README
OUI-SPY
ESP32-S3 based multi-mode detection system with integrated buzzer and power management.
This board has sick PCB art. Available on colonelpanic.tech - Ready-to-use, no additional components required.
All current firmware is passive and detection-only. Nothing transmitted, nothing exploited — just listening. This is the Blue Edition (defensive/recon). A Red Edition with offensive capabilities is in development and will be released separately. Stay tuned.
Flash from your browser
No Python, no PlatformIO, no drivers to install:
https://colonelpanichacks.github.io/oui-spy-unified-blue/
Chrome, Edge, or Opera on desktop. Plug in the XIAO ESP32-S3 with a USB-C data cable, click Connect & Flash, pick the serial port. Always ships the latest Unified Blue firmware.
Firmware Options
OUI-SPY Unified Blue ⭐ RECOMMENDED
All four modes in one firmware — select from a boot menu, reboot, and go.
Flash from your browser: colonelpanichacks.github.io/oui-spy-unified-blue
One flash, four capabilities. The unified build combines Detector, Foxhunter, Flock-You, and Sky Spy into a single firmware with a WiFi-based boot selector. No reflashing needed to switch modes.
- Boot selector on AP
oui-spy/ouispy123at192.168.4.1 - Hold BOOT button 2 seconds to return to the selector from any mode
- MAC randomization on every boot for privacy
- Global buzzer toggle from the selector menu
- Distinct boot sounds per mode — each plays its own retro tune so you know which firmware you're in
- Persistent mode selection — remembers your last choice across power cycles
- Configurable AP — change the selector SSID/password from the web UI
Includes all features from the standalone firmwares below, plus GPS wardriving in Flock-You mode, session persistence to flash, KML export for Google Earth, and a prior session history tab.
Use Cases: Everything. Flash once, switch modes on the fly.
OUI-SPY Foxhunter
Precision proximity tracker for radio direction finding
- Single target MAC address tracking with real-time RSSI analysis
- Variable proximity beeping based on signal strength (closer = faster beeps)
- Optimized for directional antenna usage and triangulation
- Aggressive scanning parameters for maximum sensitivity
- Clean audio feedback system for field operations
- Good for foxhunting competitions and asset recovery
Use Cases: Radio direction finding, asset tracking, security device location, RF analysis
OUI-SPY UniPwn
Advanced Unitree robot exploitation system with web interface
- BLE-based command injection exploits for Unitree Go2, G1, H1, and B2 robots
- AutoPwn automation with 7-step exploitation and bulletproof error handling
- Real-time BLE scanning with signal strength indicators and target management
- Custom command injection with SSID/password injection methods
- Comprehensive web interface with operations logging and system monitoring
- AES-CFB128 encryption implementation for Unitree's crypto protocol
- Based on original research by Bin4ry and d0splash
Use Cases: Security research, authorized penetration testing, educational robotics security assessment
Flock-You
Flock Cam detector — passive 2.4 GHz WiFi tiered-confidence detection with GPS wardriving
- Passive 2.4 GHz promiscuous receiver — no AP, no transmit
- Tiered confidence — IE fingerprint (tier 4) + wildcard-probe signature + OUI matches (tiers 1-3), each with its own distinct audio so you know by ear which method fired
- Descending channel hop (11 / 6 / 1) at 250 ms dwell to intercept the target's ascending probe cycle fast
- Session persistence to on-device SPIFFS with CRC validation — previous session viewable in the dashboard history tab
- Flask companion dashboard in
api/with live GPS-tagged feed, JSON / CSV / KML (Google Earth) export - Standalone (no host required) or plugged-in (dashboard) — no mode switch
- USB-CDC command protocol:
CMD:DUMP_PREV,CMD:DUMP_LIVE,CMD:STATUS,CMD:VERSION,CMD:CLEAR_* - Also folded into OUI-SPY Unified Blue Mode 3
Use Cases: Surveillance-transparency research, privacy auditing, wardriving
For research & educational use only. You assume all liability for any use or misuse of these devices — don't do anything illegal or dumb. Not affiliated with, endorsed by, or associated with any camera-network operator; all trademarks belong to their respective owners.
