---
title: "versatile wireless security and network analysis: Ghost_ESP"
url: "https://maker.wiznet.io/lawrence/projects/ghost-esp/"
markdown_url: "https://maker.wiznet.io/lawrence/projects/ghost-esp/md"
type: "UCC: User Created Content"
author: "jay candel"
author_url: "https://github.com/jaylikesbunda/Ghost_ESP"
editor: "WIZnet"
editor_url: "https://maker.wiznet.io/"
original_author: "jay candel"
original_url: "https://github.com/jaylikesbunda/Ghost_ESP"
published: "2026-02-05"
language: "en"
tags: ["ESP32", "W5500", "Hibrid Network"]
hardware: ["Espressif ESP32", "WIZnet W5500"]
likes: 0
views: 422
comments: 0
source: "WIZnet Makers (https://maker.wiznet.io/)"
---

# versatile wireless security and network analysis: Ghost_ESP

> versatile wireless security and network analysis

Original author: jay candel (source: https://github.com/jaylikesbunda/Ghost_ESP)

## Components

- **Espressif ESP32** x 1 ([docs](https://www.espressif.com/en/products/socs/esp32))
- **WIZnet W5500** x 1 ([docs](https://docs.wiznet.io/Product/Chip/Ethernet/W5500))

WIZnet parts: W5500 ([Datasheet](https://docs.wiznet.io/Product/Chip/Ethernet/W5500/datasheet?utm_source=maker&utm_medium=project&utm_campaign=w5500), [product hub](https://maker.wiznet.io/products/w5500/))

## Article

## 1. 프로젝트 개요 및 특징

Ghost_ESP는 저가형 마이크로컨트롤러인 ESP32를 강력한 네트워크 침투 테스트(Penetration Testing) 도구로 변환해주는 오픈소스 펌웨어입니다.

다양한 하드웨어 지원: ESP32 기본형부터 C3, S3 변종 보드를 지원하며, 특히 화면이 포함된 CYD(Cheap Yellow Display)나 웨어러블 기기인 T-Watch S3에서도 구동 가능합니다.

다중 프로토콜 지원: WiFi와 블루투스(BLE)뿐만 아니라 GPS, IR(적외선), NFC 등 다양한 통신 규격을 지원하여 광범위한 보안 테스트가 가능합니다.

접근성: 고가의 전문 보안 장비 없이도 누구나 저렴한 비용으로 무선 네트워크의 보안 수준을 점검할 수 있도록 설계되었습니다.

---

## 2. 하이브리드 네트워크 (Hybrid Network)

이 프로젝트의 핵심은 무선(WiFi/BLE)과 유선(Ethernet)을 동시에 다루는 하이브리드 구조에 있습니다.

매체 간 브릿징: 무선으로 수집한 데이터를 유선망으로 전송하거나, 반대로 유선 인터넷 신호를 무선 AP(액세스 포인트) 형태로 배포하는 게이트웨이 역할을 수행합니다.

통제와 공격의 분리: 무선 인터페이스가 공격(Deauth, Spam 등)으로 인해 불안정해지더라도, 유선 이더넷을 통해 장치를 안정적으로 제어하고 상태를 모니터링할 수 있는 이중 구조를 가집니다.

---

## 3. 사용되는 주요 솔루션 및 기능

이 프로젝트는 소프트웨어와 하드웨어를 결합하여 다음과 같은 구체적인 보안 솔루션을 제공합니다.

| **구분** | **주요 기능 및 솔루션** | **설명** |
| --- | --- | --- |
| WiFi 보안 | Deauth & Beacon Spam | 무선 연결 해제 공격 및 가짜 AP 생성 테스트. |
| 피싱 테스트 | Evil Portal | 가짜 로그인 페이지를 통한 인증 정보 수집 시뮬레이션. |
| 블루투스 | BLE 스캐닝 & AirTag | 주변 저전력 블루투스 기기 추적 및 위치 확인. |
| 데이터 수집 | Wardriving (GPS) | 위치 정보를 포함한 주변 무선 망 지도 작성 (WiGLE 지원). |
| 복제 및 제어 | IR & NFC | 적외선 리모컨 신호 복제 및 근거리 무선 통신 카드 분석. |

---

## 4. W5500의 역할과 기술적 구현

`ethernet_manager.c` 코드를 통해 확인된 W5500은 프로젝트에서 유선 통신의 핵심을 담당합니다.

하드웨어 TCP/IP 스택 제공: ESP32의 CPU 부하를 줄이면서 안정적인 유선 네트워크 연결을 지원합니다.

SPI 기반 인터페이스: MOSI, MISO, SCK, CS, INT 핀을 사용하여 ESP32와 고속으로 데이터를 주고받습니다.

안정적인 관리 채널: 무선 환경이 혼잡하거나 공격 패킷으로 인해 WiFi 통신이 불가능한 상황에서도 장치에 접속할 수 있는 Out-of-band 관리 경로를 제공합니다.

데이터 스트리밍: 수집된 대량의 패킷 데이터를 손실 없이 PC나 서버로 전송하기 위한 고속 통로 역할을 합니다.

