Marauding Wi-Fi Networks With The Flipper Zero

Hello world and welcome to Haxez, today I’m going to be talking about using your Flipper Zero to attack Wi-Fi networks. By default, the Flipper Zero doesn’t have Wi-Fi capabilities. However, with the addition of the Wi-Fi developer board, you can add this functionality. The Wi-Fi developer board is rocking an ESP32-S2 module. With this module, you can perform Wi-Fi penetration testing such as probing attacks, de-authentication attacks, SSID rickrolling, and more.
Show Notes
* Dev Board Case: www.tindie.com/products/justc...
* Marauder Flasher: github.com/UberGuidoZ/Flipper...
* Installing RogueMaster: • Making Flipper Zero Ul...
* Installing Unleashed: • Unleashing the power o...
00:00 Unboxing
00:39 Introduction
01:12 Where To Buy
01:27 Downloading Firmware
01:57 Connecting Dev board
02:20 Flashing Firmware
03:48 Exploring Marauder
05:26 Scanning Access Points
06:15 Listing Access Points
07:14 Selecting Access Points
08:10 Rick Roll Attack
10:03 Deauth Attack
12:49 Probe Attack
14:32 Conclusions
Support Haxez
Socials
* Haxez - haxez.org/
* Rob’s Blog - www.bordergate.co.uk/
* Twitter - / haxez_org
Miscellaneous
* amzn.to/45AMKrJ Hack Disguise
* amzn.to/43hMb4s Mil-Tec Tactical Backpack
* amzn.to/3IQbWRb Black Hoodie
Hardware
* amzn.to/3MJmnad Alfa AWUS036ACH
* amzn.to/43zB1YE Alfa AWUS036ACS
* amzn.to/43eySSm Alfa AWUS036ACHM
* amzn.to/43gdGLR Alfa AWUS036NHA
* amzn.to/43y9wyv ATTiny85 Digispark
Books
* amzn.to/3C02Qxz Red Team Field Manual
* amzn.to/45ygiq1 Blue Team Field Manual
* amzn.to/43yaHOn PTFM: Purple Team Field Manual
* amzn.to/3MKXgEh Hash Crack: Password Cracking Manual
* amzn.to/43DuBrv Serious Cryptography
* amzn.to/42g3UYw Ethical Hacking
* amzn.to/45D58A8 Black Hat GraphQL
* amzn.to/43Ab6QE Hardware Hacking Handbook
* amzn.to/3C2gjET Cyberjutsu
* amzn.to/3C192oS Gray Hat C#
* amzn.to/43wd9Fa Practical IoT Hacking
* amzn.to/3WKV9oy Bug Bounty Bootcamp
* amzn.to/3OVlgqC The Art Of Cyberwarfare
* amzn.to/3OLqW6E Black Hat Python
* amzn.to/3C8uMiw Penetration Testing
* amzn.to/3oFDMc2 Art of Mac Malware
* amzn.to/3N25F7y Attacking Network Protocols
* amzn.to/3N66aNG Designing Secure Software
* amzn.to/3MIgHxh Rootkits and Bootkits
* amzn.to/3C1KWdR Practical Doomsday
* amzn.to/43BhbMq The Car Hacking Handbook
Crypto
* Doge: D7bGHhx78F1dLDS8yaMnF9fYX2CyY8ekwT
* BTC: bc1qtn75ut0299uzseqyhj6fh047a9nljj0j2ghj6a
* LTC: ltc1qdmynth2pqedmentm4t49c2wdgdj9kvg9y43x30
* ETH: 0x74FeeD2E98a5250CFedED7bB332357b48282d088

[@MoBeezyVevo]

Very clean an informational video. I've been looking for somebody who can explain as much as you can. You definitely deserve a subscription.

[@Jorge-jr2nb]

Great! Detailed and very well explained! Thank you very much

[@adsbygooglenl7849]

You are the best! Now i know how to work with the wifi dev board. Before i had no known

[@JoNazty1102]

I have been exploring on FZ and this was for real the first video that was crystal clear1 Very well done, much appreciated! If you ever feel like making a follow-up on sniffing and handshakes and how to interpret hashtags in HEX ;) - will add this channel to my favourites, thx for sharing!

