Hacking ▍

What's on the bench

Per-physical-unit inventory. Sensitive fields (serials, MAC addresses, Wi-Fi keys) are sanitized at sync time and never reach the website.

Source updated .

HackRF One

Wideband SDR transmit + receive (1 MHz – 6 GHz)

  • "porta"

    HackRF One — Clifford Heath modified design, JSTVRO-manufactured ("H2R4" bundle)

    acquired
    2026
    location
    Bench, RF station
    purpose
    Standalone SDR with PortaPack for field work + bench analysis
    firmware
    PortaPack Mayhem (unified HackRF + PortaPack firmware) · 2.4.0

    field-readyprimary-sdrclifford-heath-modportapack-h2-plus

Clockwork PicoCalc

RP2040/RP2350 handheld with QWERTY + 320×320 IPS — programmable blank canvas

  • "calc"

    Clockwork PicoCalc (Pico 1 H module)

    acquired
    2026
    location
    Bench
    purpose
    Embedded coding handheld — Pico SDK C/C++ + MicroPython experiments

    benchprogrammable

Flipper Zero

Multi-tool RF/RFID/NFC/IR/BadUSB/GPIO front-end

  • "TJ411"

    Flipper Zero

    location
    Travel kit
    purpose
    Travel daily-driver — hotel-room IR remote (over BLE from Android phone), hotel keycard NFC emulation, casual WiFi survey, entertainment apps
    firmware
    Momentum · mntm-012 (release 31.12.25); Radio FW 1.20.0; BLE stack: light

    travel-kitdaily-driverno-modulesmomentumflipper

  • "AWOKflip"

    Flipper Zero

    location
    Bench (paired with AWOK Dual Touch V3 module)
    purpose
    Host for the AWOK Dual Touch V3 module — Wi-Fi/BLE wardriving and audit work that needs the AWOK's dual-ESP + touchscreen + GPS
    firmware
    Momentum · mntm-012 (release 31.12.25); Radio FW 1.20.0; BLE stack: light

    benchwardrivingawokmodule-hostmomentumflipper

  • "wifi-devboard"

    Flipper Zero WiFi Devboard (Model WD.1)

    location
    With Flipper kit
    purpose
    Official ESP32-S2 Wi-Fi/BLE platform for the Flipper — runs Marauder (Wi-Fi attacks: deauth, beacon spam, sniff, Evil Portal, BLE-spam), FlipperHTTP (JSON/HTTP bridge for FAPs), or the stock Black Magic Probe (USB → SWD GDB-server for FAP debugging). Mounts on any Flipper via the 18-pin GPIO header OR runs standalone via its own USB-C.
    firmware
    TBD — typically one of {Black Magic Probe (stock), ESP32 Marauder, FlipperHTTP}; the three are mutually exclusive on the single ESP32-S2 · TBD

    flipper-modulewifiesp32-s2marauderofficialdevboard

  • "game-over-host"

    Flipper Zero

    location
    Bench (paired with Game Over module)
    purpose
    Host for the Game Over module — Wi-Fi/BLE + sub-GHz (CC1101 daughter) or NRF24 mousejack work that benefits from Game Over's standalone OLED/joystick UI plus Flipper-bridged operation

    benchwi-fi-attacksub-ghznrf24game-overmodule-hostruckussupply-chain-caveat

GL-iNet GL-BE3600

Wi-Fi 7 travel router — OpenWrt-based pentest/privacy platform for hotels, cafes, conferences

  • "beryl"

    GL-iNet GL-BE3600 (Beryl AX Pro)

    location
    Travel kit
    purpose
    Portable Wi-Fi 7 travel router — hotel-Ethernet → personal Wi-Fi, VPN-at-the-edge, captive-portal helper, repeater, USB tethering
    firmware
    GL-iNet OpenWrt (Admin Panel) · TBD — check Admin Panel → System → Overview

    travel-kitrouterwifi-7openwrtdual-band

AWOK Dual Touch V3

Third-party Flipper Zero module - dual ESP32-WROOM + resistive touch + on-board GPS, for Wi-Fi/BLE wardriving and audit work

  • "awok"

    AWOK Dynamics Dual Touch V3

    acquired
    2026
    location
    Bench (mounted on AWOKflip Flipper Zero)
    purpose
    Wi-Fi/BLE wardriving + audit module. Dual ESP32-WROOM, resistive touchscreen (ILI9341 + XPT2046, NOT capacitive), on-board GPS with internal antenna routing. Runs Marauder, Ghost ESP, or Bruce on either ESP independently.
    firmware
    ESP32 Marauder (daily-driver per tjscientist 2026-05-12; Device Info screen read 2026-05-12) · Marauder HW: V6.1 (screen-side display chain); ESP-IDF: V5.5.1-710; Marauder release version: TBD (capture from Device Info banner — likely v1.12.x)

    benchwardrivingawokthird-party-modulemarauder

Ruckus Game Over

Third-party Flipper Zero module - ESP32-S3 + OLED/joystick UI + microSD + CC1101/NRF24 daughter slot. Wi-Fi/BLE/sub-GHz/2.4 GHz multi-radio for audit and pentest.

