The HaleHound is a handheld penetration-testing device that packs an entire wireless attack lab into a single unit. With more than 40 attack modules spanning five radio protocols, it covers just about every band a security researcher might want to explore, all driven from a small touchscreen display. It's an open project with an active community, and it can be bought pre-assembled, as a kit, or built entirely from scratch.
What It Can Do
The HaleHound's strength is breadth. Rather than specializing in one protocol, it reaches across the wireless spectrum with dedicated hardware for each band. Here's a rundown of its capabilities.
WiFi. A full suite of 2.4GHz WiFi tooling: deauther, beacon spammer, evil twin captive portal, auth flood, karma attack, EAPOL/PMKID capture, probe sniffer, and packet monitor.
Bluetooth. BLE-focused attacks including BLE Cinder, BLE Spoofer, the BLE Predator GATT honeypot, WhisperPair (CVE-2025-36911), Airoha RACE key extraction, and an AirTag attack suite.
2.4GHz (NRF24). Using the NRF24 radio: WLAN Ember, MouseJack keystroke injection, a promiscuous sniffer, a spectrum analyzer, and Proto Kill for multi-protocol attacks.
SubGHz (CC1101). Sub-gigahertz work such as signal replay, brute forcing with De Bruijn sequences, SubGHz Scorch, a Tesla charge-port opener, Flipper .sub file transmission, and a spectrum analyzer.
RFID / NFC. Powered by a PN532, the card tooling covers scanning, reading, cloning, key brute forcing, and card emulation, with full MIFARE Classic support.
SIGINT & Defense. Beyond offense, it includes GPS wardriving, IoT/LAN reconnaissance scanning, a Flock Safety camera detector, jam detection across all bands, and a unified loot manager to keep captured data organized.
The Hardware
At its core, the HaleHound runs on a CYD ("Cheap Yellow Display"), the inexpensive ESP32 board with a built-in touchscreen. Builds use either the 2.8" or 3.5" version. Around that base, the radios and modules are added to give the device its multi-band reach.
Frequency Range
Across its various radios, the HaleHound covers a wide slice of the spectrum:
- 125 / 134 kHzLF RFID (Chameleon Ultra / Proxmark-style)
- 13.56 MHzHF NFC (PN532)
- 300–928 MHzSub-GHz (CC1101, three sub-bands)
- 2.400–2.4835 GHz2.4 GHz (NRF24 + WiFi)
It doesn't do 5 GHz or 6 GHz yet, which is a limitation of the ESP32 on the CYD board. From what I understand, Jesse is working on new firmware targeting a different CYD that has dual-band WiFi, so that may change down the line.
Project and Community
The project is maintained by Jesse Hale, and everything lives in the open:
- Website: HaleHound™
- GitHub: JesseCHale (HaleHound)
- Web Flasher: flash.halehound.com
HaleHound has its own web flasher now, so you can flash the firmware right from the browser without going anywhere else. Flash the firmware early, even before you solder on any radios. It's far better to troubleshoot simple issues up front than to discover them later, when you have an insane amount of wires to navigate just to find the culprit.
There's also an active Discord community, which has been genuinely useful. I've had Jesse himself respond to questions I've asked and problems I've run into. Early on I hit stability issues where certain features would crash the device, usually showing up as a full white screen followed by a restart. Since the v3.8.0 firmware update, those crashes seem to be resolved.
The Firmware
One of my favorite parts of this device is the firmware. The graphics are genuinely cool and unlike anything else in this space, with a distinct look that sets the HaleHound apart. New additions like the drone detector and skimmer detector are excellent, and it's clear the project is actively evolving.
It isn't perfect, though. I wish it were possible to edit the captive portal pages. More significantly, some of the on-screen text is far too small for me to read at all, and a few features use very light text that's extremely difficult to make out. On occasion I've had to take a photo with my phone just so I could zoom in and read the screen. Some features are also a bit confusing: there are multiple buttons that do the same thing, behavior that isn't consistent from one app to the next, and cases where it simply isn't clear what a given button does. None of this is a dealbreaker, but larger and higher-contrast fonts would go a long way, and a pass at making the interface more consistent would noticeably smooth out the experience.
