Flipper postman esp32s2

Project Overview

Hey there, fellow tinkerers and security enthusiasts! SpaceGhost here, and I’ve got an exciting project to share with you. My recent adventures with Flipper device programming have led me down another fascinating rabbit hole. This time, I’ve embarked on a mission to bring network capabilities to the Flipper Zero by developing custom firmware for the official ESP32 chip board.

Image source: https://docs.flipper.net/development/hardware/wifi-developer-board/schematics

The Power of ESP32

Before we dive into the project details, let’s take a moment to appreciate the ESP32 chip. Developed by Espressif Systems, this little powerhouse has become a favorite in the IoT and embedded systems world. Here’s a quick rundown of its impressive capabilities:

• Dual-core processor running at up to 240 MHz
• Wi-Fi and Bluetooth connectivity
• Robust security features
• A plethora of peripherals and interfaces
• Low power modes for energy-efficient operation
• Extensive development support

With these features, the ESP32 is perfectly suited for our goal of enhancing the Flipper Zero’s capabilities.

Project: Flipper Postman ESP32-S2

Our project, which I’ve dubbed “Flipper Postman ESP32-S2,” aims to create custom flash software for the Flipper Dev Board. This software exposes WiFi and HTTP methods via serial (UART), allowing the Flipper Zero to pick them up and build web-enabled applications.

Key Features

• WiFi network management (connect, disconnect, list networks)
• HTTP requests (GET, POST, PATCH, STREAM)
• Custom HTTP request builder
• UDP communication
• LED indicators for various states

How It Works

The custom firmware acts as a bridge between the Flipper Zero and the internet. Here’s a simplified workflow:

1. Flash the custom firmware onto the ESP32-S2 board.
2. Connect the board to the Flipper Zero.
3. Use UART commands to control WiFi connections and make HTTP requests.
4. The ESP32-S2 handles the network operations and returns the results to the Flipper Zero.

This setup essentially turns your Flipper Zero into a pocket-sized web client, opening up a world of possibilities for security testing, IoT experimentation, and more.

Potential Applications

With this new capability, we can explore several exciting avenues:

1. WiFi Penetration Testing: Create portable tools for network scanning, deauthentication attacks, and security audits.

2. IoT Device Emulation: Simulate various IoT devices to test network security or set up honeypots.

3. Remote Control and Monitoring: Implement web interfaces or mobile apps to control your Flipper Zero remotely.

4. Mesh Networking: Develop networks of multiple Flipper devices for distributed tasks or long-range communication.

5. Signal Processing and SDR: Implement basic software-defined radio functionalities or create spectrum analyzers.

6. Network Protocol Analysis: Build portable packet sniffers, protocol analyzers, and debugging tools.

7. Environmental Sensing: Integrate various sensors for portable weather stations or environmental monitoring.

Project Information

Github repo

Custom flash software for Flipper Dev Board exposing the WIFI and HTTP methods via serial (UART) that can be picked up by the flipper zero device for building web enabled applications.

Features

• Connect / Disonnect to WiFi networks
• List available WiFi networks
• Make HTTP GET, POST, PATCH and STREAM requests
• Custom HTTP request builder with all the methods GET, POST, HEAD, DELETE, PATCH, PUT, attach custom headers (Authorization), show and hide response headers
• Stream serial responses for large payloads.
• UDP communication, send commands and messages over the network via UDP packets
• LED indicators for different states

UDP / Network communication

After you establish wifi the board listens to UDP packets you can use mobile apps (with TCP/UDP) or use cmd line tools like echo -n "GET https://api.spacexdata.com/v3/rockets" | nc -u 192.168.0.115 1234.

The board will transmit the local port and into the serial

You can also send custom messages to the flipper, type MESSAGE: {your text} for transmitting whatever you want to your flipper device.

Flipper Zero Uart Terminal

You can use the https://github.com/cool4uma/UART_Terminal to communicate directly with the board. You don’t have to write https:// it will be auto added by the board.

Arduino Ide Serial Monitor

Communication via usb to flipperzero (GPIO->USB-UART Bridge) with Arduino Ide Serial Monitor

Installation (Build from source)

0. Git clone the project
1. Install Arduino IDE
2. Arduino IDE -> Settings (Preferences)

Copy and paste the https://raw.githubusercontent.com/espressif/arduino-esp32/gh-pages/package_esp32_index.json

3. Wait for installation
4. Arduino IDE -> Tools -> Board -> Board Manager -> look for esp32 by Expressif systems and install
5. Arduino IDE -> Tools -> Manage Libraries -> find ArduinoJSON package and install
6. Arduino IDE -> Select Board -> choose esp32s2 dev board

UART Terminal Application. You can also connect flipper to your computer via usb cable then enter GPIO and enable the UART-USB Bridge to communicate directly to board via Arduino IDE Serial Monitor or minicom cmd line program

7. Set the SSID and password for the WiFi connection using the SET_SSID and SET_PASSWORD commands.
8. Activate the WiFi connection using the ACTIVATE_WIFI command.
9. Use the GET, POST, or GET_STREAM commands to make HTTP requests.
10. Build custom HTTP requests using the BUILD_HTTP_* commands.
11. Execute custom HTTP requests using the EXECUTE_HTTP_CALL command.
12. Use the ? or HELP commands to print help information.

SERIAL API Documentation

This section provides detailed information about the available commands, their descriptions, arguments, responses, and response types. It also includes the possible serial responses that the receiver can expect.

Commands

Sending Commands

To set the SSID for the WiFi connection:

Copy 
1SET_SSID MyWiFiNetwork

To make an HTTP GET request:

Copy 
1GET https://api.example.com/data

To make an HTTP GET request and stream the response:

Copy 
1GET_STREAM https://api.example.com/data

To make an HTTP POST request with a JSON payload:

Copy 
1POST https://api.example.com/data {"key":"value"}

HTTP Builder

The firmware holds a http config you can manipulate and then execute the call. Check the flags in the table above.

Show response headers

HTTP builder if set for showing headers will only transmit the headers from this list "Content-Type", "Content-Length", "Connection", "Date", "Server"

Simple Build call

BUILD_HTTP_METHOD HEAD BUILD_HTTP_URL https://api.com/ EXECUTE_HTTP_CALL

Receiving Responses

When you send a GET_STREAM command, you will receive the following responses:

Copy 
1GET_STREAM request to: https://api.example.com/data
2STREAM:
3<streamed data>
4STREAM_END

When you list available WiFi networks:

Copy 
1WIFI_LIST: Available WiFi networks: <list>

Notes

• The firmware currently follow strict redirects (HTTPC_STRICT_FOLLOW_REDIRECTS - strict RFC2616, only requests using GET or HEAD methods will be redirected (using the same method), since the RFC requires end-user confirmation in other cases.)
• Website crawls will print html only on smaller websites.
• You should be able to stream files and images to flipper via stream (untested)
• Simple get call will make a head call first and determine the possible size of the content, that will not always be possible, if the content length is unknown, firmware will choose safer stream method

ESP32 links

• ESP32 Arduino Setup
• ESP-IDF
• ESP32S2 Specs

Author: SpaceGhost @ spaceout.pl