Sky-Spy
Drone RemoteID detection and real-time mapping system
- Dual-protocol scanning: WiFi promiscuous mode + BLE for OpenDroneID (ASTM F3411)
- Real-time GPS coordinate extraction from drone broadcasts (location, altitude, speed, heading)
- Operator/pilot location tracking and identification
- JSON serial output for mesh-mapper.py visualization integration
- Thread-safe audio alerts: 3 quick beeps on detection, heartbeat every 5 seconds
- Multi-drone tracking: Monitor multiple concurrent drones simultaneously
- Non-blocking buzzer implementation with dedicated FreeRTOS task
Use Cases: Drone detection, airspace monitoring, RemoteID compliance verification, counter-UAS awareness
Remote-ID-Spoofer
WiFi Remote ID spoofer and simulator with swarm mode
WARNING: Transmitting spoofed Remote ID signals is illegal in many jurisdictions. See the full legal disclaimer before use. This firmware is for authorized security research and education only.
- WiFi-based ASTM F3411 Remote ID broadcast via NAN action frames and AP beacon vendor IEs
- Flask web UI with cyberpunk dark theme, dual control panels, and map-based flight path planning
- Swarm mode: spoof up to 20 simultaneous drones with configurable formations, offset/random flight paths, and stagger start
- Realistic variation engine: altitude drift, speed variation, GPS jitter, heading wobble, TX timing jitter -- all toggleable with live sliders
- Live telemetry feeds showing real-time broadcast data and per-drone swarm status
- Play/Pause/Stop state machine with status ticker and TX count
- Buzzer and LED feedback with mute controls
- 1Hz broadcast rate matching real Remote ID transmitters
- Inspired by d0tslash and H.A.R.D (Hackers Against Remote ID)
Use Cases: Security research, Remote ID protocol analysis, counter-UAS testing, educational demonstration
3D Prints
Enhance your OUI-SPY with custom 3D printed cases and accessories:
OUI-SPY Case with External Antenna Hole
by out0fstep
- Protective case with external antenna hole for enhanced RF performance
- Secure fit for OUI-SPY board with proper ventilation
- Compatible with external directional antennas for foxhunting applications
OUI-SPY Travel Case
by out0fstep
- Compact travel case for portable OUI-SPY operations
- Protective design for field use and storage
- Easy access to controls and indicators
OUI-SPY Keychain
by out0fstep
- Portable keychain case for everyday carry
- Compact design for discreet operations
- Easy access to all controls and indicators
Mini Yagi Case
by out0fstep
- Specialized case for directional antenna operations
- Designed for use with 2.4G Directional Antenna 10.5dB High Gain SMA
- Optimized for foxhunting and directional RF detection
- Professional-grade directional antenna setup
OUI-SPY SMA Spacer
by Nitekry D Paul
- SMA connector spacer for external antenna mounting
- Ensures proper antenna positioning and signal optimization
- Compatible with various SMA antenna configurations
OUI-SPY Tacti-kewl yagi grip with accessory mounts
by out0fstep
- Universal yagi Grip for foxhunting
- picitinny rail compatibility
Hardware Specifications
- MCU: ESP32-S3 dual-core processor
- Connectivity: WiFi 802.11n, Bluetooth 5.0, BLE
- Audio: Integrated buzzer with PWM control
- Power: USB-C powered with efficient power management
- Antenna: Built-in antenna with option for external directional antenna
- Form Factor: Compact PCB design optimized for portable use
Quick Start
- Purchase your OUI-SPY board from colonelpanic.tech
- Flash the Unified Blue firmware — one flash, all four modes
- Power on and connect to WiFi AP
oui-spy/ passwordouispy123 - Select your mode from the web selector at
http://192.168.4.1 - Device reboots into your chosen mode — hold BOOT 2s to return to menu anytime
AP credentials per mode
Each mode brings up its own access point with its own credentials. After a mode switch you are joining a different network, not the selector AP.
