PORTAL.HACK Firmware

Firmware for advanced security tests on M5StickC Plus and M5StickC Plus 2 ESP32 Devices

• BLE-HACK: Spam of Bluetooth Low Energy devices.
• BLE-FASTSPAM: Rapid spam of BLE devices, constantly sending notifications.
• BLE SCAN: Scanning Bluetooth Low Energy networks and displaying devices.
• BLE WIN BAD-USB: Executing BadUSB attacks on Windows PCs via Bluetooth.
• BLE RUBBERDUCKY: Executing Rubber Ducky attacks via Bluetooth.
• nRF24 JAM: Jamming Bluetooth devices using the nRF24 antenna.
• EXFILTRATE CORP.: Extracting system information from Bluetooth devices.
• IOS-CRASH: Crashing or disrupting iOS devices via Bluetooth.
• ANDROID-CRASH: Crashing or disrupting Android devices via Bluetooth.

• WIFI-HACK: Attacking Wi-Fi networks by exploiting protocol vulnerabilities.
• WIFI PCAP FILE SAVE: Saving Wi-Fi packets in PCAP format for analysis.
• PORTAL.ino - Wi-Fi Function: Fake Wi-Fi hotspot for social engineering attacks and credential harvesting.

• RF SIGNAL JAM: Jamming RF signals.
• RF REMOTE JAM: Web-controlled device for disrupting RF signals.
• RF GRABBER: Capturing RF signals.
• RF REPLY: Replaying captured RF signals.
• RF SCANNER: Scanning RF signals.
• RF RECORD: Recording RF signals.
• RF REC-REPLY: Replaying recorded RF signals.
• RF COPY-RAW: Copying raw RF signals.
• RF SEND-RAW: Transmitting raw RF signals.
• RF SUB SEND: Sending RF signals from .sub files.
• RF FILE-SAVE: Saving RF signals to SD card.
• RF CUSTOM REPLY: Custom response to RF signals via web interface.
• RF AUDIO JAM: Jamming audio signals transmitted via RF.
• CC1101 GRAB: Capturing RF signals using the CC1101 antenna.
• CC1101 REPLY: Replaying captured signals using CC1101.
• CC1101 SCANNER: Scanning RF signals in real-time using CC1101.
• CC1101 JAMMER: Using CC1101 to jam radio signals.
• CC1101 BRUTE: Brute-force attack for 24-bit Princeton RF remotes using the CC1101 antenna.
• CC1101 SYNC: Synchronizes rolling code remotes and allows PORTAL.HACK to emulate them as a real remote.
• RF FS SAVE: Saves RF signals directly to M5Stick internal storage (no SD card required).
• RF FS SEND: Replays RF signals stored on the device's internal memory.
• CC1101 TESLA: Opens Tesla charging ports using the CC1101 antenna.
• TESLA PORT OPEN: Opening Tesla charging ports.
• TESLALOOP: Continuously sends Tesla charge port open signal in a loop, preventing it from closing while in range.
• CC1101 SYNC: Synchronizes multiple CC1101 signals.
• RF RECORD LFS: Records signal data using LittleFS (internal storage, no SD card required).
• RF REPLAY LFS: Replays recorded signals from LittleFS.
• SCROLLSCANNER: RF spectrum scanner with real-time waterfall display, similar to SDR visualizations.
• CC1101SCROLL: CC1101-based waterfall RF scanner for visualizing signal activity across frequencies.

• IR-BRUTE: Brute-force attacks on IR remote control systems.
• IR LEARN: Learning and saving IR signals.
• IR SEND: Sending copied IR signals.
• IR SCANNER: Scanning IR signals in real-time.
• IR FILE-SAVE: Saving IR signals to SD card.
• IR CUSTOM REPLY: Sending custom IR signals via web interface.
• IR DATA SCAN: Scanning and displaying IR data.
• TRAFFIC LIGHTS IR: Manipulating traffic lights via IR signals.
• NIGHT-CAMERA JAM: Jamming night vision cameras via IR signals.
• IRLIST COPY: Copies a saved sequence of IR signals into memory for review, editing, or replay.
• IRLIST SEND: Captures and stores a list of IR signals, then allows full batch replay in sequence.
• IR LEARNING LFS: IR learning and saving to LittleFS.
• IR REPLAY LFS: IR signal replay from LittleFS storage.