[@jwillie000]

good simple vid but good depth , thanks and keep making . cheers

[@phatesdesign3411]

Thank you for this video my man. Wow!, I am astonished. You articulate everything. You explain it perfectly and you don't dance around with silly video effects. To the point and focused. I love it!. I got a billion and one questions normally everyday about the flipper/ Marauder /dual boot..pmkid is a serious rabbit hole... So an explanatory video on that would be great

[@GuidoZ]

Well done! Glad you found the tool useful! 😊

[@kemakol]

Hey I recognize that name =) thank you!

[@CydiaMasterHack]

Thanks for the repo man, making our lives a little easier

[@davidmartinez7194]

Appreciate everything you've done for flipper enthusiasts 🐬

[@molotov5000]

i just installed it on my dev board for flipper zero and its working amazing

[@Psmotta01]

more flipper videos!! loved ur videos

[@htcmlcrip]

Agree. Show how each function works with proper explanation like in this video.

[@coolergappney1943]

Change the lyrics to your Rick roll attack,and make it be like a party invite for your neighbors address, and see how many people notice and show up

[@CGHart]

outstanding tutorial - from a beginner thank you very much!

[@rikvermeer1325]

Most I've found are 101 tutorials where "hackers" just scroll through the menu what makes me wonder if they understand what's behind it. At 10 minutes it becomes interesting to me... I hope more people will start doing in depth videos. Thanks! I've subscribed.

[@Voodoo8648]

Right! Only thing I've concluded is that it doesn't do anything!

[@asmith9554]

@@Voodoo8648 Well it's a toy for people that think watching V for Vendetta was a defining moment in their life.

[@ejc222]

Just the information I was looking for.

[@shu7927]

thanks really interesting and well explained

[@ThereWillBeCake]

Cheers for the video and thanks for all the fish!

[@jameswalker199]

I was under the impression that the probe spam feature is a pseudo privacy tool. As people walk around a large area, say a shopping centre, its possible to track the general area that individuals are in by listening to the WiFi probes their phones give out and observing how they move through the environment. The probe spam disrupts this by just sending out junk probes as fast as possible.

[@mariogentile472]

How Batman used it to see thru walls in a movie

[@jeffbrownstain]

You can also just turn off wifi. Woaw

[@suzierottencrotch7893]

Im sure it can be used that way too. Good point.

[@htcmlcrip]

@@jeffbrownstain hard to use internet when your WiFi is off (assuming you don t wanna use mobile data).

[@jeffbrownstain]

@@htcmlcrip Hard to use wifi consistently when you're out walking around in public. Or, did you not actually comprehend the context of the conversation you just forced yourself into?

[@xeon_one]

Let me start by saying good job keep up the good work. Quick question would you like to share your stl. files or site you got it from. Thank you

[@DoubleVisionSoundSystem]

Deauth is more effective if you can also select clients (often referred to as stations). I have the same issue when selecting some AP’s, but when I select the AP and all the connected clients, works almost every time. Not sure if this firmware has that functionality but it’s only a matter of time 👍

[@haXez_org]

Yeah that makes 100% sense. I don’t think it was possible to select clients when I recorded the video. Soon though hopefully aye :-)

[@Shy_Knee_Side_Up]

That is good to know and will try that as the only way was able to deauth a specific AP is when manually rebooted the dev board repeatably via the physical reboot button on the board, which is less then ideal.

[@htcmlcrip]

@@haXez_org all I know that aircrack-ng (Linux) had this and it was always possible to select client too (presumably pretend packet is sent from specific client). As of effectiveness some of my phone's can be deauthed easily from public wi-fi's, where I tested it on aircrack suite, on my laptop, so it may also depend in the device you trying to deauth. Don't quote me on that, I messed with that 3 to 5 years ago lol. 2 years ago I used one of those stand alone esp deauthers with the same result.

[@jameswalker199]

The ESP-32 can only do 2.5GHz WiFi, I don't know how this affects 5GHz networks, but I imagine anything not specifically listening for deauthentication packets on 2.5GHz would probably not even hear them.

[@User_1795]

Your better off just flashing a 8226 with spacehun's firmware.

