u/Cheap_Personality206

Hey everyone, just shipped v1.6.0 of WifiPhisher for ESP32, my open-source Wi-Fi security testing firmware for ESP32-family boards (Evil Twin, Karma, deauther, on-device handshake/PMKID cracking, all from a web UI hosted on the device itself).

This release is one of the bigger ones so far:

• USB Wi-Fi adapter support (new) — added a from-scratch driver for the RTL8188EU USB dongle, so on S2/S3/C5/C6/Cardputer boards with USB-OTG you can now sniff and inject from an external adapter, not just the onboard radio.
• BLE toolkit (new) — BLE device identification, a BLE sniffer, and BLE spam attacks.
• Network discovery & port scanner (new) — subnet host discovery, mDNS/Bonjour and SSDP/UPnP discovery, plus a TCP Connect/SYN port scanner, all built in.
• Aircrack is a lot faster — swapped the generic mbedTLS crypto path for the native primitives already compiled into the Wi-Fi stack, which cut RAM usage and pushed handshake/PMKID verification to ~3 keys/sec on-device.
• Smarter deauther — it now tracks per-client ACKs to stop wasting airtime on clients that already dropped off, filters targets by RSSI, and auto-aligns the SoftAP channel to a single selected target.
• Evil Twin reliability fixes — clean task shutdown (no more hangs) and fixed 5GHz target detection.
• UI polish — WPS column in the scanner, and a reworked admin dashboard (screenshot below).

Flash it straight from the browser here, no toolchain needed: https://espwifiphisher.alexxdal.com/

Source, full changelog and build instructions: https://github.com/Alexxdal/WifiPhisher

Adding more functionality to my project, next smb Scan, arp spoofing, banner grabbing, and more check the repo if interested and maybe want to collaborate:

https://github.com/Alexxdal/ESP32WifiPhisher

Repo: https://github.com/Alexxdal/esp_wifi_usb

What it is

esp_wifi_usb lets an ESP32-S3 drive a cheap RTL8188EU USB Wi-Fi dongle directly off its built-in USB OTG peripheral, using ESP-IDF's USB Host Library. No separate USB host controller board, no Linux kernel in the middle — the dongle plugs straight into the S3's native USB port and the driver talks to the chip's registers over USB control/bulk transfers.

The point of doing this: the ESP32's own Wi-Fi radio doesn't do monitor-mode packet injection/reception the way a dedicated sniffer chipset does. RTL8188EU dongles are cheap, common, and well documented in the Linux world (lwfinger/rtl8188eu), so it's a natural second-radio option — if you're willing to reimplement the driver from scratch for a bare-metal target.

How it works

The RTL8188E is normally driven by a full Linux driver (firmware download, MAC/BB/RF register tables, calibration state machines, USB descriptor-based TX/RX queues, etc.). None of that exists for ESP-IDF, so this project ports the relevant slice of it directly:

• USB enumeration and bulk/control transfer handling via ESP-IDF's usb_host API
• Firmware blob download to the chip's embedded 8051 MCU
• MAC/BB/RF bring-up sequence (register tables ported from the reference Linux driver's PHY config files)
• IQ/LC calibration
• A promiscuous RX path that decodes the chip's RX descriptor format and hands raw 802.11 frames + RSSI/rate metadata to a callback
• Raw 802.11 frame injection via the chip's TX descriptor/queue mechanism

The public API (esp_wifi_usb.h) deliberately mirrors ESP-IDF's esp_wifi.h naming (esp_wifi_usb_init, esp_wifi_usb_set_promiscuous, esp_wifi_usb_80211_tx, ...) so application code looks familiar if you've used the built-in Wi-Fi's promiscuous/injection APIs before.

Current status

• RX / promiscuous sniffing: working — captures real 802.11 frames (beacons, probes, data) from nearby APs/stations with plausible RSSI.
• TX / raw frame injection: working, confirmed transmitting over the air (verified with an external sniffer).

There's no station/AP association mode — this is a sniffing + injection tool, not a general-purpose Wi-Fi stack replacement.

Why I'm posting

This was mostly reverse-engineering work: cross-referencing the chip's behavior against the real Linux driver source and USB captures of the vendor Windows driver on the same physical dongle, register by register, to figure out why a seemingly-correct TX descriptor was being silently dropped by the chip's DMA engine (turned out to be a mis-transcribed configuration register value). If you're interested in USB host bring-up on ESP32, RTL8188x internals, or just want a second radio for sniffing/injection projects, take a look — feedback and testing on other RTL8188EU dongles is welcome, since so far this has only been validated against one specific unit.

Built with PlatformIO + ESP-IDF, targeting ESP32-S3 (needs native USB OTG, not just USB-UART).

I am developing a penetration testing project focused on Wi-Fi and Bluetooth (BT features coming soon). Drawing from my extensive experience in Wi-Fi security auditing, I’ve built this tool to include the specific features and target data that provide the most value during a real-world network assessment.

I am currently looking for contributors and beta testers to put the firmware through its paces and help identify bugs or suggestion for improvements.

The firmware is completely headless. To get started, simply flash the device and connect to the access point:

• SSID: MagicWifi
• Password: MagicWifi1234
• Interface:http://192.168.4.1/admin.html

It support those ESP32 models: ESP32, ESP32S2, ESP32S3, ESP32C3, ESP32C5, ESP32C6

This is the webflasher if you want to install the firmware easily: https://espwifiphisher.alexxdal.com/
And this is the repository if you are intereseted in the source code:
https://github.com/Alexxdal/ESP32WifiPhisher
Thanks for your attention.