I've included some screenshots of my HaleHound and a few of its features below so you can get a sense of what the firmware actually looks like. Photographing the screen with a phone is genuinely difficult, so apologies for the lower-quality images. Click any image to enlarge it, then use the arrow keys to move through the set.
Buying vs. Building
If you'd rather not solder, you can buy a fully assembled HaleHound, or a kit if you want to put it together yourself. Cases are available separately too. For anyone who wants the full experience, though, building one from scratch is an option, and that's the route I took.
My Build
I built my own using a 3.5" SPI-exposed CYD. For radios I used the E07 and E01 modules, and I included the NFC reader/writer, which some people leave out. I also fit a small battery inside.
On top of the standard build, I upgraded the antennas. A larger GPS antenna made a big difference in locking onto satellites compared to the small included one, and better WiFi and SubGHz antennas noticeably improved what I could detect.
If you're planning your own build, this walkthrough is excellent. I picked up several techniques and helpful tips from it: Complete 3.5in HaleHound CYD Build Tutorial by Valleytech.
The Hardest Electronics Project I've Done
This was, honestly, the most difficult electronics project I've built, and a few factors piled on to make it that way.
The biggest one was a defective JST cable-maker kit. Every custom JST cable I built had the same failure: when I plugged it into a female JST port, the individual wires would push back out of the connector. Because of that, I couldn't take advantage of the JST harness-to-CYD connections the way the build normally allows. Instead, I had to solder nearly everything directly. That meant three wires soldered straight to the onboard ESP32 microcontroller, three to the onboard LED connection, and several others besides.
I also used a case from DuggieTech, which came prebuilt with a buck converter and battery charger already installed. That was convenient, but it also meant my setup didn't always match the tutorials and video walkthroughs, so following along got tricky. Arranging the two radios, the GPS module, the battery, and the perfboard PCB in that space took some patience.
One unexpected upside: before this project, I had no idea you could make your own custom JST cables. Even though my kit turned out to be defective, it's a genuinely cool skill to have picked up. Just be warned that there are a ton of different JST types, varying by both pin count and physical size, so it's worth double-checking exactly what you need before ordering.
Hot Glue Is a Godsend
I can't overstate how useful hot glue was on this project. When you have multiple wires soldered together at one point and then need to solder another wire nearby, the bundle fights you: reheat the joint and the wires spring back up out of position. Tacking them down with hot glue, not over the solder joint itself but on the insulated section right next to it, held everything firmly in place while I made changes. Hot glue was also essential for securing components inside the case and for general cable management.
Get Ceramic-Tipped Tweezers
Another tool I'd strongly recommend is a pair of ceramic-tipped tweezers. When you press down on an insulated wire while soldering it, the heat can melt the insulation. Ceramic tips avoid that problem entirely. Plastic-tipped tweezers aren't a substitute either, since you can easily damage them attempting the same thing. DuggieTech sells an excellent pair here for only $15. I bought a set and they've been great.
The IPEX GPS connector must never touch the onboard clock. If it does, it fries the entire chip. It's a genuinely poor design that this is even possible, and it looks alarmingly easy to do, so route the GPS wire carefully to make sure it won't swing toward and contact the clock. Don't skip this.
The Moment of Truth
Toward the end, the build turns into an enormous rat's nest of cables. When I finally smashed everything together and screwed the case shut, I figured there was maybe a 75% chance it wouldn't even power on. To my delight, it did, and when I ran the radio test function (which checks the CC1101, the NRF24, and the GPS) all three lit up green and passed. Very cool, and honestly a little surprising.
Honest Reflections
I tried to be as careful and tidy as I could with the soldering, the hot glue, and the organization, but in the end it's still a mess. It's simply a lot to manage in a tiny space, and the wires are very small gauge. At one point I soldered two of the wrong wires together while bundling the E01 and E07 on the perfboard into a harness to route over to the CYD, which was unfortunate. I had to cut them and splice in a new wire. And as I mentioned, I never got the luxury of using clean JST harnesses, thanks to that defective kit.
Even with the frustrations, it was a deeply satisfying project, and there's something special about hitting power on a tangled mess of your own wiring and watching every radio check pass.