[@diegorr94]

Where did you get your dev board protector?, it’s really cool.

[@adrielmourey]

great video good info, thank you,

[@PsychoPlatoonSwoup]

For the deuth attack if I remember correctly its similar on a esp8266 board with the handshake by client has to be accomplished then create the duplicate access point eg-"(target wifi network name here) duplicate the access point name then fire back at the network the compiled attack and say at a deuth repeater and duplicate SSID so it creates a sea of the same network and refreshes authentication so that client can't connect till attack is stopped, I hope that makes sense so as to not trigger algorithm, but good luck with your progress

[@mrbillypop]

Wow excellent!

[@haXez_org]

Many thanks!

[@josephsaucedo8691]

Hay number 4 is me LoL 💯🍻

[@daviddavidson2357]

Deauth works in a second of running for me. Tested using an ESP32-CAM module as a video over IP source (connected to my router) and an ESP32 Wroom board with marauder flashed onto it.

[@Sun.Burn.]

did you put package in your flipper? or just install all, get list, select and attack ?

[@daviddavidson2357]

@@Sun.Burn. You need the .fap file on the flipper and you need to flash firmware to the esp32, old hardware firmware, web updater (not the OTA one, the browser based UART one)

[@bennguyen1313]

What is the difference between the Flipper Black Magic Probe firmware and the Marauder firmware? And any thoughts on other add-on boards ? For example does the Dr.B0rk's NRF24 board add Bluetooth since the ESP32-S2 only has wifi? What can you do with nrfsniff and mousejacker plugins? BTW, doesn't the Flipper Zero by itself support BLE? What can be done that instead of NRF24?

[@TheChad17]

The next time you run your deauth attack, run a ping X.X.X.X -t and you will see the packets being lost from the disconnect

[@haXez_org]

With X.X.X.X being the IP of the target AP? Good idea. I did revisit this recently and attempted to monitor traffic with Wireshark. The adaptor consistently disconnected when running the attack but bizarrely it wasn't noticeable outside of Wireshark.

[@TheChad17]

@@haXez_org I was just running a ping back to googles dns and watched the packets drop 1 after another. On this small scale I was shocked to see it dropping so much. Also, the probing caused my ping to be 100x higher.

[@johnadams9558]

Does the esp32 deauthorize on both 2.4 and 5Ghz? Also, my Deauth Monster (dstike) works infinitely better when connected to an external antenna. Does this info translates to the Flipper dev board?

[@101101brad]

the death flood worked on my EXT wifi but not my main wifi. My opinion is that the ext is already stretched and therefore it was flooded but not my main wifi because of the strong signal.

[@101101brad]

Also I had like 3 AP for my main wifi with the same name. not sure what thats about.

[@Lesmore187]

@@101101brad that's not a good sign change your network name and password and verify secure connection

[@graphmed]

The Flipper’s Wifi devboard is using an ESP32-S2 which is not capable of 5GHz. Only 2.4 GHz. AFAIK only the ESP32C5 is able to work both on 2.4 and 5 GHz.

[@deitschebanana4128]

Where did you get the case for the WiFi module or did you print it yourself? I also ordered on joom but there was no mentioning of a casing.

[@haXez_org]

Got it from Tindie but be careful if you order one. They are pretty delicate. Pop the pins out from the back using a pen or something. www.tindie.com/products/justcallmekoko/flipper-zero-wifi-dev-board-enclosure/

[@deitschebanana4128]

@@haXez_org Thanks for sharing much appreciated. This site has many other goodies I've never seen before.

[@funkyjunky3224]

Where did you get the cover for the dev board

[@StaceyTheEssene]

thanks for the video mate! ive got the dev board w/ wifi already, but where did you find the case for yours? Ive looked around the manufacturer site and cannot seem to find it, please advise.

[@Bamblez]

read the description fam

[@StaceyTheEssene]

@@Bamblez i feel silly AF 🤣🤦‍♀Thanks fam!! 🙃😊

[@MrGreenLeaf420]

I did everything but after i plug the dev board into my flipper after flashing marauder and go to the marauder app and press scan, nothing happens. Its like it doesnt detect the board. The light on the board flashes after i plug it into the flipper so I know at least something is happening. Any idea why it wont scan anything?