5. Brute Force on RF Devices

• RF DEVICE BRUTE: Brute-forcing RF devices to identify access codes.
• RF LIGHTS BRUTE: Brute-forcing RF-controlled lighting systems.
• PARKING GATE BRUTE: Brute-forcing parking gate systems.
• CEILING FAN BRUTE: Brute-forcing RF-controlled ceiling fans.
• DEBRUIJN BRUTE: Brute-force attack using De Bruijn algorithm.
• CAME 12bit BRUTE: Brute-forcing CAME 12-bit systems.
• CAME 24bit BRUTE: Brute-forcing CAME 24-bit systems.
• LINEAR 10bit BRUTE: Brute-forcing linear 10-bit systems.
• PRINCETON 24bit BRUTE: Brute-forcing Princeton 24-bit systems.
• KEELOQ BRUTE: Brute-forcing KeeLoq systems.
• NICE FLO BRUTE: Brute-forcing Nice Flo systems.
• HOLTEK BRUTE: Brute-forcing Holtek systems.
• RESTAURANT RATEKESS PAGERS BRUTE: Brute-forcing Ratekess restaurant pagers.
• PT-2240 BRUTE: Brute-forcing PT-2240 systems.
• UNILARM 25bit BRUTE: Brute-forcing Unilarm 25-bit systems.

• NFC SCANNER: Scanning NFC cards and displaying UID.
• NFC DOOR BRUTE: Brute-forcing NFC door systems.
• PN532 CLONE: Clone NFC tag data directly to device memory using the PN532 module (no SD card required).
• PN532 SCAN: Scan and display the UID of NFC chips using the PN532 reader.
• RFID FASTBRUTE: Fast brute-force on RFID (Mifare) systems.
• RFID SLOWBRUTE: Slow brute-force on RFID (Mifare) systems.
• MIFARE UNLOCK: Replay function for RFID brute force attacks.
• CLONE RFID TAG: Full cloning of RFID cards.
• REPLY RFID TAG: Replay data from an RFID card.
• COPY RFID UID: Copying the UID of an RFID card.
• REPLAY RFID UID: Replaying the UID of an RFID card.
• EMULATE TAG: Emulating a cloned RFID card.
• PN532VIEW: Adds a visual NFC tag viewer for PN532.

• SHOP CART UNLOCK: Unlocking smart supermarket shopping carts.
• SAFE UNLOCK: Unlocking safes using the Flipper Zero SentrySafe method.

8. Security and Utility Functions

• DETECT SKIMMERS: Detecting skimmer devices to ensure card security.
• DETECT PWNAGOTCHI: Detecting Pwnagotchi devices.
• DETECT FLIPPERZERO: Detecting other Flipper Zero devices.
• EMP GENERATOR: Generating electromagnetic pulses (EMP) for testing.
• GPS INFO: Displaying GPS information such as location and altitude.
• SOUND NOISE: Emitting annoying sounds to disrupt or alert.
• LED LIGHT: Controlling an LED for visual effects or indications.
• WEBFILEMANAGER: Web-based file manager for device internal storage.
• REMOTESCREEN: Creates a Wi-Fi network to remotely view and control the PORTAL.HACK screen from a connected device, like a smartphone.

9. Simulations and Extra Features

• TAMAGOTCHI: Simulating a virtual pet like a Tamagotchi.
• WEB LINKS: Quick access to web resources for hacking.
• SETTINGS: Accessing the device's configuration menu.

PORTAL.ino - Wi-Fi Function

In PORTAL.HACK Portal mode, an open WiFi Hotspot named "Vodafone Free WiFi" (configurable by clone another AP) is activated. It serves a fake login page for social engineering attacks, capturing entered usernames, passwords, emails, and OTPs. Cloning existing SSIDs is possible from the WiFi Scan details. Captured credentials can be viewed by connecting to the portal and browsing to http://172.0.0.1/creds. Custom SSIDs and settings can be configured in a similar manner. SD Card support logs usernames and passwords to portal-hack-creds.txt.

Note: PORTAL.HACK is intended for professional engagements, education, or demonstration purposes only. Unauthorized use of personal information is against the law.

Join our Discord community for support, updates, and discussions!