Build a Flipper Zero WiFi Multi-Tool: Marauder, Bluetooth Spam, and NFC Projects

Project Overview

This guide walks through building the ultimate Flipper Zero wireless multi-tool by adding an ESP32-S2 WiFi companion for the Marauder firmware, setting up Bluetooth spam and discovery tools, and building practical NFC automation projects. By the end, your Flipper will be able to scan WiFi networks, run deauth attacks (authorized testing only), probe for hidden SSIDs, spam Bluetooth advertisements, clone access cards, and automate your smart home — all controlled from the Flipper's screen with its physical buttons.

Required Parts

ComponentPriceSource Flipper Zero$169Flipper Devices (or authorized retailers) ESP32-S2 Mini$3-5AliExpress, Amazon, Digi-Key Dupont jumper wires (F-F, 6x)$2Any electronics supplier Micro USB data cable$5Any (must be data, not charge-only) Silicone case for Flipper$8-12Amazon, Flipper official store NTAG215 stickers (10-pack)$6-10Amazon T5577 rewritable cards (10-pack)$5-8Amazon Optional: WiFi Dev Board for Flipper (official)$29Flipper official store Total (without Flipper)$29-69

Step 1: Install Momentum Firmware

Momentum firmware (formerly Xtreme) adds critical features including expanded Sub-GHz frequency ranges, the app store, and BadUSB improvements. If you already have Momentum from our getting started guide, skip this step.

1. Download the latest Momentum release from GitHub (Next-Flip/Momentum-Firmware)
2. Open qFlipper on your computer → Advanced Controls → Install from file
3. Select the .tgz firmware file and flash it
4. The Flipper will reboot into Momentum
5. Explore Momentum Settings → Protocols to unlock expanded frequency ranges

Step 2: Build the WiFi Marauder Companion

2a. Flash the ESP32-S2 with Marauder Firmware

The ESP32-S2 runs the Marauder firmware independently — the Flipper just acts as a display and control interface via serial UART.

1. Install ESP32 board support in Arduino IDE ( Boards Manager → search "ESP32 by Espressif")
2. Download the Marauder firmware from github.com/justcallmekoko/ESP32Marauder
3. Or use the pre-compiled flasher tool: github.com/Smoochiee/Marauder-for-Flipper
4. Connect ESP32-S2 Mini to your computer via USB-C
5. Select board: "ESP32S2 Dev Module"
6. Select the correct COM port
7. Upload the Marauder firmware sketch
8. Open Serial Monitor at 115200 baud — you should see Marauder boot messages

2b. Physical Connection (ESP32-S2 to Flipper GPIO)

Connect these 4 wires between the Flipper's GPIO header (top of device) and the ESP32-S2 Mini:

Flipper GPIOESP32-S2 MiniFunction Pin 13 (TX)RX (GPIO18)Flipper sends commands to ESP32 Pin 14 (RX)TX (GPIO17)ESP32 sends data back to Flipper Pin 9 (GND)GNDCommon ground Pin 1 (3.3V)3.3VPower the ESP32 from Flipper

Important: Both devices run at 3.3V logic — no level shifter needed.

2c. Install the Marauder App on Flipper

1. On Momentum firmware: Apps → App Store → Search "Marauder"
2. Install the WiFi Marauder companion app
3. Connect the wires between Flipper and ESP32
4. Launch the Marauder app on Flipper
5. The app will display a terminal interface showing the ESP32's output

2d. Using the Marauder

From the Flipper screen, you can control these Marauder functions:

FunctionWhat It DoesLegal Use scanapScan for WiFi access points and display listAlways legal — passive reception scanstaScan for connected stations (clients)Always legal — passive sniffrawCapture raw 802.11 framesPassive monitoring of your own networks sniffbeaconCapture beacon framesNetwork analysis sniffprobeCapture probe requests (devices looking for networks)Foot traffic analysis, device tracking sniffpwnDetect WiFi attacks in your areaDefensive security deauthSend deauthentication frames to disconnect clientsOnly on networks you own or have written permission to test probeFlood area with probe requestsAuthorized testing only aplistShow discovered access pointsAlways legal select -a #Select an AP from the list— attacks -t deauthDeauth selected APAuthorized testing only

Step 3: Bluetooth Projects

3a. Bluetooth Discovery and Scanning

The Flipper's built-in Bluetooth LE can scan for nearby devices:

1. Open the Bluetooth app on Flipper
2. Select "Scan" to discover nearby BLE devices
3. You'll see device names, MAC addresses, and signal strength (RSSI)
4. Use this to inventory devices in an area, find lost BLE trackers, or identify unknown devices

3b. BLE Spam (Apple AirPods, Samsung Galaxy Buds, etc.)

Warning: This floods nearby phones with fake device pairing notifications. It's annoying to recipients and may violate laws regarding intentional interference. Use only in controlled environments with consent.