[@qkb3128]

This would be great to use a lily go tea display!

[@ClickClack_Bam]

Do any attacks allow you to gain the info to then join a network through Wi-Fi? Would be pretty neat option if you were somewhere & needed to join a protected Wi-Fi network & this gave you the option.

[@23dunmc]

You are gaining the info, you just aren’t saving it and decoding it. It needs to be saved to a computer then decrypted.

[@eldar3978]

thank you! but where to find this passwords after deauth or probe?

[@FireWoodOfficial]

A lot of new routers have protected management frames and WPA3 enabled . Good luck

[@ovejeromd]

Not really

[@boxingbar1]

Hi when i scan AP it says Press BACK to send stopscan ? any advice?

[@MrGreenLeaf420]

Same with mine. Let me know if you figure it out.

[@phatesdesign3411]

Oooohhh, So evil twin probably turned into evil portal... I got the dual boot after talking Sasquatchs video. Sorry for commenting twice but no joke. I would love to pick your brain about this... Do a follow along learning video or something like that would be badass.

[@yeah-t2j]

Can i deauth multiple networks at the same time ?

[@Dpjohnson83]

How do you select multiple networks to attack at once

[@Sun.Burn.]

how to put paquets deauth in flipper zero? because the deauth attack do nothing for me..

[@bradcasper4823]

Can you make your own custom beacon attack, just with different text? If so, how?

[@bandino1990]

im able to scan for wifi networks.. and see the list.. how do i select one??

[@MasterBojangles]

These are currently back in stock, get one while you can!

[@bunker88]

I dont find log Files and sniffing resaults. Can you Tell me wher to find thes Files ?

[@fernandasori5609]

How do you put the cat at the end of the video on the flipper? Name ?

[@serge-microsoftserge4484]

Translation with google! Hello, thank you for this video. You make life easier for us, I think you go a little fast to show each step and explain, especially for beginners. It would be great if you spoke slowly enough, for people who put the translation in the subtitle who don't speak English. I understand a little better now thanks to you. Good luck, the French-speaking community of Belgium is waiting for your next videos.

[@crissportillo4121]

lastly where may I obtain a hard case for the Dev

[@Dpjohnson83]

I have Xtreme firmware works with external ESP 32 CAM very well

[@redpillcommando]

Dude, Deauth worked for me on my network. It kicked my target workstation off the net and kept it off until I stopped the attack. Of course, I was sitting right next to it but hay, it works. Also, I am running a much later version of the Marauder ROM. But how to I capture the three way handshake, does anyone have a pointer to that?

[@3018Papa]

Hello where did you ger your case for the wifi board at the beggingin of your video? Thx im big fan of your videos 0:18

[@copperandgold4674]

Looks like it may have been 3D printed

[@Qu0thTheRaven]

i think its fairly common to block deauth packets by default nowadays because its a known issue. wpa3 capable devices can come with it out of the box for instance and various software packages block it sometimes. I've personally had plenty of success with it but newer devices, not so much..

[@Notme-le3qt]

@2:24 you mention a 'black magic firmware'... I've searched reddit & google to no avail. Could you please tell me where I could find more info on this black magic firmware??

[@404LeXX]

Is it possible to do this with bluetooth ?

[@ViperV0]

same with me the deauth wont work for me and i don't know what I'm doing wrong

[@igorpassos3443]

When I try to start Marauder, this appears: "A fatal error occurred: Failed to connect to ESP32-S2: No serial data received." help me please

[@jameswalker199]

Complete guess, but have you flashed the marauder firmware to the WiFi module correctly? If the firmware isn't on the module, it won't be running, so no serial data will be being sent.

[@K0RAXX]

Says ESPtool.exe is missing when I connect the board to PC to update it's CFW. ..(plz download and extract the full package)

[@101101brad]

Could you do a NRF24 video?

[@pekjoek]

how do i select multiple ap's?? instead of "select -a 2/select -a all" I want to: select -a 1, 2, 4, 7...how the hell do i write: , ??? is there any version of maruder able to do , ? only symbols current is "space" and _ .

