Tools

Official command-line driver/utilities (airspy_rx and friends) for Airspy-brand SDR receivers, used for raw IQ capture independent of a GUI front end.

airspy_rx -f 100.0 -a 10000000 -r output.raw

Identifies and extracts embedded files and firmware images buried inside a binary blob — signature-scans for known file/filesystem headers and carves out what it finds.

binwalk -e firmware.bin

When a UART header is identified but the baud rate is not, quickly cycle through the common rates and watch for readable boot text instead of guessing one at a time.

for baud in 9600 19200 38400 57600 115200; do
  echo "--- trying $baud ---"
  timeout 3 picocom -b $baud -q /dev/ttyUSB0
done

BLE sniffing and hijacking toolkit (needs a couple of cheap nRF51-based dongles) that can follow, jam and even take over an existing BLE connection.

btlejack -s

Open-source USB hardware swiss-army-knife for talking to unknown chips over UART/SPI/I2C/JTAG/1-Wire from a serial terminal — usually the first thing plugged into an unidentified header on a PCB.

picocom /dev/ttyUSB0 -b 115200

Open-source hardware that emulates and clones RFID/NFC tags (rather than just reading them) — used to test how access-control readers react to a spoofed or replayed credential.

Pocket-sized successor to ChameleonMini with BLE control from a phone app, dual-frequency (LF+HF) emulation, and onboard support for common Mifare attacks.

Open-source side-channel power analysis and voltage/clock glitching platform (hardware + Python toolchain) for practical hands-on work with fault injection and DPA, not just theory.

ICS/SCADA honeypot emulating industrial protocols (Modbus, S7comm, etc.) and PLC device fingerprints, to detect and study attacks against industrial control systems.

conpot -t default

Cross-platform general-purpose SDR receiver GUI aimed at being simpler to get running than SDR#/GQRX on any given OS, with a spectrum/waterfall view and basic demodulation.

Python framework (with GoodFET/GreatFET/Cynthion hardware backends) for emulating arbitrary USB devices in software, used to fuzz host USB stacks/drivers or spoof a device a host expects.

Reads, writes and verifies SPI/parallel flash chips (BIOS/UEFI, router firmware, embedded device flash) with a wide range of cheap programmers, in-system or desoldered.

flashrom -p ch341a_spi -r backup.bin

Pocket multi-tool for RF/RFID/NFC/infrared/iButton with a Dolphin-themed UI — reads, emulates and replays sub-GHz, 125kHz LF and 13.56MHz HF tags, plus GPIO for basic hardware hacking.

Node.js BLE MITM/impersonation toolkit — scans and clones a target device's GATT profile so a fake peripheral can sit between a phone app and the real hardware.

node scan.js

Open hardware/FPGA-based multi-protocol debug tool — a growing library of applets for talking, sniffing and glitching just about any low-speed digital interface (UART, SPI, I2C, JTAG, flash) from one board.

glasgow run uart -V 3.3 --pins-rx=0 --pins-tx=1

A free software-defined-radio development toolkit — a flow-graph-based signal-processing framework that HackRF, RTL-SDR, BladeRF and USRP tooling is commonly built on top of.

GNU Radio-based SDR receiver GUI for Linux/macOS with a waterfall display and the standard analog demodulators — a common first stop for exploring what a new SDR dongle can hear.

NSA-released passive network mapping tool for ICS/SCADA environments — builds a topology map from captured traffic without sending any packets onto often-fragile OT networks.

Great Scott Gadgets' general-purpose USB hardware hacking tool — GPIO, SPI, I2C, and a software-defined peripheral bus for talking to almost anything on a board over USB from a host script.

gf info

STM32-based open-source hardware for UART/SPI/I2C/JTAG/CAN work, in the same niche as the Bus Pirate but built around faster hardware and an extensible HydraFW firmware.

picocom /dev/ttyACM0 -b 115200

Directory of publicly reachable IP cameras with no or default authentication, browsable by country and manufacturer — an oft-cited example of what exposed device search finds.

