Ghostscale Business Card Microcontroller Project

The Ghostscale business card is a purposefully designed printed circuit board (PCB) that can be assembled into a Wi-Fi and Bluetooth testing and attack tool, running ESP32 Marauder via an ESP32 development board and a microSD card module for extensible storage.

Our card has additional project capabilities, too! Come visit us at another event to learn more!

What can it do?

Once you build out the base functionality, the business card has a suite of offensive and defensive tools to scan and sniff Wi-Fi and Bluetooth signals. When you plug in an SD card, it can also perform an evilportal attack, collect data during Wi-Fi or Bluetooth wardriving, and log authentication or PMKID frames for later offline WPA2 password cracking.

Instructions for Use

Using your newly built business card microcontroller project for testing is easy! The base business card runs ESP32 Marauder from the serial command line (learn more about ESP32 Marauder).

  1. Insert a microSD card into the microSD card module (optional but needed for some commands)
  2. Plug the ESP32 module into your laptop using a USB cable
  3. Determine the COM port the ESP32 module is using
    • On Windows, open a command prompt and type mode
      • You may need to install a CH340 USB adapter driver on Windows if the device is not showing up
    • On Linux, run sudo dmesg and look for the /dev/ttyXXXX port of the new device
  4. Connect to the ESP32 module using a serial COM port tool (e.g., Putty, screen, Arduino IDE) at 115200 baud
  5. Type help for a list of ESP32 Marauder commands available
    • For example, the command sniffpmkid -c 11 tells the device to start logging any WPA2 PMKID packets on channel 11 to a packet capture (PCAP) file on the SD card
    • Once connected, you can use hcxpcapngtool (part of the Linux hcxtools package) to convert the PCAP file into a data file for use with hashcat
  6. With the custom Ghostscale firmware, if you create a file named AUTOEXEC.ESP at the root of your SD card and put a ESP32 Marauder command on the first line of that file, the business card will automatically run that command at boot

Firmware

When you built the business card with us during the conference, you programmed it with a custom version of the ESP32 Marauder program that includes an added feature to run a command at startup from an AUTOEXEC.ESP file.

If you want to download and (re)install the firmware, select the appropriate version below (the version is written above the Bluetooth expansion slot; v1.0 does not have any writing) and run the command in programmingcommands.txt within the .zip file to load the firmware onto the ESP32 module.

Circuit Diagram

Here is the circuit diagram for the Ghostscale bcard v1.1. The v1.0 bcard is identical, except the SD card CS pin is ESP32 pin 4 (not ESP32 pin 22).

Bill of Materials

Parts required to build the base Ghostscale bcard:

PartQuantityNotes
Ghostscale bcard printed circuit board (PCB)1
ESP32 development module130 pins and the four corner pins must be VIN, EN, D23, and 3v3
MicroSD card reader module1The six pins in order must be 3v3, CS, MOSI, CLK, MISO, GND
MicroSD card (optional)1Any size
1x 15-pin female header22.54mm pitch
1x 6-pin female header12.54mm pitch

Loading Other Firmware

The ESP32 board together with the SD card opens up a wealth of other project opportunities. Here are just a few examples:

NOTE: You may need to modify these or other projects to match the Ghostscale business card pinout – the MicroSD card uses the ESP32 “VSPI” pins (D23, D19, D18) and has VSPI CS on pin D4 for v1.0 bcards and pin D22 for v1.1 bcards.

What are all these other holes?

The board includes a slot for a JDY-31 Bluetooth module. You can pick up one of these inexpensive modules, program it to run at 115200 baud and plug it into the board, allowing you to send serial commands to the ESP32’s default (RX0/TX0) serial interface.

The remaining holes are for future expansion capabilities. If you bring your Ghostscale business card and come see us at the same conference next year or another future event, we’ll help you extend your device’s capabilities with add-on boards that you can build and collect!

Please Use Ethically

The Ghostscale business card is intended for research and authorized testing purposes. Users are responsible for ensuring compliance with all relevant laws and regulations.