[@ar0nis]

why the wifi attacks wont work? i did everything...a red light its on when attack is on but nothing happen

[@htcmlcrip]

Because devices reconnect faster than you can blink is my guess. So it works just you wouldn't notice.

[@BlueeBubble]

I pressed scan but it just says Press BACK to send stopscan

[@greyfots]

Does anyone know if the rickroll spam can be changed to a specific user selected text? If so could point me in the right direction

[@Livestyle99]

How Can I create my own Wifi ? I have a Google Index but I dont get how to make a own wifi

[@maryamjn-marie5102]

I need this

[@thegamingdragon7097]

when i scan AP it wont do anything. help?

[@GocygoOffical]

Is that the CRKT Piet?

[@Robingraves9180]

i got it to work once and now i cant seam to be able to do it again. help lol

[@JasonFarrell777]

0:16 when I ordered every accessory they had on the flipper website, they did not give me an option for this hard case to surround the very delicate motherboard

[@stephie4228]

It’s 3d printed not an official accessories

[@JasonFarrell777]

@@stephie4228 thank you for that info. Do you know where i can buy it?

[@TeeTeeTeeL]

How do I get a hold of you ? I need some help with a problem with flipper

[@haXez_org]

I’d recommend posting something on the official form or the sub reddit. I’m definitely not the best person to ask for troubleshooting help. I’m learning about everything as I go along and wouldn’t have a clue.

[@zeneto2157]

Dude. Brazilian gov. has forbidden the import and use of flipper zero here. I got arduino and raspberry pi 3 and wonder if i can make flipeer zero alike with those gadgets ... can i ??

[@Rightly_Divided]

It is possible. This is all open source.

[@iTsMike78]

Has anyone got any of the attacks to work except for the Rick roll access points?

[@nxk_ty9738]

i installed unleashed but i wont find the stuff that you have under applications

[@htcmlcrip]

Make sure you got as card formatted by properly with all the tools, I installed it yesterday and is in the SD card. So go to file browser not the main menu/app picker. Or from applications-gpio folder

[@nxk_ty9738]

@@htcmlcrip Okay i will try that. Thank you very much. :D

[@Hackdaplanet-lp1ex]

Momentum, and dark unleashed are best

[@benjamincounter418]

How do I get my Wifi back ? 😅

[@JackShen]

I know this is old but it will only deauth the devices on 2.4Gz , most routers have 5Gz. Most likely your device dropped from 2.4GHz and hopped onto the 5GHz

[@alpharomeo5123]

Looong time ago ☺️

[@topp0009]

can you crack ure wpa2 with that or rubber duck and apart from free Internet how wud you then control ure keylog mal ware ure pc on that new work..thanks Neil england

[@ugurimpram2519]

i done exactly what you said, i flashed my dev board, my flipper has unleashed firmware and when i plug my dev board in and go to scan ap nothing works its just a blank screen saying press back to send stopscan? any ideas? what did I do wrong? any help is appreciated

[@ugurimpram2519]

lol i was playing around with other settings it quickly crashed and when i tried again its all working now haha sick - guess it just needed to reboot itself

[@mynameiskain4933]

happened the same to me, did you connect the board to the computer while maintaining the boot button of the board pressed? i research a bit, did that and it works like a charm after reflashing without any kind of error in the process :) hope it helps

[@VicGreenBitcoin]

Only works on old web 64 and web 128 wifi 'security', not now days wifi security

[@KurtisSanders]

ahh the file is not there anymore cany dl Marauder

[@ZZYDDD]

does it show wifi password ?

[@random-unbreaded-commentor]

I want to get one of these damn things but grew up entirely in an anti computer household and have like, not even the slightest clue how they work 😂 is there a "learning how to use a tool that can do tons of illegal things for a totally recreational legal hobby for dummies" book somewhere?

[@Stopes.]

Just jump in. Arduino are a great place to start if your mechanically minded. Involves problem solving, coding, building etc.

[@droneforfun5384]

So how does it show the wifi-password…?..

[@AbundanceTribe]

It only deauthentecates wep or open networks

[@f7p1764]

main thing is missing about pcap and how to sniff

[@Viktor_Smilenko]

Супер, работает))

[@bryangallardo5048]

Anyone else have the issue where it doesn't scan anything?