  • "game-over"

    Ruckus // section80 Game Over

    acquired
    2026
    location
    Bench (mounted on game-over-host Flipper Zero)
    purpose
    Multi-radio Wi-Fi/BLE + sub-GHz/2.4 GHz pentest module. ESP32-S3 onboard with OLED + joystick UI for standalone operation; 8-pin daughter slot accepts either CC1101 (sub-GHz) or NRF24 (2.4 GHz) - mutually exclusive.
    firmware
    Ruckus Marauder fork (vendor pre-loaded, closed-source) · TBD - vendor doesn't publish a version string in the binary release notes

    benchwi-fi-attacksub-ghznrf24game-overthird-party-moduleruckussupply-chain-caveat

DSTIKE Hackheld

ESP8266 standalone Wi-Fi attack handheld + open-source Arduino target — running Stefan Kremser (Spacehuhn)'s `esp8266_deauther` firmware on Travis Lin (DSTIKE)'s purple-PCB handheld

  • "hackheld"

    DSTIKE Hackheld V1 (purple PCB)

    location
    Bench / lab
    purpose
    Smallest standalone Wi-Fi attack platform in the lineup — pocket-sized ESP8266 with OLED + buttons + 1000 mAh battery, no host required. Pre-flashed with Spacehuhn `esp8266_deauther` v2.6.1. Doubles as the open-source educational ESP8266 target for custom Arduino / PlatformIO firmware (Vol 10 + Vol 11 of the deep dive). The 25 dBm PA on the DSTIKE WiFi+ module extends practical attack range vs a stock ESP-12-F.
    firmware
    Spacehuhn esp8266_deauther · 2.6.1

    benchwi-fi-attackesp8266deautherdstikespacehuhnstandaloneprogrammable

Bus Pirate 6

Embedded-protocol Swiss-army knife — UART, HDUART, I²C, SPI, JTAG/SWD, 1-Wire, smart card, DDR5 SPD, I²S, IR, LED — on 8 buffered I/O pins; the RP2350B + 74[REDACTED] look-behind buffer enables simultaneous drive+sample

  • "bp6"

    Bus Pirate 6 REV2 (RP2350B), enclosed

    acquired
    2026
    location
    Bench
    purpose
    Wired-protocol bring-up and recon. Pairs with HackRF One (RF protocol research) and Flipper Zero (front-line multi-tool) to cover the embedded-protocol half of the bench.
    firmware
    BusPirate5-firmware (main branch — unified tree covers BP5/5XL/6) · main branch commit 93aefde (2026-04-07 11:25:00 UTC, ian@wherelabs.com; commit adds # as syntax-parser line-comment)

    benchembedded-protocoldebuggerrp2350bus-pirate

Gigatronics 6060A Signal Generator

Receiver alignment, RF measurement, modulation reference (10 kHz-2.1 GHz, GPIB)

  • "siggen"

    Gigatronics 6060A or 6062A (model on bench flagged TBD)

    location
    Bench

    Rebadged Fluke 6060A-series. Model (6061A/6062A), branding era, reference-oscillator option, and last-cal date all bench-verification TBDs. Manuals in TestEquipment/Gigatronics 6060A/02-inputs/manuals/gigatronics/.

Radio City Products 665 (vintage VTVM)

High-Z DC/RF voltage measurement on vintage tube radios; insulation testing

  • "vtvm-665"

    Radio City Products Model 665 (period-dated October 1944)

    location
    Bench

    Four functions: megger (500V insulation), VTVM, ohmmeter, capacity meter. Tube complement + battery state TBD. Manuals in TestEquipment/Radio City Products 665 VTVM/02-inputs/manuals/rcp-665/.

Electrostatic CRT Tester — Mark 2

Bring up / test electrostatic-deflection-and-focus CRTs (scope/radar/indicator tubes) + neon/dekatron/Nixie/magic-eye/E1T/NIMO/Geissler devices

  • "crt-tester"

    Electrostatic CRT Tester Mark 2 (open-source kit, sgitheach.org.uk; CC BY-SA 4.0)

    location
    Bench

    Built by Jeff (DIY) from the Complete electronics kit (£200; SMD pre-fitted, through-hole + hardware bagged), in a CUSTOM case Jeff laser-cut himself (own design, not the maker acrylic), with CUSTOM tube-socket holders of his own. Build date + serial/provenance TBD; bench photos pending (Vol 5 FIGURE SLOTs). Supplies: 12 V DC in; heater ~6 W; grid -5..-120 V; focus adj; accel a2 <=+2.2 kV; PDA <=+5.6 kV; deflection +/-300 V; AC-coupled X/Y/Z; 4 mm banana panel. Deep dive: TestEquipment/Electrostatic CRT Tester Mark 2/02-inputs/volume_sources/ (8 vols). Photos still wanted: TestEquipment/Electrostatic CRT Tester Mark 2/02-inputs/volume_sources/PHOTO_SHOPPING_LIST.md