WiFi deauth to LoRa beacons. MouseJack to DHCP starvation. POSEIDON covers more attack surface than any other pocketable device — and it's keyboard-first so you actually fly through it.
📖 Open the Codex — every tool, what it does & how it works →
The deauth-correctness core: scan, capture, sniff, wardrive.
Scan, deauth (client sniffer + disassoc pair + seq counter), evil portal, karma, beacon spam, probe sniff, PMKID + 4-way handshake, wardrive + GPS, CIW zeroclick injection.
Autonomous handshake hunter, cyberpunk helmet face. RL channel picker, SD-persisted. 4 modes: HUNT, STEALTH, SURGICAL, STORM.
Classify, spam, clone, and the WhisperPair CVE probe.
Classifying scan (OUI + Continuity + Fast Pair DBs). Spam Apple/Samsung/Google/Windows. Bad-KB HID, tracker detect, GATT explorer, Sour Apple CVE-2023-42941, Find-My emulator, clone, flood, plus WhisperPair CVE-2025-36911 probe (real ECDH + AES).
Capture, decode, replay, and a 3,190+ signal library.
Capture with protocol decoder (Princeton, CAME, NICE, Linear). RAW record via native RMT. Replay Flipper .sub. 3,190+ signal library. Spectrum analyzer. Brute force. Jammer. Jam Detect RSSI monitor.
ESB sniffing, MouseJack injection, nRF24 BLE spam.
Promiscuous ESB sniffer (Goodspeed trick). MouseJack HID injection. nRF24 BLE spam with full CRC24 + whitening. Spectrum analyzer. CW jammer.
Multi-band LoRa, GNSS, and a full Meshtastic leaf node.
Multi-band scan. Beacon TX with GPS coords. Meshtastic LongFast listener + full leaf node (chat/nodes/page/position). LoRa Analyzer live capture. GPS fix, baud auto-detect.
Full SX1262 stack on the CAP-LoRa1262 hat: canonical init with BUSY pin, HSPI shared with SD, antenna-switch-before-begin. Scan / beacon / listener / spectrum on 433 / 868 / 915 / US LongFast.
Wired LAN suite plus the SaltyJack credential arsenal.
Port scan, ping, DNS, SSDP poisoner, honeypot, reverse TCP tunnel, UART shell, plus SaltyJack (DHCP starve, rogue DHCP, Responder, WPAD NTLM, on-device cracker).
HID payloads, IR remotes, and pocket utilities.
USB-HID payload runner. TV-B-Gone. Samsung remote. Flashlight, stopwatch, calculator, morse, MAC randomizer, SD format, file browser. 6-palette theme engine.
Unified proximity hunting across every radio.
Hot/cold proximity submenu: BLE tracker hunt + passive tracker scan + CC1101 finder + nRF24 finder, all geiger-style. Pick a target, radio switches automatically.
5 GHz attacks the S3 can't do, paired over ESP-NOW.
Plug-in ESP32-C5 over ESP-NOW: 5 GHz deauth (targeted + broadcast, binary patch bypassing ieee80211_raw_frame_sanity_check), 802.15.4 Zigbee sniffer, 5 GHz PMKID, dual-band scan with auth column (WPA3 red-flagged). Auto-pairs on channel 1.
Six swappable color schemes. Pick your mood.