Tooling
Self-Host

Hardware Hacking — Flipper Zero & Friends

Flipper, ChipWhisperer, JTAGulator, Proxmark, HackRF — for physical / embedded engagements.

Hardware hacking lives at the intersection of pentesting, embedded engineering, and SDR. The 2024–26 starter kit is a Flipper Zero plus a Proxmark / HackRF / Bus Pirate / ChipWhisperer depending on the niche. For SDR receivers see SDR Receivers / SDR Transceivers. For logic analysis see Logic Analyzers. For firmware reversing see Reverse Engineering (Ghidra).

Multi-tool — the gateway drug

  • ★ ★ Flipper Zero — pocket multitool; sub-GHz radio, NFC, RFID (125 kHz LF), iButton, IR, GPIO, BadUSB. The phenomenon device of 2022–26. ~$170 base; expansion ecosystem.
    • Stock firmware — official; conservative.
    • Momentum — the leading 2024+ community firmware fork; modern UI, regional unlock, more apps.
    • Unleashed — long-running community firmware; unlocks restricted regions / modulations.
    • RogueMaster — older fork; mostly absorbed.
    • WiFi Devboard / Marauder firmware — ESP32-S2 board for Wi-Fi attacks.
    • Video Game Module — RP2040 expansion.
    • GPIO modules — NRF24, GPIO breakout, custom dev boards.
  • HackRF Portapack — software-defined-radio handheld; like a Flipper for SDR.
  • M5Stack Cardputer — small Linux dev kit; growing security app set.

Sub-GHz / RFID / NFC

  • ★ Proxmark3 RDV4 — the reference RFID research tool (LF + HF + 13.56 MHz); reads / clones / sniffs Mifare, iCLASS, HID Prox, AWID, etc. Paid hardware (~$300+); FOSS firmware.
  • iCopy-X / iCopy-XS — handheld card cloner.
  • Chameleon Mini / Chameleon Ultra — programmable HF card emulator.
  • PM3Easy / PN532 — entry-level NFC.
  • MFkey64 / Magic Mifare cards — Mifare Classic write cards.
  • NFC Tools (mobile) — quick smartphone work.
  • See SDR Receivers: RTL-SDR, Airspy, SDRplay.
  • See SDR Transceivers: HackRF, BladeRF, LimeSDR, USRP.
  • Universal Radio Hacker (URH) — protocol analysis / signal demodulation; FOSS.
  • GNU Radio — visual signal-processing graphs.

JTAG / SWD / UART

  • ★ JTAGulator (Joe Grand) — finds JTAG / UART pinouts on unknown boards; DEFCON classic.
  • Bus Pirate v5 — multi-protocol probe (UART, SPI, I2C, JTAG-ish); Pirate v5 launched 2024.
  • Bus Blaster — JTAG.
  • Black Magic Probe — built-in GDB server; SWD / JTAG.
  • SEGGER J-Link / J-Link Edu — paid (Edu cheap); broad ARM support.
  • OpenOCD — open-source on-chip debugger.
  • Glasgow Interface Explorer — Python-driven multi-protocol; see Logic Analyzers.
  • Saleae Logic 8/16 / Pro — paid; logic-analyser software is best in class.
  • PulseView (sigrok) — FOSS logic-analyser front-end.

Side-channel / glitch

  • ★ ChipWhisperer (NewAE) — power-side-channel and voltage / clock glitch platform; FOSS hardware + software. The reference DPA / glitch kit. Lite / Husky / Pro tiers.
  • PicoEMP — DIY EM-glitch.
  • Faultier — glitch tool.
  • GIAnt (Riscure) — paid; commercial glitching rig.

Flash / chip-off

  • CH341A — cheap SPI flash programmer; the universal "dump the BIOS" choice.
  • flashrom — FOSS flash-programming utility.
  • xgpro / Minipro / TL866 II Plus — chip programmer.
  • PCB clip / SOIC8 clip — read flash without desoldering.
  • Hot-air rework station — for chip-off; see Hot Air & Rework.

Boot / firmware extraction

  • See Reverse Engineering (Ghidra) for binwalk / unblob / Ghidra.
  • EMBA / FACT / firmwalker / FwAnalyzer — automated firmware analysis.
  • u-boot console access — common entry path.

Wi-Fi / Bluetooth (link)

  • See Wireless / Wi-Fi Pentesting.
  • Ubertooth One — older BT classic.
  • Sniffle (TI dongle) — modern BLE sniffing.
  • nRF52840 dongle + Nordic Sniffer — BLE / 802.15.4 / Thread.

Vehicle / CAN / OBD-II

  • CANtact / Macchina — CAN tooling.
  • PandwaRF Rogue — sub-GHz handheld.
  • OpenGarages.org Car Hacker's Handbook tooling.
  • caringcaribou / icsim — virtual-CAN sim.

ICS / OT (industrial control)

  • Conpot — ICS honeypot; see Honeypots (T-Pot).
  • PLCNG / pyspeed — Modbus / S7 / DNP3 testing.
  • redpoint (Digital Bond) — ICS scanning.

Pick this if…

  • Default starter / demo / pocket multitool: Flipper Zero (Momentum firmware).
  • RFID / access-card cloning: Proxmark3 RDV4.
  • JTAG/UART discovery on unknown PCB: JTAGulator.
  • Side-channel / glitch research: ChipWhisperer.
  • Reading SPI flash / BIOS: CH341A + SOIC8 clip + flashrom.
  • SDR-driven RF research: HackRF or BladeRF + Universal Radio Hacker.
  • General-purpose protocol probe: Bus Pirate v5 or Glasgow.

Previous

CTF Tools — pwntools, GEF, angr

Next

Crypto & TLS Testing

On this page