NRSuite-Android pairs an Android phone with a cheap ESP32 board to form a portable, no-root Wi-Fi and BLE security research platform for authorized testing.

NRSuite answers a question field operators ask constantly: how much wireless assessment capability can you stuff into a pocket without a laptop? The answer here is an Android application, written in Kotlin and licensed under GPL-3.0, that treats a commodity ESP32 board as a programmable radio peripheral. You install the app, flash the board with the companion nrsuite-firmware using an in-app flasher over USB-OTG, and the phone becomes the command console for a combined offense/defense toolkit spanning Wi-Fi recon, WPS auditing, BLE tooling, HID injection, and passive threat detection. The README is unusually disciplined for this genre: it front-loads an authorized-use-only notice referencing LEGAL.md, marks the project Beta, and points to a separate documentation site for depth.

Architecturally, the interesting choice is the strict split between radio and UI. The ESP32 handles monitor mode, packet generation, BLE advertisement, and USB HID emulation; the Android side owns everything with a screen, database, and crypto workload. That split shows up repeatedly in the feature design: the WPA/WPA2 Cracker runs offline dictionary attacks on the phone with pause/resume and checkpointed sessions, and WPS Pixie Dust recovery runs Pixiewps on-device after the ESP32 captures the M3 message. Pushing compute to the phone keeps the firmware small while still delivering capabilities that normally need a laptop.

Hardware compatibility is documented honestly via a capability matrix rather than marketing. Classic ESP32 and the ESP32-C3 cover Wi-Fi and BLE but lack native USB, so no mass storage or BadUSB. The ESP32-S2 adds USB HID but drops BLE; the ESP32-S3 is the only board that does everything; and the ESP32-C5 uniquely brings regulatory channel filtering alongside 2.4/5 GHz support. The README defers to the firmware repository for the authoritative per-board matrix, which is the right call given how quickly these tables drift.

The recon side is mature. Wi-Fi Scan reports SSID, BSSID, RSSI, security, and WPS flags with retry-serialized scans and preserved previous results — details that matter in the field when a scan mid-assessment fails. The Packet Sniffer does monitor-mode capture with PCAP export, band hopping, and channel-locked capture. Probe Request Monitor flags randomized MACs, Channel Analyzer visualizes 2.4/5 GHz occupancy with nearby APs sorted by RSSI, and the Hidden AP Revealer resolves cloaked SSIDs passively through probe-request candidates and association traffic.

Offensive modules exist — Evil Twin with captive portal, deauth bursts, custom beacon floods, and the NRuGochi Pwnagotchi-style recon loop — and this article documents them strictly as capabilities of record for authorized engagements against infrastructure you own or are contracted to test. Notable engineering details include same-session PIN-to-PSK continuation in the Pixie Dust module, persistent portal results after auto-stop, per-BSSID HS_.pcap handshake files in NRuGochi, and a template manager with SHA-256 duplicate rejection and a 24 KB firmware-side heap limit on portal HTML. These are quality-of-life signals that the author has actually run long engagements with the tool.

The credential pipeline is where NRSuite earns its keep professionally. PCAP to .hs22000 merges classic captures into a Hashcat .22000 file with automatic best-handshake dedupe per BSSID+station and SSID extraction; the cracker imports both WPA*01 and WPA*02 hashes, selects the best M1/M2 pair, and checkpoints wordlist runs against compressed lists. A Credential Manager stores results with locally generated ZXing Wi-Fi QR codes for handoff to other team members, keeping WPS PINs in a separate row — a small but thoughtful data-model decision.

What genuinely differentiates the suite is the parity of its defensive half. The Deauth Detector passively monitors deauth/disassociation frames with BSSID, client, RSSI, and reason-code filters plus async alerts. The Rogue AP Detector compares visible APs against OUI rules to flag duplicate SSIDs, security downgrades, and impersonation, with managed whitelist/blacklist rules. The WPS Attempt Detector passively watches selected BSSIDs for M1–M8 progression and scores risk low/medium/high — effectively the same telemetry an attacker's Pixie Dust run produces, which makes the tool useful for detection validation in your own environment.

BLE tooling covers scanning with manufacturer data and service UUID badges, read-only GATT enumeration, and a Tracker Detector for Find My/AirTag-style advertisements with repeated-sighting correlation — a legitimately defensive feature given how common tracker stalking has become. The sensors section adds an LD2450 mmWave radar visualization module, an unusual inclusion that suggests the author is building toward physical-detection use cases rather than pure radio attack.

The HID/BadUSB stack is broad: a Ducky Editor for DuckyScript authoring, BLE and native USB keyboard/mouse emulation, a supervised PIN bruteforce tester with max-attempt caps and saved sessions, and multi-device USB sessions with per-device permissions — a genuinely useful detail when you have several serial boards attached. The README quietly notes that a BLE-HID PIN tester remains hidden and experimental, with lock-screen use unsupported, which is a candid scoping decision rather than a teaser.

Operationally, everything runs through the app's refreshed field-instrument UI with three themes (Obsidian, Black for AMOLED, Daylight), plus Home, Devices, Terminal, and Logs views. Multi-device support means one phone can drive several boards concurrently, and the planned roadmap — resumable cracker jobs already shipped, Wifite-style auto capture pending, ESP-NOW mesh marked experimental — signals active, realistic development. With 187 stars and a Beta badge, this is a young project, but the README's precision, the docs split, and the Discord structure (#support, #showcase, #github) suggest maintainership intended to last.

For defenders, NRSuite is worth studying precisely because its offensive and defensive halves are mirror images. Anyone deploying it against your network leaves the classic signatures: deauth reason-code floods, unsolicited beacons, portal DNS/HTTP listeners, and WPS M1–M3 exchange anomalies — all observable with commodity WIDS or with this suite's own detector modules running on a spare phone as a cheap monitoring node. That duality, plus a setup cost of roughly one ESP32-S3 and a cable, makes it a practical training-lab instrument: build the attack, watch the detector fire, and tune your alerting before an adversary does it for you.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• Frieren for turning OpenWrt routers and SBCs into security gadget platforms


• fucking-Awesome-Hacking for navigating the security tooling ecosystem


• haaukins for automated virtualized security training labs