Some of the most capable security tools now fit on a keyring. The M5StickC Plus2 is an ESP32 device barely bigger than a car key, with a screen, a battery, and a USB port — and once you flash it with the open-source Bruce firmware, it turns into a surprisingly complete handheld wireless-security platform. I’ve been using mine to learn a whole stack of techniques hands-on.

The frame first, because it always comes first: every capability below is for your own equipment, a lab you own, or an engagement you’ve been explicitly authorized to test. Captive-portal credential capture, spoofing, keystroke injection — used against systems you don’t have permission for, these are crimes, not party tricks. The skill worth having is knowing how they work so you can defend against them.

What it does

Bruce exposes a genuinely broad toolkit, and even better, a full scriptable serial command line so you can drive it from a computer:

• Wi-Fi — scanning, sniffing, a web UI, and captive-portal (“evil portal”) templates. The portal side is the classic phishing-awareness demonstration: stand up a fake login page, see how readily people hand over credentials, and understand exactly why you train staff against it.
• BadUSB / keystroke injection — the device can pretend to be a keyboard and type a scripted payload the instant it’s plugged in. This is the single best argument for why “just plug in the USB stick you found” is a terrible idea, and why endpoint policies lock down HID devices.
• Sub-GHz and IR — with an add-on radio it captures and replays the 433 MHz signals behind cheap remotes and doorbells, and IR handles television-style codes. The lesson, again and again, is how much everyday kit uses unauthenticated, replayable signals.
• RFID / NFC — reading and working with access cards, the foundation of understanding physical-access security.

The lessons that stuck

Config that fails silently is dangerous. An early gotcha: the settings command parses input in a very specific comma-separated format, and feeding it the “obvious” JSON format was silently accepted and quietly corrupted the setting — no error, it just persisted the garbage. I only caught it by always reading the value back after writing. That habit — verify the write, never assume it took — is worth more than any single feature on the device.

Password reuse is a personal problem too. Setting the thing up, I noticed I was about to reuse a near-identical password across the gadget, my Wi-Fi, and another system. Building attack tools is a fast way to become paranoid about your own hygiene, which is exactly the right outcome.

Recovery matters before you experiment. The firmware lives in a single app partition with no automatic rollback, so a bad update means a USB recovery. Backing up the working image before flashing anything is the difference between a five minute fix and a bricked toy. I keep dated backups of both the firmware and its asset bundle.

Why bother

A device this small collapses the distance between reading about an attack and watching it happen on hardware you’re holding. And the through-line of every technique it does is the same defensive insight: unauthenticated signals get replayed, plugged-in devices get trusted too easily, and people click the login page. You learn to shut those doors by opening them yourself, in a place where it’s safe and legal to do so.

Tech: M5StickC Plus2 (ESP32-PICO), Bruce firmware, Wi-Fi, BLE, sub-GHz (external CC1101), IR, NFC, BadUSB.