| Mode | SSID | Password | Dashboard |
|---|---|---|---|
| Boot Selector | oui-spy | ouispy123 | 192.168.4.1 |
| Detector | snoopuntothem | astheysnoopuntous | 192.168.4.1 |
| Foxhunter | foxhunter | foxhunter | 192.168.4.1 |
| Flock-You BLE | flockyou | flockyou123 | 192.168.4.1 |
| Flock-You WiFi | none | — | USB-CDC + Flask dashboard |
| Sky Spy | none | — | serial JSON output only |
Selector, Detector, and both Flock-You APs are changeable from their web UI and persist to NVS. Foxhunter is fixed.
Can't load
192.168.4.1after joining? On Android, a network with no internet gets deprioritised and your browser traffic goes out over mobile data instead. Turn mobile data off, or accept the "stay connected" prompt.Says the password is wrong? If you previously joined an AP with the same SSID under different credentials, your phone is retrying the saved one. Forget the network and rejoin.
Technical Features
Advanced BLE Scanning
- Maximum aggressive scanning parameters for optimal detection
- Dual-core processing for concurrent web interface and scanning
- Real-time RSSI analysis and signal strength reporting
- Support for both active and passive scanning modes
Privacy & Security
- MAC address randomization for stealth operation
- No traceable hardware fingerprints
- Secure web configuration with timeout protection
- Local processing - no cloud dependencies
Audio System
- Multiple beep patterns for different alert types
- Variable frequency proximity indication
- Clean startup and ready signals
- Non-overlapping audio sequencing
OUI Reference
Looking for manufacturer prefixes? Check the full list here: OUI List (ouis.md)
Gotta catch 'em all — contribute your findings!
If you need to verify an OUI, use one of these lookup tools:
- Official IEEE OUI Lookup: https://standards.ieee.org/products-services/regauth/oui/index.html
- Alternate OUI Lookup: https://macaddress.io/
Choose your firmware above and start detecting.
License
Open source project. Hardware available commercially on colonelpanic.tech.
Contributors
34 commits
See what people are saying
Similar repos
README
OUI-SPY
ESP32-S3 based multi-mode detection system with integrated buzzer and power management.
This board has sick PCB art. Available on colonelpanic.tech - Ready-to-use, no additional components required.
All current firmware is passive and detection-only. Nothing transmitted, nothing exploited — just listening. This is the Blue Edition (defensive/recon). A Red Edition with offensive capabilities is in development and will be released separately. Stay tuned.
Flash from your browser
No Python, no PlatformIO, no drivers to install:
https://colonelpanichacks.github.io/oui-spy-unified-blue/
Chrome, Edge, or Opera on desktop. Plug in the XIAO ESP32-S3 with a USB-C data cable, click Connect & Flash, pick the serial port. Always ships the latest Unified Blue firmware.
Firmware Options
OUI-SPY Unified Blue ⭐ RECOMMENDED
All four modes in one firmware — select from a boot menu, reboot, and go.
Flash from your browser: colonelpanichacks.github.io/oui-spy-unified-blue
One flash, four capabilities. The unified build combines Detector, Foxhunter, Flock-You, and Sky Spy into a single firmware with a WiFi-based boot selector. No reflashing needed to switch modes.
- Boot selector on AP
oui-spy/ouispy123at192.168.4.1 - Hold BOOT button 2 seconds to return to the selector from any mode
- MAC randomization on every boot for privacy
- Global buzzer toggle from the selector menu
- Distinct boot sounds per mode — each plays its own retro tune so you know which firmware you're in
- Persistent mode selection — remembers your last choice across power cycles
- Configurable AP — change the selector SSID/password from the web UI
Includes all features from the standalone firmwares below, plus GPS wardriving in Flock-You mode, session persistence to flash, KML export for Google Earth, and a prior session history tab.
Use Cases: Everything. Flash once, switch modes on the fly.