[@josephcraig8807]

Deauth honestly works 1% of the time for me. Only on certain networks

[@dasskanal2343]

It only workes for wlan in a 2.4 GHz range

[@taylormathews9013]

Same here, I found that my devices (Govee lights) are really easy to deauth but my laptop stays connected. Tip, in router settings enable WPA3 and you’ll be a bit more secure but it won’t help your bulbs lol

[@dark30welderwelding11]

It does work as it should. This attack is not about actually disconnecting the device from the network. It’s about getting hashes … lots of them. The devices are being deauthd’ they are just re-authenticating immediately and generating a new hash to be captured. This isn’t a DDOS type of attack. It’s meant to generate data to be analyzed later.

[@devinmerrill3632]

Need an esp8266 board for this

[@LP-fy8wr]

Deauth is only going to work if the access point is capable of packet injection.

[@YuriPetrovich]

bro, why are you not on linux?

[@haXez_org]

Ha ha, I use linux everywhere just not on my base. I have my reasons some of which I can’t even justify to myself.

[@orbitalxr194]

i got an error about failed to connect

[@orbitalxr194]

never mind i fixed it your not meant to have the board light on while doing the flash.bat thing

[@JIMMYSBN]

also mine dosen't deauth my devices...

[@-a6833]

Deauthing is not a jamming technique, it's completely different, hence why it's not necessarily illegal, jamming is inherently illegal

[@jameswalker199]

From the perspective of the victim, their attempts to connect to a specific network are being jammed. I agree, though; this is not signal jamming, which is just shouting as loudly as you can in order to disrupt any and all communication attempts. Deauthing is more akin to "hey, you know that guy you're currently talking to right this moment? I'm definitely him and I'm telling you that we've stopped talking now. Goodbyeee"

[@computeroid6162]

It's not working on your network because you are probably not using WPA2 which is when the exploit works. Hope this helps!

[@josephmunoz640]

Can you use it to get Wi-Fi passwords

[@bairfreedom]

Yes, you can use the bad usb option. There are scripts that steal wifi pwds

[@thekillerkid6543]

I understood this the whole way but it’s not working for the first part

[@atomicforcegaming2867]

Tried to order one lastnight after they reopened the us store, they canceled my order :( My Christmas is ruined ...

[@AllAroundTube50]

I got one (i'm in the USA). Get one before they ban them.

[@crissportillo4121]

how do you screen record on the flipper lol seriously though

[@NX6.2]

That's the qflipper software on his computer than you can update and mod your flipper zero with.

[@carlos_mann]

WHERE CAN I BUY A FLIPPER ZONE ? (USA) 🙄 Please help me out

[@macgyver1408]

From me I'm in Canada

[@carlos_mann]

@@macgyver1408 More details, please

[@macgyver1408]

Give me your contact details ill call you

[@htcmlcrip]

eBay at 3x price from scalpers.

[@macgyver1408]

Try lab 401

[@Nefix7314]

hello thanks for the tutorial, unfortunately the Marauding doesn't work for me. Scan AP etc. Just says "press BACK to send stopscan" or nothing. Can you please help me? PS: I use Unleashed, but I've also tried RogueMaster and it doesn't work either

[@haXez_org]

Have you tried re-flashing the developer board? All I would be able to suggest is re-flashing both the flipper and dev board. Checking that its plugged in properly and that you have at least 1 AP in the area. Other than that I would recommend asking on the subreddit or official forum. sorry

[@Nefix7314]

@@haXez_org Thanks for the quick reply, I've now reflashed Blackmagic + wifi devboard and it's working. Thank you for your help

[@tijsbreukink3985]

@@haXez_org got the same problem, how do I exactly ''reflash''?

[@mynameiskain4933]

happened the same to me, did you connect the board to the computer while maintaining the boot button of the board pressed? i research a bit, did that and it works like a charm after reflashing without any kind of error in the process :) hope it helps

[@MrGreenLeaf420]

@@Nefix7314did you reflash to blackmagic then to marauder? Or did you just flash it to blackmagic?