Evil-M5Project – RTFM

A couple of years ago I flashed a captive portal onto an M5Core2 to see if I could phish a WiFi password sitting at my own desk. It worked on the first try, and that stupid little experiment never really stopped growing.

Today it’s Evil-M5Project, a pocket-sized penetration-testing framework with more than 75 modules, running on a €30 M5Cardputer (and a whole family of other M5Stack / ESP32 boards). This page is the RTFM: a map of everything the project does, and the front door to a series of articles where I take the big attacks apart one at a time.

Every episode answers the same four questions. What is the attack? Why is it a real problem? How do criminals actually use it? And then the fun part: how do you reproduce it on the Evil, where it falls short, and how do you defend against it?

Disclaimer

Evil-M5Project is meant for ethical and educational use only. The creator is not responsible for any misuse. Only run it against networks and devices you own or are explicitly authorized to test, and follow the laws of your country. Everything below exists so you can understand these attacks and defend against them.

So what is it, really?

At its core it’s firmware for cheap ESP32-based M5Stack hardware. It turns a keychain-sized gadget into a multi-tool for WiFi, Bluetooth/BLE, LAN, sub-GHz radio, NFC and USB/HID. No laptop, no Kali install, no backpack full of antennas. Just a screen, a keyboard and a battery in your pocket. The whole thing is open source: https://github.com/7h30th3r0n3/Evil-M5Project.

The interesting part isn’t any single feature. It’s that attacks which used to need a trained pentester carrying a bag of gear now fit on a toy you can buy with pocket money. That shift is exactly why defenders should care, and it’s the thread running through this whole series.

Hardware it runs on

• M5Cardputer (recommended, screen plus a full keyboard)
• M5Stack Core2, Core S3 / S3 SE, Fire, AtomS3 (add the GPS module for wardriving)
• M5NanoC6 and other ESP32 boards, with optional Cap HATs for Sub-GHz (CC1101) and NFC (ST25R3916), plus the M5Stack LLM module
• Companion slave firmwares turn spare ESP32s into a sniffing/wardriving RIG for the bigger multi-device attacks

The full arsenal

Every module in the project, grouped by what it attacks. The deep dives in the series below take the big ones apart one at a time; this is the complete map, pulled straight from the wiki.

Wi-Fi attacks and rogue access points

• Evil Twin clones a target SSID, stands up a fake AP with a captive portal, and deauths clients onto it to phish credentials.
• Captive Portal hosts fake login / sign-in portals (managed from the Admin WebUI, with Check Credential to read back what was captured).
• Deauther sends Wi-Fi deauthentication frames to kick clients and capture the resulting WPA/WPA2 handshake.
• Auto Deauther hands-free, channel-hopping deauth and handshake capture that finds APs on its own.
• Handshake Master large-scale handshake capture using several ESP32 sniffing slaves to watch every channel at once.
• Client Sniff and Deauth continuous, roaming handshake collection, pwnagotchi style.
• Karma Attack, Automated Karma, Karma Spear answer a device’s probe requests to impersonate the networks it remembers (manual, automatic and targeted).
• Probe Attack / Sniffing Probes craft or capture probe requests to bait the karma attack and profile nearby devices.
• Beacon Spam floods the air with fake SSIDs to confuse scanners and demo rogue-AP behaviour.
• Open Wifi Checker finds open and WEP networks and tests whether the open ones actually reach the internet.
• WPS Auditor passively audits nearby access points for WPS.
• CIW ZeroClick an SSID-injection testing framework for IoT and Wi-Fi device security.
• Honeypot a fake Telnet service that catches and logs unauthorized access attempts.
• Wifi Dead Drop an anonymous file and message drop over a Wi-Fi captive portal.

Recon, sniffing and mapping

• Scan WiFi / Select WiFi / Clone & Details list networks, pick a target, and fingerprint or clone an AP.
• WiFi Raw Sniffing / Sniff Raw Client raw pcap captures on a channel, and inspection of a connected client’s traffic for leaks.
• WiFi Channel Visualizer graphs how APs are spread across the 14 channels, live.
• Wardriving / Wardriving Master maps networks to GPS positions in Wigle format (and Google Earth KML), with multi-slave coverage.
• CSI Radar detects human presence and motion from Wi-Fi Channel State Information, no camera involved.
• Scan Network and Port / Full Network Scan maps devices, open ports and running services on the LAN.
• Web Crawler crawls an authorized website for analysis.
• Skimmer Detector scans for Bluetooth-based skimmer modules (HC-03/05/06).
• Beacon Scan scans BLE iBeacon and Eddystone beacons.
• Apple BLE Sniff passively decodes Apple Continuity BLE chatter (AirPods, hotspot, Find My presence).
• WhisperPair a Google Fast Pair BLE scanner.

