A Fubsy Polymath subdomain

Hacking

Hardware-hacking, RF, embedded protocols, and the firmware that runs them.

26 deep dives across the bench — owned hardware, firmware references, and the connective-tissue research that ties them together.

?

How to search

sten gun: pages with both words
"sten gun": the words together, as a phrase
sten OR sterling: either one (| works too)
sten -replica: leave out pages that mention “replica”

Without quotes, the last word also matches longer words that start with it (sten finds Stenophylla), and close word forms count (rifle finds rifles). Tick Exact words to match whole words only.

Whole deep dives are listed first, then the pages inside them.

Exact words

Dashboards & Cross-tool

Find your way around

What's on the bench Per-unit inventory across all owned tools (sanitized). Capability matrix 18×16 grid — which tool for which job. Legal & lab discipline The ground rules that apply to every tool here. Am I being tracked? Plain-language steps to find a hidden AirTag or other tracker — no gear needed.

Devices (22)

Hardware deep dives

HackRF One

HackRF One Wideband SDR (1 MHz – 6 GHz) — the SDR that everything else gets compared to. Live

Flipper Zero

Flipper Zero Multi-tool RF/RFID/NFC/IR/BadUSB/GPIO front-end with a modular community ecosystem. Live

Bus Pirate 6

Bus Pirate 6 Embedded-protocol Swiss-army knife — UART, I²C, SPI, JTAG/SWD, 1-Wire, smart card, more. Live

GL-iNet GL-BE3600

GL-iNet GL-BE3600 Wi-Fi 7 travel router — OpenWrt-based pentest/privacy platform for hotels, cafes, conferences. Live

Ruckus Game Over

Ruckus Game Over Third-party Flipper module — ESP32-S3 + CC1101/NRF24 daughter slot. Wi-Fi/BLE/sub-GHz/2.4 GHz. Live

AWOK Dual Touch V3

AWOK Dual Touch V3 Third-party Flipper module — dual ESP32-WROOM + resistive touch + on-board GPS, wardriving. Live

DSTIKE Hackheld

DSTIKE Hackheld ESP8266 standalone Wi-Fi attack handheld running Spacehuhn deauther firmware. Live

M5Stack Cardputer ADV

M5Stack Cardputer ADV ESP32-S3 + QWERTY + LCD — a credit-card-sized programmable bench tool. Live

M5Stack Cardputer Zero

M5Stack Cardputer Zero The compact sibling of the ADV — smaller, leaner, still ESP32-based. Live

M5Stick S3

M5Stick S3 ESP32-S3 wand-form-factor with IMU, mic, and tiny LCD — pentest charm-bracelet. Live

OpenSourceSDRLab PortaRF

OpenSourceSDRLab PortaRF Standalone PortaPack-style chassis with built-in HackRF clone — no host PC needed. Live

Nyan Box

Nyan Box Cat-themed network mischief kit — ESP32-based, OpenSource hardware/firmware. Live

Wi-Fi Pineapple

Wi-Fi Pineapple Hak5's flagship Wi-Fi auditor — the platform much of modern wardriving learned from. Live

PWNagotchi

PWNagotchi A Pi Zero W "Tamagotchi for Wi-Fi handshakes" — RL-driven captive-portal hunter. Live

iCopy-X

iCopy-X Lab401 portable RFID/NFC cloning appliance — push-button replacement for Proxmark3 when the goal is "clone this card to that card, fast." Live

Chameleon Ultra

Chameleon Ultra NRF52840 RFID/NFC emulator — 8 HF + 8 LF card slots, MIFARE Classic attacks, BLE-driven. Live

SquachWatch

SquachWatch Talking Sasquach's open-source surveillance-device detector for the $15 ESP32 "Cheap Yellow Display" — names Flock cameras, body cams, recording glasses, skimmers, trackers and drones it hears on Wi-Fi and Bluetooth. Live

HaleHound

HaleHound Jesse C. Hale's proprietary multi-protocol offensive-security firmware for the ESP32 "Cheap Yellow Display" — the offensive twin of SquachWatch: Wi-Fi/BLE plus plug-in CC1101, NRF24, PN532 and GPS, all gated behind a liability disclaimer with a defensive Blue Team mode. Live

LakeShark

LakeShark Samuel Reynolds' GPL-3.0 firmware turning the LilyGO T-Display P4 (ESP32-P4) into a standalone handheld SDR scanner — P25 trunking, FM/AM, POCSAG and ADS-B decoded on-device with an RTL-SDR over USB, plus LoRa/MeshCore, GPS and offline maps. No PC. Live

OUI-SPY colonelpanichacks' surveillance-detector firmware ecosystem on a $7.50 Seeed XIAO ESP32-S3 — a second, independent methodology to SquachWatch: firmware-dump-sourced OUIs, wildcard-probe IE fingerprinting, a 5-tier confidence model, an RSSI foxhunter, and drone Remote ID. Live

Rayhunter The EFF's open-source IMSI-catcher / Stingray detector firmware (Rust) for cheap Qualcomm-modem hotspots — it passively watches the cellular control plane its own modem is on for the signatures of a fake base station. Defensive situational awareness; runs on the Orbic RC400L and a dozen other hotspots. Live

Quansheng UV-K5 The $30 Beken BK4819 handheld that became a hacker's playground — a thriving custom-firmware ecosystem (F4HWN Fusion, egzumer, VUURWERK, FAGCI) unlocks wide RX, AM/SSB and the signature spectrum-analyzer mod across three firmware-incompatible MCU generations. Live

Firmware & Languages (2)

Code that runs on the metal

Parrot OS

Parrot OS The Debian-based pentest distro that's the bench OS for half this gear. Live

Bruce Firmware

Bruce Firmware pr3y's AGPL-3.0 "predatory" multi-device ESP32 pentest firmware — the broad-hardware peer of Marauder/Ghost ESP, running across M5Stack (incl. the owned Cardputer ADV and M5Stick S3), LILYGO, CYD and its own RF REAPER board, with Wi-Fi/BLE/sub-GHz/NFC/IR and a JavaScript interpreter. Live

Research (2)

Connective tissue

AirTags

AirTags Item trackers ("air tags") end-to-end — the BLE Find My network, UWB, NFC/anti-stalking theory, the tracker varieties, and the counter-surveillance half: detecting hidden tags. Live

Camera Detection

Camera Detection Hidden-camera counter-surveillance end-to-end — finding cameras across every emission class (Wi-Fi/IP, analog wireless, cellular, non-emitting SD-only), a survey of commercial + DIY detectors, and building your own ESP32 Wi-Fi-camera finder. Live