The ESP-IDF-native wireless security platform for ESP32.
Deep Wi-Fi and BLE assessment, research-grade capture and export, and a real app ecosystem. Built directly on Espressif's ESP-IDF rather than through the Arduino core, so new silicon and radio features land first and there is no abstraction layer between GhostESP and the hardware.
⭐️ Enjoying GhostESP? Please give the repo a star. It helps a lot.
What's New
v2.2: LoRa goes dual-stack, captures get richer, and detection widens.
- LoRa: Meshtastic and MeshCore on SX1262, switchable at runtime, with the official apps over BLE. Ships on Heltec V3, T-Deck, CrowPanel Advance 2.4/2.8/4.3", and CrowPanel Advanced P4 7/9/10.1".
- Captures: per-frame signal, channel and rate in Wireshark; 802.1Q/QinQ VLAN tags; control frames (RTS/CTS/ACK) in EAPOL and Wireshark captures.
- Detection: a wider BLE device-detect list (Tile, SmartTag, Chipolo, AirPods, Apple Watch, FindMy, Fast Pair, hearing aids and more), plus
bledetect, mdnssniff, and dualwd BLE + Wi-Fi wardriving.
- Apps: Game Boy / Game Boy Color emulator, gallery folders (Tools, System, Games, Communication, Media, Sensors), and a richer plugin UI API.
- Quality of life: status-bar clock with analog and seven-segment faces, Country selector, Row Height setting, runtime IR TX/RX pin config, custom channel hopping, USB SD passthrough (S3), and T-Deck audio.
Earlier: v2.1 (Revival) added on-device OTA with rollback protection, the ST25R3916 NFC backend, the Cloud Store, and GhostScript (sandboxed Lua). v2.0 rebuilt the UI and introduced the native app ecosystem.
Full history in CHANGELOG.md.
Get Started
Why GhostESP
GhostESP is a platform, not a bag of tools. Five things set it apart:
- Built on ESP-IDF, not Arduino. Unlike Marauder and Bruce, GhostESP works against Espressif's SDK directly. It gets new chips and radio features first (802.15.4, Zigbee, 5 GHz on the C5) and lower-level control of the radios, memory, and partitions. Arduino-based firmware can reach the same APIs, just not as directly.
- Live capture and on-device analysis. Stream traffic into Wireshark in real time over USB, and browse, inspect, and convert captures (PCAP, hc22000, WiGLE, 802.15.4) on the device itself.
- GhostLink. Pair two ESP32s so one runs the other's radio, keyboard, and display, with BLE bridging to the Android app, split-channel wardriving, and peer OTA.
- Native apps. SD apps with their own permissions and storage, built with
gbt and a plugin SDK, installed from the Cloud Store, plus a Lua runtime for scripts. Examples: Device Inspector, ESP32Finder, a Doom port, a QR generator.
- One command set, many front ends. Drive GhostESP from the on-device UI, serial CLI, WebUI, Flipper Zero app, Android app, or a GhostLink-connected device, all against the same commands.
Features
WiFi Features
- Evil Portal (with custom HTML from buffer via serial)
- Deauth / disassoc attacks
- Channel switch attack
- GTK abuse / client isolation testing
- EAPOL logoff attack
- Karma (with custom SSID lists and custom portal chaining)
- Beacon spam (single/list/random/Rickroll)
- AP scan / STA scan / scanall
- Multi-select APs and stations
- Probe request listening (with auto-spawned Evil Twin)
- Handshake + PMKID capture
- WiFi capture to SD (PCAP) with on-device PCAP browser + hc22000 export
- USB dongle mode for Wireshark (extcap stream)
- Per-frame signal, channel and rate in captures, plus 802.1Q/QinQ VLAN tag and control-frame (RTS/CTS/ACK) support
- DHCP starvation
- ARP / port / SSH / local IP scanners
- mDNS discovery / NetBIOS scan / HTTP banner scan / SNMP probe (with per-host and per-subnet variants)
- Passive local-name sniffer (
mdnssniff: mDNS/LLMNR/SSDP/NetBIOS) per ARP-discovered host
- WiFi OUI vendor lookup
- WPA3/SAE attacks (flood + compliance checker)
- Wardriving exports (WiFi/BLE/GPS) + sweep CSV (WiFi/BLE/GPS/802.15.4)
- Split-channel wardriving helper via GhostLink
- Dual-band
dualwd BLE + Wi-Fi coexistence wardriving (PSRAM boards)
- RSSI tracking (AP/station) with live RSSI meter view
- Drone detection / spoofing
- PineAP detection
- Flock / surveillance detector
- WPS detection
- Pwnagotchi-style automated capture mode (Capture PWN)
- Channel congestion analysis
- Custom channel-hopping plans for attacks, AP/station scans, Airspace Monitor and packet hopping
- WiFi Airspace Monitor (real-time packet/threat insights, fast channel hopping, suspect device cards, packets/sec sparkline)
- DNS Sinkhole (blocklist-based NXDOMAIN blocking with built-in blocklist downloads)
- Web UI + filesystem + remote command relay
BLE Features
- BLE scan modes (general, AirTag, Flipper, raw)
- BLE advertisement scan with OUI prefix/vendor filtering + RGB match pulses
- BLE spam modes (Apple, Microsoft, Samsung, Google, Random) with optional custom advertiser name (
blespam -name)
- AirTag scan / spoof / select
- BLE packet capture
- BLE stream to Wireshark
- Flipper finder + RSSI
- GATT/service scan + per-device enumeration + device tracking (live RSSI meter)
- BLE wardriving
- BLE skimmer detection
- BLE device detect scan (
bledetect) with list, track and AirTag-spoof actions: Tile, Samsung SmartTag, Chipolo, AirPods (per-model), Apple Watch, generic FindMy clones, Fast Pair / Find Hub, hearing aids, exposure beacons and Chameleon Ultra
- Drone / OpenDroneID scan / list / track / spoof
- Aerial (drone) detector with threat classification
- GhostLink BLE bridge to the Android companion app
USB Features
- USB keyboard host mode (ESP32-S3 builds)
- USB SD card passthrough (ESP32-S3 boards with an SD slot)
- Remote keyboard control over GhostLink
- BadUSB script runner
- BadUSB identity options (VID/PID/manufacturer/product/layout/randomize)
- BadUSB trackpad (touchpad-style cursor control)
- BadUSB mouse jiggler
- BadUSB
type_char CLI for typing individual ASCII characters
- USB HID keyboard output mode (forward on-device keystrokes over USB)
- Dedicated WebUI BadUSB page
IR Features
ghostesp-revival/ghostesp