Skip to the content.

ESP32 Wi-Fi Penetration Tool

This project introduces an universal tool for ESP32 platform for implementing various Wi-Fi attacks. It provides some common functionality that is commonly used in Wi-Fi attacks and makes implementing new attacks a bit simpler. It also includes Wi-Fi attacks itself like capturing PMKIDs from handshakes, or handshakes themselves by different methods like starting rogue duplicated AP or sending deauthentication frames directly, etc…

Obviously cracking is not part of this project, as ESP32 is not sufficient to crack hashes in effective way. The rest can be done on this small, cheap, low-power SoC.



Demo video

Demonstration Youtube video


  1. Build and flash project onto ESP32 (DevKit or module)
  2. Power ESP32
  3. Management AP is started automatically after boot
  4. Connect to this AP
    By default: SSID: ManagementAP and password: mgmtadmin
  5. In browser open and you should see a web client to configure and control tool like this:

    Web client UI


This project is currently developed using ESP-IDF 4.1 (commit 5ef1b390026270503634ac3ec9f1ec2e364e23b2). It may be broken on newer version.

Project can be built in the usual ESP-IDF way: build

Legacy method using make is not supported by this project.


If you have setup ESP-IDF, the easiest way is to use flash.

In case you don’t want to setup whole ESP-IDF, you can use pre-build binaries included in build/ and flash them using (requires Python).

Example command (follow instructions in esptool repo): -p /dev/ttyS5 -b 115200 --after hard_reset write_flash --flash_mode dio --flash_freq 40m --flash_size detect 0x8000 build/partition_table/partition-table.bin 0x1000 build/bootloader/bootloader.bin 0x10000 build/esp32-wifi-penetration-tool.bin

On Windows you can use official Flash Download Tool.


Wi-Fi attacks

Attacks implementations in this project are described in main component README. Theory behind these attacks is located in doc/

API reference

This project uses Doxygen notation for documenting components API and implementation. Doxyfile is included so if you want to generate API reference, just run doxygen from root directory. It will generate HTML API reference into doc/api/html.


This project consists of multiple components, that can be reused in other projects. Each component has it’s own README with detailed description. Here comes brief description of components:


This project was mostly build and tested on ESP32-DEVKITC-32E but there should not be any differences for any ESP32-WROOM-32 modules.

Hw components

On the following pictures you can see a battery (Li-Pol accumulator) powered ESP32 DevKitC using following hardware:

Hw components Hw components

Altogether (without coin) this setup weights around 17g. This can be further downsized by using smaller Li-Pol accumulator and using ESP32-WROOM-32 modul directly instead of whole dev board.

This setup cost me around 300 CZK (± 11.50 EUR/13.50 USD). Using the modul directly that costs around 80 CZK (± 3 EUR/3.5 USD) we can get to price of 160 CZK (± 6.5 EUR/7.5 USD) which makes this tool really cheap and available to almost everybody.

Power consumption

Based on experimental measurements, ESP32 consumes around 100mA during attack executions.


Feel free to contribute. Don’t hestitate to refactor current code base. Please stick to Doxygen notation when commenting new functions and files. This project is mainly build for educational and demonstration purposes, so verbose documentation is welcome.


This project demonstrates vulnerabilities of Wi-Fi networks and its underlaying 802.11 standard and how ESP32 platform can be utilised to attack on those vulnerable spots. Use responsibly against networks you have permission to attack on.


Even though this project is licensed under MIT license (see LICENSE file for details), don’t be shy or greedy and share your work.