What started as a tiny ESP32 board listening for Wi-Fi networks turned into one dashboard watching the airwaves and the sky above the lab at the same time.
None of it began as one project. I flashed a wardriving tool onto a spare board to see what it could do. That gave me data I wanted to keep private, which led to a self-hosted map, a custom importer, an automated cracking app and finally a new layer in Pixel Radar.
A pocket-sized wardriver
The hardware end is an ESP32-C5 running Biscuit, wireless security research firmware controlled from a phone over Bluetooth. Once paired with the companion app, it can scan Wi-Fi and Bluetooth traffic or run a wardrive that records the access points and BLE devices it hears with the phone’s location data.
There is no laptop or separate GPS dongle to carry. The phone stays in a pocket and the board does the listening.
Keeping the data in the lab
Uploading a wardrive to WiGLE is the usual route, but it also means sending the collected network data to somebody else’s service. I wanted the map without that round trip.
Pwnamap became the local replacement. It runs on the home-lab server, keeps its own database and exposes a WiGLE-compatible API. Biscuit’s export still could not go straight in, so I wrote the missing bridge: an importer that takes Biscuit’s CSV output and feeds it into Pwnamap, ready to browse on the local map.
The importer was its own small build. It normalises what Biscuit exports, preserves the useful radio and location fields, and avoids a public upload anywhere in the chain.
Automating the crack
Capturing a handshake is only half the job in an authorised test. The old workflow meant moving files to a Linux box over SSH, converting them by hand and typing out Hashcat jobs every time.
I replaced that with a desktop app that handles the pipeline in one window. Drop in a capture and it converts the file, sends it to the cracking host and starts the job. Speed, GPU temperature, progress and estimated time remaining come back live.
The app can also select a tailored keyspace for a small set of router families whose factory credentials follow known patterns. It does not expose those patterns in the interface or this post. The useful part is the orchestration: identify an applicable test, choose the bounded job and keep a clear fallback when the guess is wrong.
The checkpoint that lied
Long jobs needed to survive a stop or reboot. Hashcat restore files handled that until I moved a project folder. The stale checkpoint still pointed at the old path, so the next run failed almost instantly and quietly looked like a completed “not cracked” result.
The app now checks the restore state before trusting it. If the stored path is broken, it reports the problem and starts the job cleanly instead of turning an environment error into a false result.
The Plusnet question
One router-aware test became a research side quest. Plusnet and BT have shipped closely related hub hardware, and a publicly discussed BT factory-key quirk narrows its character set by omitting easily confused characters. That raised a question: does the equivalent Plusnet generation use the same rule?
I have not proved that it does. Rather than build an assumption into the main attack, the narrower search lives behind a separate experimental control. If it finds nothing, the app falls back to the complete search. The test is deliberately marked as a hypothesis until I can verify it against owned hardware.
One window for sky and ground
Pixel Radar was already plotting live ADS-B aircraft received by the SDR stack. Pwnamap had its own map full of terrestrial radio observations. Once both systems were local, joining them stopped looking strange and started looking obvious.
A small backend addition pulls the wardrive records from Pwnamap and presents them as a second Pixel Radar layer. Nearby observations collapse into numbered clusters, then split into individual pins and detail popups as the map zooms in. Private identifiers stay out of public views.
The result is one window showing what is flying overhead and what is broadcasting on the ground. I did not expect an aircraft tracker and a wardriving tool to share a screen, but underneath the styling they are both points on a map with a timestamp attached.
Next: more GPU
The cracking side is now the bottleneck. Some factory-key search spaces still take serious GPU time, so an unused mining frame is next in line for a second life as a dedicated multi-GPU cracking box.
That can have its own write-up when the parts arrive and the first real job survives the new hardware.
Zombie