Hardware tool that brute-forces which pins on an unlabelled header are JTAG or UART, and at what configuration, before any actual debugging can start.

picocom /dev/ttyUSB0 -b 115200

Builds interactive maps and screenshot galleries of internet-connected cameras and ICS devices discovered via internet scan-search-engine APIs.

Hak5's covert USB-Ethernet pass-through implant — sits inline on a wired network for remote access, recon and MITM modules while looking like a USB adapter.

The base NFC hardware abstraction library most Linux NFC tooling is built on, including mfoc and mfcuk — the standard tools for recovering MIFARE Classic keys.

nfc-list

Community custom firmware for Flipper Zero focused on stability and quality-of-life features on top of the official stack (more protocols, UI tweaks, plugin support).

A USB charge/data cable with a hidden implant for keystroke injection and Wi-Fi-controlled payload delivery, built to look and function like an ordinary cable.

On-chip debugger supporting a huge range of JTAG/SWD adapters and target MCUs — halts, single-steps and dumps memory on embedded targets, the usual next step once JTAG pins are found.

openocd -f interface/stlink.cfg -f target/stm32f4x.cfg

Web-based SDR receiver server — points a browser at a shared radio front end so a receiver can be listened to and demodulated remotely without installing client software.

Open-source GSM baseband firmware and host tools for a handful of old Motorola phones, letting researchers run and inspect the actual GSM protocol stack instead of only sniffing the air interface.

Community-maintained firmware for the PortaPack add-on that turns a HackRF into a standalone, battery-powered handheld SDR — transmit/receive/replay without a laptop attached.

The de-facto reference RFID/NFC research tool and its firmware/client software — reads, writes, clones and analyses a wide range of low- and high-frequency card technologies.

proxmark3 /dev/ttyACM0

The community-maintained fork of the Proxmark3 client/firmware, now the de facto standard for anything RFID/NFC beyond casual tag reading — LF/HF, Mifare attacks, standalone scripting.

pm3 -c "hf 14a info"

Adam Laurie's long-running Python library and script collection for RFID reader hardware — tag enumeration, Mifare Classic key attacks and general LF/HF experimentation predating most of today's GUI tools.

Decodes and prints the traffic of hundreds of ISM-band devices (weather stations, tyre-pressure sensors, wireless doorbells, key fobs) from an RTL-SDR-class dongle.

rtl_433 -f 433.92M

The driver and command-line utilities (rtl_sdr, rtl_fm, rtl_tcp) that turned cheap DVB-T USB dongles into general-purpose SDR receivers — the hardware most of this category is built on.

rtl_sdr -f 433920000 -s 250000 capture.bin

One of the original general-purpose SDR receiver front ends — waterfall, demodulators and a plugin ecosystem, still widely used with RTL-SDR/Airspy/HackRF hardware.

Full-featured SDR receiver and transmitter application with dozens of built-in demodulators (including digital voice), a REST API, and multi-device/multi-channel support.

Open-source logic analyzer/oscilloscope software stack (sigrok drivers plus the PulseView GUI) supporting dozens of cheap USB logic analyzers, with protocol decoders for UART/SPI/I2C and more.

sigrok-cli --driver fx2lafw --config samplerate=24m --samples 1000

Open-source USB Bluetooth (Classic and BLE) monitoring hardware plus its host tools, for sniffing and following connections that a normal Bluetooth adapter's firmware hides.

ubertooth-btle -f -c capture.pcap

Open-source, USB-stick-sized ARM computer running full Linux — used to build a self-contained portable pentest/forensics/HSM-style implant that presents as an ordinary USB device.

Hak5's dedicated rogue-AP/MITM hardware appliance — recon, karma/evil-twin attacks and traffic capture through a web dashboard and a modules ecosystem, built for field engagements.

Feature-maximalist community custom firmware for Flipper Zero — bundles extra sub-GHz frequencies/protocols, apps and unlocks beyond what the stock firmware ships.