1. Install the BLE Spam app from the Flipper app store (Momentum firmware)
2. Select device type to emulate (AirPods, Galaxy Buds, etc.)
3. Start broadcasting
4. Nearby phones will display repeated pairing notifications

3c. Flipper as Bluetooth Remote

1. Use the Bluetooth Remote app on Flipper
2. Pair with your phone or computer via Bluetooth
3. Use Flipper buttons as presentation clicker, media controller, or keyboard input

Step 4: NFC Automation Projects

4a. WiFi Password Sharing Tag

1. Open NFC app on Flipper → Saved → Add manually
2. Select NDEF record type: WiFi Credentials
3. Enter SSID, password, and encryption type (WPA2)
4. Write to an NTAG215 tag
5. Any phone with NFC can now tap the tag to auto-connect to your WiFi
6. Place near your front door for guests

4b. Home Automation Trigger Tags

1. Set up Home Assistant with NFC tag integration
2. Write URL or webhook trigger to NTAG215 tag
3. Place tags around your workshop:
   • "Shop Lights On" → triggers shop lighting scene
   • "Shop Lights Off" → turns everything off
   • "Vacuum On" → activates dust collection
   • "Ventilation On" → turns on exhaust fans
4. Tap with phone to trigger, or use Flipper to write/verify tags

4c. Contact Card / Digital Business Card

1. Write vCard format contact info to NTAG215
2. Include: name, phone, email, website, social links
3. Tap with any phone — auto-prompts to save contact
4. More memorable than paper business cards

4d. URL Launcher Tags

1. Write any URL to an NTAG tag (your website, portfolio, etc.)
2. Phones automatically open the URL when tapped
3. Use for: product links on physical items, menu links on tables, info kiosks

Step 5: 125kHz RFID Projects

5a. Clone an Access Card (Authorized Only)

1. Open NFC → 125kHz RFID → Read
2. Hold access card near the back of the Flipper (antenna location)
3. Flipper beeps and displays the card ID
4. Save the capture with a descriptive name
5. Emulate the card: select saved file → Emulate
6. Hold Flipper's back to the reader — it will present the card ID

5b. Write to T5577 Rewritable Card

1. Read the original card (above)
2. Place a blank T5577 rewritable card near the Flipper
3. Select the saved card data → Write
4. Flipper programs the T5577 with the captured ID
5. The T5577 card now functions identically to the original

5c. HID Prox Brute Force (Security Testing)

1. For authorized penetration testing of HID Prox systems
2. Use the brute-force or dictionary attack features in the RFID app
3. Or use the Multi-Fuzzer app from the app store
4. Tests a range of facility codes and card numbers
5. Only use on systems you own or have written authorization to test

Step 6: Sub-GHz Projects

6a. Universal Garage Remote

1. Open Sub-GHz → Read on your Flipper
2. Press your garage remote button near the Flipper
3. Flipper captures the signal — save it
4. Replay the signal: select saved capture → Send
5. Most fixed-code garage remotes work this way
6. Note: Modern rolling-code remotes (after ~1995) won't replay successfully — this is good for security

6b. Wireless Outlet Control

1. Most cheap wireless outlets use fixed 433MHz codes
2. Sub-GHz → Read → press outlet remote button
3. Save each button (on/off for each outlet)
4. Control outlets directly from Flipper
5. Integrate into automation sequences

6c. Weather Station Decoder

1. Install the Weather Station app from the app store
2. Place near wireless weather sensors
3. Flipper decodes temperature, humidity, wind, rain data
4. Use the Sub-GHz → Read Raw to capture unknown protocols
5. Analyze in Universal Radio Hacker on PC

Step 7: Build a Portable Enclosure

Combine everything into a portable field kit:

1. 3D print a holder that mounts the ESP32-S2 on top of the Flipper
2. Use pogo pins or a short connector for quick attach/detach
3. Include storage for NTAG tags, T5577 cards, and jumper wires
4. Add a small USB power bank for extended ESP32 operation
5. Search Thingiverse/Printables for "Flipper WiFi mount" — many designs exist

Step 8: Automate with BadUSB Scripts

Combine the wireless tools with BadUSB for comprehensive authorized testing:

Network Audit Script

1. BadUSB script opens terminal
2. Runs network discovery commands
3. Saves results to desktop
4. Runs in background while you use Flipper for wireless scanning

WiFi Report Generator

1. Use Marauder to scan all WiFi networks in an area
2. Export capture to SD card
3. Transfer to laptop via qFlipper or Bluetooth
4. Generate report with network names, encryption types, signal strength

Essential Apps from the App Store

AppPurpose WiFi MarauderControl ESP32 WiFi companion ESP32 WiFi ScannerSimpler WiFi scanning (if no Marauder) BLE SpamBluetooth advertisement spam (use responsibly) Sub-GHz PlaylistReplay multiple signals in sequence Weather StationDecode wireless weather sensors Multi-FuzzerFuzz RFID and NFC readers Mouse JigglerPrevent screen lock via USB Barcode GeneratorDisplay various barcode formats NRFSnifferNordic RF 2.4GHz sniffing (needs module)

Legal and Ethical Boundaries

• WiFi scanning and passive monitoring: Legal in most jurisdictions
• Deauth attacks: Illegal without authorization — violates FCC regulations and Computer Fraud laws
• Bluetooth spam: May violate intentional interference laws — use only with consent
• RFID cloning: Illegal to clone cards for unauthorized access — only test systems you own
• Sub-GHz replay: Generally legal for your own devices; illegal for others' without permission
• BadUSB: Illegal to use on computers without explicit authorization

Troubleshooting

ProblemSolution Marauder not responding to FlipperCheck TX/RX wires not swapped; verify ESP32 flashed correctly; check baud rate (115200) ESP32 not powering from FlipperSome ESP32 boards draw too much current; use external USB power instead WiFi scan shows no networksEnsure ESP32-S2 (has WiFi) not ESP32-C3 or other variant; check antenna connection NFC read failsCard must be on back of Flipper where antenna is; try different card orientation RFID emulation not workingHold Flipper's back flat against reader; some readers need stronger field — try closer Sub-GHz capture is noisyEnsure antenna is connected; try different frequencies; check for interference sources Bluetooth not discovering devicesBLE only — classic Bluetooth not supported; target devices must be BLE advertising