[ Flipper Zero + ESP32: Adding WiFi ]

The Flipper Zero has no WiFi radio inside. To get it onto a network you
bolt on an external ESP32 board: it plugs onto the GPIO header and does the
WiFi (and some Bluetooth) work, while the Flipper drives it over a serial link.
This is the companion to the Flipper Zero hub page, zoomed in on that one
add-on.

Two boards are common:

  — WiFi Dev Board. The official add-on, or a clone, built around an
    ESP32-S2 or ESP32-S3. It is shaped to sit straight on the Flipper header.
  — Generic ESP32. Any ESP32 dev board works if you wire its UART to the
    Flipper at 3.3V with a shared ground.

Either way the ESP32 is the radio; the Flipper is the screen and keypad in
front of it. Everything here assumes networks you own or are authorized to test.

The firmware that does the WiFi work runs on the ESP32, not on the Flipper.
You flash it onto the board once, then the Flipper just talks to it. Two
projects dominate:

  — ESP32 Marauder. The long-standing WiFi and Bluetooth toolkit:
    scanning, monitoring, beacon and probe work, and sniffing, with a Flipper
    app front end.
  — Bruce. A broader ESP32 firmware that folds WiFi and BLE tools in
    alongside other radios, also popular on the dev board.

Both run entirely on the ESP32 and are flashed separately from the Flipper's
own firmware. What they give you is WiFi scanning and monitoring, some BLE work,
and the usual probe and beacon utilities, for networks you own or are authorized
to test. Offensive features exist; the authorization rule below is not optional.

Flashing happens over USB, straight to the ESP32, and has nothing to do with
the Flipper's own update process. You do it once per firmware change.

The easy path is in the browser. This site's ESP32 web flasher talks to the
board over USB from the browser, with no toolchain to install, which is the
simplest way to get Marauder or Bruce onto a board. The command-line
alternative is esptool, the same tool the web flashers wrap.

This page stays high level on purpose: the flasher guide walks the actual
steps. Flash the board first, then come back and wire it to the Flipper.

The dev board plugs onto the Flipper's GPIO header. The Flipper talks to the
ESP32 over UART, a plain serial link: the Flipper's TX goes to the board's
RX, the Flipper's RX goes to the board's TX, both sides share a ground, and the
board takes 3.3V. Never feed an ESP32 pin 5V from the Flipper.

The four connections that matter:

  — 3V3 (header pin 9) powers the board.
  — GND (header pin 11, or any ground pin) is the shared ground.
  — TX (header pin 13) is the Flipper transmit, into the board's RX.
  — RX (header pin 14) is the Flipper receive, from the board's TX.

The official WiFi Dev Board lines these pins up so it simply clicks on; with a
generic ESP32 you run four jumper wires to the same four points.

The same 18-pin header is a general expansion bus, so the ESP32 is only one of
the things you can hang off it:

  — CC1101. An external Sub-GHz radio board that extends range beyond the
    built-in radio.
  — NRF24. 2.4 GHz modules for their own class of radio work.
  — GPS. A serial GPS module for location and timing, wardriving-style
    logging included.
  — Video Game Module. The official add-on, built on an RP2040, for games
    and extra output.

Only one board fits the header at a time, so pick the add-on for the job. The
ESP32 is the one you want for WiFi.

WiFi work raises the stakes over the rest of the Flipper's radios, because it is
so easy to reach other people's networks, by accident or on purpose.

  — Owned or authorized only. Scan, monitor, and test networks you own or
    have explicit written permission to test. Nothing else.
  — Active attacks are a different line. Deauthentication and similar
    jamming-style attacks are disruptive and, against networks you do not own,
    illegal. They are not covered here.
  — Detect, do not attack. This site hosts defensive tooling, like a deauth
    detector, not attack payloads. Offensive firmware features are for
    authorized testing only.

Passive scanning sits in a grey area and is widely done; active interference
does not. None of this is legal advice. When in doubt, do you own it, or do you
have it in writing.

Does the Flipper Zero do WiFi on its own?
No. The Flipper Zero has no WiFi radio inside. You add WiFi with an external
ESP32 board on the GPIO header, which the Flipper drives over UART. Without that
board there is no WiFi at all.

Which ESP32 board should I use?
The common choice is an ESP32 WiFi dev board, the official one or a clone, built
around an ESP32-S2 or ESP32-S3. A generic ESP32 board works too, as long as you
can wire its UART to the Flipper at 3.3V. The board runs its own firmware, ESP32
Marauder or Bruce, flashed separately from the Flipper.

How do I flash the ESP32 board?
Over USB, with a flashing tool, not through the Flipper. The easiest path is
this site's browser-based ESP flasher, which talks to the board over USB from
the browser. You can also use esptool from the command line. You flash the ESP32
with Marauder or Bruce, separately from the Flipper's own firmware.

Is WiFi scanning legal?
Passive scanning of the airwaves sits in a grey area and is widely done, but
active attacks such as deauthentication are only for networks you own or are
authorized in writing to test. Unauthorized use is illegal regardless of the
tool. This site hosts detectors, not attack payloads.