Internal network, MITM and LAN services

• Rogue DHCP Server answers DHCP first to make the device the gateway and DNS.
• DHCP Starvation drains the real DHCP pool so the rogue server is the only one left answering.
• Switch DNS DNS spoofing that redirects HTTP requests to a captive portal.
• Network Hijacking the guided, one-button chain: starvation, rogue DHCP, portal and DNS spoofing in order.
• Responder LLMNR / NBNS / SMB poisoning that captures NTLMv2 credentials from Windows chatter.
• WPAD Abuse serves a malicious proxy config (wpad.dat) to harvest NTLMv2 with no browsing required.
• Printer Attack finds printers on port 9100 and reads their status over SNMP.
• CCTV Toolkit discovers and fingerprints IP cameras (HTTP/RTSP/ONVIF) and checks default logins.
• SIP Toolkit maps VoIP handsets and the PBX and gauges how exposed they are.
• LDAPDump enumerates Active Directory and writes it into a sortable HTML report.
• UPnP Mapping lists the router’s current UPnP port mappings (read-only exposure check).
• UPnP NAT opens a port on the network through UPnP, the way malware lets itself back in.
• SSDP Poisoning answers device discovery with hundreds of fakes to pollute the network’s view.
• Web Siphoning Cookie cookie siphoning, inspired by Samy Kamkar’s work.
• SSH Shell / Reverse TCP Tunnel connect out to SSH servers, or open a reverse tunnel for remote access.

Radio, NFC and physical

• Cap Sub-GHz (CC1101) read and decode, record and replay sub-GHz signals, with a spectrum analyzer, waterfall, gate identification and OpenSesame fixed-code brute-force.
• Send Tesla Code (RFunit) a proof-of-concept Tesla charge-port code sender.
• Cap NFC (ST25R3916) read, write, clone, emulate and relay cards: MIFARE default-key and mfkey recovery, DESFire checks, an EMV reader, and live ISO-DEP relay.
• BadUSB keystroke-injection attacks via DuckyScript over USB.
• Mouse Jiggler anti-AFK mouse movement over USB to keep a screen awake.
• Bluetooth Keyboard a wireless HID keyboard for the same injection trick without a cable.
• TagTinker ESL rewrites Electronic Shelf Labels (price tags) over infrared: images, text and commands.

Tracking, BLE and privacy

• IMSI Catcher monitors IMSI leaks over EAP-SIM carrier Wi-Fi.
• FindMyEvil turns a cheap ESP32 into an Apple Find My (OpenHaystack) beacon, with your own keys.
• Wall of Airtag scans for Find My and AirTag beacons travelling with you, the detection side of tracker abuse.
• Wall of Flipper detects nearby Flipper Zero devices.
• BLE Name Flood rapidly cycles BLE advertisement names for stress-testing.
• PwnGridSpam spams a name and face to nearby pwnagotchis (a denial-of-screen prank).
• SkyJack takes over a legacy Parrot AR.Drone over its open Wi-Fi.

Comms, mesh and the rest

• EvilChatMesh an offline, infrastructure-less ESP-NOW mesh chat for Cardputer and ESP32 devices.
• LLM Chat Stream (EvilOllama) a local LLM chat server driven from the device.
• Totem Compass an ESP-NOW long-range mesh scanner.
• EAPOL / Deauth detection the defensive flip side: counts deauth frames, flags an attack in progress and spots nearby pwnagotchis.
• Crack NTLMv2 on-device NTLMv2 cracking for demos (real cracking still happens offline on a proper rig).
• FileManager / UART Shell an SD-card browser and a serial console on the device.
• Bluetooth Serial Control / Admin WebUI / Remote Web Server drive the device over Bluetooth, a local web dashboard, or a remote Command & Control server.
• Settings / Customing Theming configuration and full UI theming.

That is the whole toolbox. The feature-by-feature manual, every menu and every option, lives in the project wiki (75+ pages). This page is the why. The wiki is the how to click.

The series: start here

Every episode follows the same map: the problem, then how criminals use it in the wild, then a hands-on demo on the Evil with its limits, then how to protect yourself. The series is complete now: every title below is a live article, so start wherever a topic grabs you.

1. Evil Twin: the fake network that steals your credentials
2. Deauth and handshake capture: the doorway into cracking WPA
3. Karma and Probe: when your phone calls out to ghost networks (live)
4. Rogue DHCP and DNS hijacking: becoming the network’s router
5. Responder and WPAD: stealing Windows credentials without an exploit
6. Sub-GHz replay: gates, remotes and the Tesla charge-port
7. NFC: cloning, emulating and relaying a badge or a card
8. NFC relay: using a contactless card that never leaves your pocket
9. BadUSB and HID injection: ten seconds on a USB port is enough
10. IMSI catching: how you get tracked through your SIM (live)
11. AirTags and Find My: from handy tracker to stalking tool
12. SSDP / UPnP: punching through the firewall from the inside
13. Exposed internal services: printers, cameras, VoIP, Active Directory
14. Drone hijacking: SkyJack on a Parrot AR.Drone
15. ESL hijacking: rewriting price tags in a store

Get it / contribute

Firmware and docs are on GitHub: https://github.com/7h30th3r0n3/Evil-M5Project, with the full manual in the wiki. If the project is useful to you, a star helps other people find it and keeps the research going. Now go read the manual. RTFM. 🐉