Usage
The RF-Hunter has six buttons on the front panel.
| Button | What it does |
|---|---|
| UP | Move cursor up |
| DOWN | Move cursor down |
| LEFT | Move left (in keyboard / setup screens) |
| RIGHT | Move right |
| ENTER | Select / confirm |
| BACK | Go back one screen |
Hold BACK for 5 seconds from anywhere to return to the main menu.
Boot sequence
When you power on, the device shows the RDH Robotics logo, then a two-screen legal notice, then lands on the Main Menu.
Main Menu
> RF-Hunter
Deauther-Suite
WiPhi
Use UP / DOWN to move the cursor and ENTER to open a tool.
RF-Hunter
RF-Hunter uses the onboard nRF24L01 radio to study interference in the 2.4 GHz band.
- Select RF-Hunter from the main menu
- The nRF24 initializes — you'll see "Initializing..." then "OK"
- Pick a mode:
| Mode | Channels swept |
|---|---|
| BLE & All 2.4GHz | All 125 channels — covers BLE, Zigbee, Wi-Fi, and proprietary protocols |
| Just Wi-Fi | Wi-Fi channels 1–11 only (2412–2462 MHz) |
- The device runs until you press BACK
- Press BACK to stop and return to the RF mode list
- Hold BACK 5 seconds to go back to the main menu
Deauther Suite
The Deauther Suite runs the spacehuhn esp8266_deauther engine.
- Select Deauther-Suite from the main menu
- The display switches to the deauther's own UI
- Use the buttons to scan networks, select a target, and run tests
- A web interface is also available — connect your phone or laptop to the device's Wi-Fi AP and open
192.168.4.1 - Hold BACK 5 seconds to exit and return to the main menu
The deauther has its own documentation at github.com/SpacehuhnTech/esp8266_deauther.
WiPhi
WiPhi is a captive portal testbed. It creates a clone of a target Wi-Fi network and serves a test login page to study how users respond to credential prompts.
Only use WiPhi on networks you own or have explicit written permission to test.
Step by step
1. Scan
Select Scan Networks from the WiPhi menu. The device scans and lists nearby access points with their channel number.
2. Select an AP
Select Select AP, scroll to your target network, and press ENTER. The selected SSID appears in the title bar.
3. Start an attack
Select Attack, then choose a mode:
| Mode | What happens |
|---|---|
| Deauth Only | Sends deauth frames to disconnect clients from the target AP |
| Deauth + EvilTwin | Disconnects clients and starts a clone AP with a captive portal |
| Stop Attack | Stops everything |
4. Watch the results
The running screen shows:
- Current mode
- Target network
- Deauth packet count
- Number of clients connected to the clone AP
When a client connects and submits the test password form, the device verifies it against the real network. If it's correct, the screen jumps to Captured and the credential is saved.
5. View captured credentials
- Captured PW — shows the credential from the current session
- Saved Passwords — shows all credentials saved to EEPROM (persists after power off)
To delete a saved credential: open Saved Passwords, select an entry, press ENTER to view it, then press BACK to delete it.
Web admin panel
While WiPhi is running, you can also control it from a browser:
Network: WiPhi_34732
Password: d347h320
URL: http://192.168.4.1/admin
The web panel and OLED work at the same time.
RF Chat (bonus)
RF Chat is a separate sketch (not part of the launcher). It lets two or more RF-Hunter devices chat over raw nRF24 radio — no Wi-Fi, no internet.
Flash RF_Chat.ino to use it. On boot, you enter a 5-digit room code and a 3-character username. Any devices sharing the same room code can send and receive messages.