OUI-SPY Foxhunter
Precision proximity tracker for radio direction finding
- Single target MAC address tracking with real-time RSSI analysis
- Variable proximity beeping based on signal strength (closer = faster beeps)
- Optimized for directional antenna usage and triangulation
- Aggressive scanning parameters for maximum sensitivity
- Clean audio feedback system for field operations
- Good for foxhunting competitions and asset recovery
Use Cases: Radio direction finding, asset tracking, security device location, RF analysis
OUI-SPY UniPwn
Advanced Unitree robot exploitation system with web interface
- BLE-based command injection exploits for Unitree Go2, G1, H1, and B2 robots
- AutoPwn automation with 7-step exploitation and bulletproof error handling
- Real-time BLE scanning with signal strength indicators and target management
- Custom command injection with SSID/password injection methods
- Comprehensive web interface with operations logging and system monitoring
- AES-CFB128 encryption implementation for Unitree's crypto protocol
- Based on original research by Bin4ry and d0splash
Use Cases: Security research, authorized penetration testing, educational robotics security assessment
Flock-You
Flock Cam detector — passive 2.4 GHz WiFi tiered-confidence detection with GPS wardriving
- Passive 2.4 GHz promiscuous receiver — no AP, no transmit
- Tiered confidence — IE fingerprint (tier 4) + wildcard-probe signature + OUI matches (tiers 1-3), each with its own distinct audio so you know by ear which method fired
- Descending channel hop (11 / 6 / 1) at 250 ms dwell to intercept the target's ascending probe cycle fast
- Session persistence to on-device SPIFFS with CRC validation — previous session viewable in the dashboard history tab
- Flask companion dashboard in
api/with live GPS-tagged feed, JSON / CSV / KML (Google Earth) export - Standalone (no host required) or plugged-in (dashboard) — no mode switch
- USB-CDC command protocol:
CMD:DUMP_PREV,CMD:DUMP_LIVE,CMD:STATUS,CMD:VERSION,CMD:CLEAR_* - Also folded into OUI-SPY Unified Blue Mode 3
Use Cases: Surveillance-transparency research, privacy auditing, wardriving
For research & educational use only. You assume all liability for any use or misuse of these devices — don't do anything illegal or dumb. Not affiliated with, endorsed by, or associated with any camera-network operator; all trademarks belong to their respective owners.
Sky-Spy
Drone RemoteID detection and real-time mapping system
- Dual-protocol scanning: WiFi promiscuous mode + BLE for OpenDroneID (ASTM F3411)
- Real-time GPS coordinate extraction from drone broadcasts (location, altitude, speed, heading)
- Operator/pilot location tracking and identification
- JSON serial output for mesh-mapper.py visualization integration
- Thread-safe audio alerts: 3 quick beeps on detection, heartbeat every 5 seconds
- Multi-drone tracking: Monitor multiple concurrent drones simultaneously
- Non-blocking buzzer implementation with dedicated FreeRTOS task
Use Cases: Drone detection, airspace monitoring, RemoteID compliance verification, counter-UAS awareness
Remote-ID-Spoofer
WiFi Remote ID spoofer and simulator with swarm mode
WARNING: Transmitting spoofed Remote ID signals is illegal in many jurisdictions. See the full legal disclaimer before use. This firmware is for authorized security research and education only.
