I like my Flipper Zero, but what I hate is all the fake stuff that people looking for attention upload to TikTok. No, the Flipper Zero can’t change gas station signs, can’t copy credit and debit cards, and can’t turn off the displays at your burger joint.
But that doesn’t mean that the Flipper Zero can’t do some very cool, useful things.
Over the past few months, I’ve been making use of the suite of hardware tools that are built into the Flipper Zero. What’s built into this tiny toy-like tool?
There’s a sub-GHz wireless antenna that can again capture and transmit wireless codes to operate wireless devices and access control systems, such as garage door remotes, boom barriers, IoT sensors, and even remote keyless systems.
RFID support allows it to read, store, and emulate a number of different RFID cards.
That’s a lot of features crammed into a tiny, $169 device.
But every week I hear from buyers who are frustrated and disappointed because their Flipper Zero won’t do the things that it can seemingly do based on those fake social media videos.
Here are some of the things I’ve been doing with my Flipper Zero over the past few weeks.
Flipper Zero is a portable multi-tool for pen-testers and geeks in a toy-like shell.
View at Flipper Zero store
Note: I’m running third-party software on my Flipper Zero, this gives me access to a bunch of additional features. Loading third-party software doesn’t invalidate your warranty and you can go back to the stock software at any time.
The sub-GHz wireless antenna can pick up the signals from car key fobs (and can record them, although playing them back to modern cars won’t unlock them because of a feature called “rolling codes” that changes the code with each use).
RFID cards and tags can be locked to prevent them from being overwritten, but the Flipper Zero can bypass some of these mechanisms. Here it is offering to unlock the card if I present it to a valid reader.
Yes, the Flipper Zero can bypass the security on some Sentry Safe electronic safes using an output from the GPIO.
The Flipper Zero has a built-in infrared module, and this in turn can be programmed to operate a wide range of devices, from TVs to AC units.
Another cool use of this infrared functionality is to test if infrared remote controls are working.
Flipper Zero can act as a BadUSB device, which means that when connected to a port it is seen as a Human Interface Device (HID), such as a keyboard.
A BadUSB device can change system settings, open backdoors, retrieve data, initiate reverse shells, or do anything that can be achieved with physical access. This is done using a set of commands written in the Rubber Ducky Scripting Language, also known as DuckyScript.
The Flipper Zero can use the GPIO to output electrical signals and act as a signal generator. I last used this to simulate an ABS (antilock braking system) module on a vehicle to confirm that all the wiring and computer in the car were working.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.