---

### 요약 및 결론

Ghost_ESP는 ESP32의 무선 기동성과 W5500의 유선 안정성을 결합한 하이브리드 보안 도구입니다. 저비용으로 전문적인 네트워크 분석 환경을 구축하려는 보안 전문가나 연구자들에게 매우 효율적인 솔루션을 제공합니다.

## 1. Project Overview & Key Features

Ghost_ESP is an open-source firmware project designed to transform the ESP32 microcontroller into a versatile wireless security and network analysis tool. It is often described as a "Revival" version of previous security tools, offering expanded hardware support and modern features.

Broad Hardware Support: It supports various ESP32 variants (C3, S3) and is optimized for devices with displays, such as the CYD (Cheap Yellow Display) and T-Watch S3.

Multi-Protocol Capability: Beyond WiFi, the project integrates Bluetooth (BLE), GPS for wardriving, and even Infrared (IR) or NFC functionality depending on the hardware.

Educational Security Tool: It serves as a low-cost alternative to professional devices like the Flipper Zero or WiFi Pineapple for ethical hacking and security research.

---

## 2. Hybrid Network Architecture

A defining characteristic of this project is its Hybrid Network approach, which simultaneously manages both wireless and wired interfaces.

Media Bridging: The device can act as a bridge, relaying data between a wireless network (WiFi/BLE) and a wired network (Ethernet).

Operational Redundancy: By using a wired connection for management, the user maintains a stable control link even when the wireless radio is saturated or unstable due to testing activities like Deauthentication attacks or packet spamming.

Gateway Functionality: It can function as a gateway, providing internet access to "clients" on a fake Access Point (Evil Portal) through its wired Ethernet backhaul.

---

## 3. Key Solutions and Applications

The project implements several specialized modules to address different network security needs:

| **Category** | **Solution / Feature** | **Description** |
| --- | --- | --- |
| WiFi Testing | Deauth & Beacon Spam | Testing network resilience by disconnecting devices or flooding the area with fake SSIDs. |
| Phishing Research | Evil Portal | Creating captive portals to simulate and study credential harvesting techniques. |
| Reconnaissance | Wardriving | Mapping wireless networks geographically using GPS module integration. |
| Peripheral Hacking | BLE & IR Tools | Tracking AirTags, sniffing BLE signals, or cloning infrared remote controls. |

---

## 4. The Critical Role of the W5500

The `ethernet_manager.c` file confirms that the W5500 (an SPI-based Ethernet controller) is a cornerstone of this system's reliability.

Stable Out-of-Band Management: As seen in the code, the W5500 provides a dedicated wired path for the Web UI, ensuring the operator never loses access to the device during intense wireless operations.

SPI Interface Integration: The firmware handles complex pin configurations (MOSI, MISO, SCK, CS, INT) to interface the W5500 with the ESP32, specifically managing hardware constraints on chips like the ESP32-S3.

Hardware TCP/IP Offloading: By utilizing the W5500’s built-in TCP/IP stack, the ESP32’s CPU is freed up to focus on time-sensitive wireless packet injection and signal processing.

High-Speed Data Logging: It allows for the reliable streaming of captured network traffic to an external server or PC without the packet loss common in congested wireless environments.

---

## Ghost_ESP Project: Frequently Asked Questions

### 1. What exactly is Ghost_ESP?

Ghost_ESP is an open-source firmware designed to turn an ESP32 into a powerful, portable tool for wireless security auditing. It features a suite of tools for testing WiFi and Bluetooth vulnerabilities, similar in spirit to professional devices like the Flipper Zero.

### 2. Why does this project use the W5500 Ethernet controller?

While the ESP32 has built-in WiFi, the W5500 provides a critical wired management layer. This "Hybrid" setup allows you to:

Maintain Control: Access the Web UI over a stable Ethernet cable even while the WiFi radio is busy performing deauthentication or spam attacks.

Create Gateways: Act as a bridge to provide real internet access to a "rogue" Access Point (Evil Portal).

Offload Processing: Use the W5500's hardware TCP/IP stack to keep the ESP32’s CPU free for time-sensitive security tasks.

### 3. Which hardware is supported?

The project is highly versatile and supports multiple ESP32 variants:

Core Chips: ESP32, ESP32-C3, and ESP32-S3.

Specific Boards: Devices with integrated screens like the Cheap Yellow Display (CYD) and the T-Watch S3.

Peripherals: It supports SPI-connected Ethernet modules like the W5500, as well as GPS, IR, and NFC modules for expanded testing.

### 4. How do I configure the Ethernet pins?

As shown in the `ethernet_manager.c` source code, the project uses the SPI interface for the W5500. You must define the following pins in your configuration:

MOSI, MISO, and SCK (Data and Clock).

CS (Chip Select) and INT (Interrupt).

Note for ESP32-S3: The firmware specifically checks for pin 6 compatibility to ensure it doesn't conflict with strapping pins or flash memory.

### 5. What are the most popular features of Ghost_ESP?

The toolkit includes several "Swiss-army knife" features for security researchers:

WiFi Deauth: Testing how devices handle sudden disconnections.

Beacon Spam: Flooding an area with fake SSIDs to test WiFi scanner limits.

Evil Portal: Hosting a fake login page to research phishing techniques.

Wardriving: Mapping local wireless networks using GPS coordinates.

---

Source: https://maker.wiznet.io/lawrence/projects/ghost-esp/