- WiFi-based ASTM F3411 Remote ID broadcast via NAN action frames and AP beacon vendor IEs
- Flask web UI with cyberpunk dark theme, dual control panels, and map-based flight path planning
- Swarm mode: spoof up to 20 simultaneous drones with configurable formations, offset/random flight paths, and stagger start
- Realistic variation engine: altitude drift, speed variation, GPS jitter, heading wobble, TX timing jitter -- all toggleable with live sliders
- Live telemetry feeds showing real-time broadcast data and per-drone swarm status
- Play/Pause/Stop state machine with status ticker and TX count
- Buzzer and LED feedback with mute controls
- 1Hz broadcast rate matching real Remote ID transmitters
- Inspired by d0tslash and H.A.R.D (Hackers Against Remote ID)
Use Cases: Security research, Remote ID protocol analysis, counter-UAS testing, educational demonstration
3D Prints
Enhance your OUI-SPY with custom 3D printed cases and accessories:
OUI-SPY Case with External Antenna Hole
by out0fstep
- Protective case with external antenna hole for enhanced RF performance
- Secure fit for OUI-SPY board with proper ventilation
- Compatible with external directional antennas for foxhunting applications
OUI-SPY Travel Case
by out0fstep
- Compact travel case for portable OUI-SPY operations
- Protective design for field use and storage
- Easy access to controls and indicators
OUI-SPY Keychain
by out0fstep
- Portable keychain case for everyday carry
- Compact design for discreet operations
- Easy access to all controls and indicators
Mini Yagi Case
by out0fstep
- Specialized case for directional antenna operations
- Designed for use with 2.4G Directional Antenna 10.5dB High Gain SMA
- Optimized for foxhunting and directional RF detection
- Professional-grade directional antenna setup
OUI-SPY SMA Spacer
by Nitekry D Paul
- SMA connector spacer for external antenna mounting
- Ensures proper antenna positioning and signal optimization
- Compatible with various SMA antenna configurations
OUI-SPY Tacti-kewl yagi grip with accessory mounts
by out0fstep
- Universal yagi Grip for foxhunting
- picitinny rail compatibility
Hardware Specifications
- MCU: ESP32-S3 dual-core processor
- Connectivity: WiFi 802.11n, Bluetooth 5.0, BLE
- Audio: Integrated buzzer with PWM control
- Power: USB-C powered with efficient power management
- Antenna: Built-in antenna with option for external directional antenna
- Form Factor: Compact PCB design optimized for portable use
Quick Start
- Purchase your OUI-SPY board from colonelpanic.tech
- Flash the Unified Blue firmware — one flash, all four modes
- Power on and connect to WiFi AP
oui-spy/ passwordouispy123 - Select your mode from the web selector at
http://192.168.4.1 - Device reboots into your chosen mode — hold BOOT 2s to return to menu anytime
AP credentials per mode
Each mode brings up its own access point with its own credentials. After a mode switch you are joining a different network, not the selector AP.
| Mode | SSID | Password | Dashboard |
|---|---|---|---|
| Boot Selector | oui-spy | ouispy123 | 192.168.4.1 |
| Detector | snoopuntothem | astheysnoopuntous | 192.168.4.1 |
| Foxhunter | foxhunter | foxhunter | 192.168.4.1 |
| Flock-You BLE | flockyou | flockyou123 | 192.168.4.1 |
| Flock-You WiFi | none | — | USB-CDC + Flask dashboard |
| Sky Spy | none | — | serial JSON output only |
Selector, Detector, and both Flock-You APs are changeable from their web UI and persist to NVS. Foxhunter is fixed.
Can't load
192.168.4.1after joining? On Android, a network with no internet gets deprioritised and your browser traffic goes out over mobile data instead. Turn mobile data off, or accept the "stay connected" prompt.Says the password is wrong? If you previously joined an AP with the same SSID under different credentials, your phone is retrying the saved one. Forget the network and rejoin.
Technical Features
Advanced BLE Scanning
- Maximum aggressive scanning parameters for optimal detection
- Dual-core processing for concurrent web interface and scanning
- Real-time RSSI analysis and signal strength reporting
- Support for both active and passive scanning modes
Privacy & Security
- MAC address randomization for stealth operation
- No traceable hardware fingerprints
- Secure web configuration with timeout protection
- Local processing - no cloud dependencies
Audio System
- Multiple beep patterns for different alert types
- Variable frequency proximity indication
- Clean startup and ready signals
- Non-overlapping audio sequencing
OUI Reference
Looking for manufacturer prefixes? Check the full list here: OUI List (ouis.md)
Gotta catch 'em all — contribute your findings!
If you need to verify an OUI, use one of these lookup tools:
- Official IEEE OUI Lookup: https://standards.ieee.org/products-services/regauth/oui/index.html
- Alternate OUI Lookup: https://macaddress.io/
Choose your firmware above and start detecting.
License
Open source project. Hardware available commercially on colonelpanic.tech.
See what people are saying
Similar repos
Contributors
34 commits