service_uuid] -c [char_uuid] -d [hex_data]

Writes data to a BLE characteristic. This can change device settings, trigger actions, or exploit vulnerabilities in poorly secured devices.

Step 9: BLE Sniffing and Analysis

The ESP32 can sniff BLE advertising packets, revealing what devices broadcast even without pairing:

blescan -r

Raw advertising data shows:

• Flags: Discoverability mode
• UUIDs: Services the device offers
• Manufacturer data: Apple, Samsung, Google, etc. — reveals device type and sometimes location tracking
• TX power: Used for proximity estimation

Apple AirTag / Find My detection:

Apple devices constantly broadcast BLE advertisements for the Find My network. These can be detected and used to identify nearby Apple users:

blescan | grep -i apple

Look for manufacturer data starting with 0x004C (Apple's company ID).

Google Fast Pair detection:

Android devices broadcast Fast Pair advertisements:

blescan | grep -i google

Manufacturer data starting with 0x00E0 (Google's company ID).

Step 10: Capture and Export Data

Save a pcap file:

sniffpmkid -s

Saves captured 802.11 frames to the ESP32's SPIFFS filesystem. Transfer to your PC via the serial interface or by putting the ESP32 into mass storage mode.

Analyze with Wireshark:

1. Export the .pcap from the ESP32.
2. Open in Wireshark on your PC.
3. Filter for EAPOL frames to find the WPA handshake.
4. Filter for deauth frames to see the attack pattern.

Crack WPA with hashcat:

hcxpcapngtool -o hash.hc22000 capture.pcap hashcat -m 22000 hash.hc22000 wordlist.txt

Tips for Wi-Fi and Bluetooth Hacking

• Update Marauder frequently: New attack modes and bug fixes are released regularly.
• Use a directional antenna: A 2.4 GHz Yagi or panel antenna on the ESP32 increases range and targeting precision.
• Channel matters: Wi-Fi attacks only work if the ESP32 is on the same channel as the target. Marauder auto-hops during scanning but you must set the correct channel for attacks.
• Battery drain: Wi-Fi Marauder drains the Flipper's battery quickly. Use a USB power bank for extended operations.
• Range limitation: The ESP32 on the dev board gets about 30-50 meters line of sight. An external antenna extends this to 100+ meters.
• BLE range: BLE has shorter range than Wi-Fi (10-20 meters typically) but penetrates walls better due to frequency hopping.
• Combine with Flipper Sub-GHz: Many IoT devices use both Wi-Fi for data and Sub-GHz for a physical remote. Capture the Sub-GHz remote signal and correlate it with the Wi-Fi traffic to map the full attack surface.

Conclusion

The ESP32 Wi-Fi Dev Board transforms the Flipper Zero from a pocket-sized RFID tool into a full-featured wireless network analyzer. Wi-Fi Marauder provides professional-grade reconnaissance, deauthentication, handshake capture, evil portal, and BLE interaction capabilities. Used responsibly on your own networks and devices, it is an invaluable tool for understanding wireless security, testing IoT device resilience, and building a complete picture of the RF environment around you. The combination of Sub-GHz, NFC, and Wi-Fi/BLE coverage makes the Flipper Zero the most versatile handheld RF analysis tool available at any price.