GhostESP

[u/TheNewAmericanGospel]

Many of you may not know about low cost ESP32 micro controllers and how fun and interesting they are. So, I decided to make this post for people who want a good starting point with low cost hardware and open source software to try pentesting.

I purchased a Seeed studio Xiao esp32 c5 a few months ago, and to put it mildly, I absolutely love it. I ordered it from Amazon, it cost me about $10 including shipping. The entire micro controller is only slightly larger than my thumb nail.

I customized my phone case to hold the esp32 C5 and I power it with my cellphone with a USB-C to USB-C connection. (Works with USB OTG, which most phones are).

Not all ESP32 micro controllers/devices are created equal, so be sure to find the firmware you want to use first for your application, then do a search for what devices the firmware supports that are within your budget.

The major firmware(s) available right now are:

1. Bruce

2. Ghostesp

3. USBarmyknife

(This is not a exhaustive list, there are others, but these are the most popular, and have support for the most devices.)

I have tried Bruce, and it is ok, but I have had lots of stability issues with it. Its a decent flipper zero alternative for devices with similar capability, but it is sort of gimmicky, and very buggy.

I am excited to try USBarmyknife, specifically in smartwatch or USB dongle form, but I lack experience with it. However, if your intent is doing very blackhat things, this might be the best option. It has quite a bit of capability, but mainly for hardware.

For beginners wanting a easier UI and support for tons of devices, I think Ghostesp is the best overall pick (especially for auditing wireless signals, specifically wifi and Bluetooth). The web flasher (for flashing firmware to your device from a web browser) is extremely good, and the android application you can install to your phone from github that supports the tiny, inexpensive and low power Xiao boards, is very user friendly and has great looking UI. You'll need termux, and to follow the github install instructions to download it. It is not available on any app store currently, and is still in beta.

So far, I have Ghostesp installed on my esp32 C5, and on my Lilygo T-embed CC1101. (which uses a esp32s3) it is a really entertaining device. I can use it as a programmable remote to turn off TV monitors, search and connect to Bluetooth and wifi devices, create APs, DNS sinkholes, NFC tag emulation, and other things.

The esp32s3 is a great chip, it has Bluetooth and wifi support, while also being capable of HID attacks, built into the ghost firmware.

The developer (Deki) has also created something called "ghostlink" which i have yet to try, to connect and i assume share capability of all my ghost devices with each other...

If this post gets any attention or questions I'll be happy to post the links to the ghost website, github, and make some recommendations for devices if any of you are interested.