ESP32-C5 single-chip dual-band Wi-Fi wardriving board

ESP32-C5 Wardriving: The Chip Is a Constant, the Board Is the Choice

PINGEQUA Lab · Hardware deep-dive · 7 min read · Updated 2026-07-15

The ESP32-C5 is why Flipper Zero wardriving got good in 2026 — one chip that finally sees both Wi-Fi bands. But since every new module uses it, the chip isn't the differentiator. The board around it is.

Quick answerThe ESP32-C5 is Espressif's first chip with a single dual-band 2.4 + 5 GHz Wi-Fi 6 radio. Before it, seeing 5 GHz on a Flipper meant bolting on a second radio; now one chip does both bands. That's why the 2026 wave of C5 Flipper options — JustCallMeKoKo's C5 Adapter, the Apex 5, the Rabbit-Labs multi-board, Scout Lite — all scan 2.4 and 5 GHz. Since they share the chip, the real question is what else sits on the board. For wardriving, which only uses the Wi-Fi radio and GPS, a board that adds sub-GHz and NRF24 radios adds cost and RF noise you don't use. On ESP32 Marauder, the C5's 5 GHz is scan/enumeration only — exactly what wardriving needs.

What the ESP32-C5 actually is

The ESP32-C5-WROOM-1U is built on Espressif's C5 SoC — the industry's first RISC-V MCU with 2.4 and 5 GHz dual-band Wi-Fi 6 (802.11ax), backward-compatible to 802.11a/b/g/n/ac. It reached mass production in 2025. The headline for wardriving is simple: one radio, both bands, natively. When ESP32 Marauder runs on a C5, its Wi-Fi scan now spans 5 GHz as well as 2.4 — so you log 5 GHz access points a 2.4-only rig walks straight past.

Why 5 GHz used to be hard

The older ESP32 on classic Flipper Wi-Fi boards is a 2.4 GHz-only radio — it physically can't tune 5 GHz. So the pre-C5 way to see 5 GHz was to add a separate second Wi-Fi radio beside the ESP32: two RF front-ends, two antenna paths, two chips. The C5 folds both bands into one radio, which is why the newest modules dropped the second Wi-Fi chip entirely.

Scan-only, and that's fine: on ESP32 Marauder the C5's 5 GHz is enumeration only — you see 5 GHz APs, but handshake/deauth work stays on 2.4 GHz. Wardriving is enumeration, so scan-only is exactly the right tool. If you specifically want active 5 GHz deauth, that's a different, dedicated-radio job — not a wardriving requirement.

The chip is a constant — the board is the choice

Here's the part that matters for buying. Because JustCallMeKoKo's C5 Adapter, the Apex 5, the Rabbit-Labs board and Scout Lite all use the same C5, they all see both bands. What separates them is how many other radios each one bolts on — and how much you assemble:

Board Wi-Fi Extra radios Focus
Scout Lite ESP32-C5 dual-band None (GPS onboard) Grab-and-go wardriving
koko C5 Adapter ESP32-C5 (DevKit) None (DIY, add GPS) Tinkerers / DIY
Apex 5 ESP32-C5 dual-band 2× sub-GHz + NRF24 All-in-one pentest
Rabbit-Labs C5 ESP32-C5 dual-band CC1101 sub-GHz Multi-tool

For wardriving, the extra radios simply aren't part of the workflow — and there's a fair engineering reason a leaner board can help here: an NRF24 operates in the 2.4 GHz band your scanner is enumerating, and a sub-GHz transceiver sits near a GPS front-end that tracks at −165 dBm. The lean boards sidestep that — JustCallMeKoKo's adapter as a DIY kit you flash yourself, and Scout Lite as an integrated, pre-flashed board with the GPS already onboard. The full named comparison, with prices, is in Scout Lite vs koko C5 vs Apex 5 vs Rabbit-Labs.

Scout Lite — the C5, and only what wardriving needs

ESP32-C5 dual-band Wi-Fi 6 + onboard L86-M33 GPS + microSD, pre-flashed Marauder. No NRF24, no sub-GHz — a quieter board, at $69.98.

Get Scout Lite Wardriving guide

FAQ

Is the ESP32-C5 really Wi-Fi 6?
Yes. The ESP32-C5 is Espressif's first dual-band 2.4/5 GHz Wi-Fi 6 (802.11ax) SoC, backward-compatible with 802.11a/b/g/n/ac. It entered mass production in 2025.
If every module uses the C5, what should I compare?
The rest of the board. All the 2026 C5 Flipper modules scan both bands; they differ in extra radios (sub-GHz, NRF24), price, and size. For wardriving, a minimal C5 + GPS board is cheaper and has a cleaner RF environment than a do-everything module.
Can the ESP32-C5 capture 5 GHz handshakes?
On ESP32 Marauder, 5 GHz is scan/enumeration only. You'll see 5 GHz access points, which is what wardriving needs, but handshake capture stays on 2.4 GHz.
Why is fewer radios better for wardriving?
Wardriving only uses the Wi-Fi radio and GPS. An NRF24 shares your 2.4 GHz scan band and a sub-GHz radio raises the noise floor near the GPS, so extra radios add interference and cost without helping you enumerate networks.
Does it need special Flipper firmware?
Wardriving runs through the ESP32 Marauder app; Momentum bundles it and maps the GPS pins to GPIO 15/16 out of the box.

Sources: Espressif — "Introducing ESP32-C5: Espressif's first Dual-Band Wi-Fi 6 MCU" and ESP32-C5 product page (espressif.com, 2025); CNX Software — ESP32-C5 mass production (2025-04), Apex 5 module (2026-02-11), Rabbit-Labs C5 multi-board (2026-03-16); justcallmekoko/ESP32Marauder wiki (github.com, 2026). Scout Lite specs per PINGEQUA listing.

For authorized network research, security auditing and electronics education only. Only scan or assess networks you own or are explicitly permitted to test. End users are responsible for compliance with local radio regulations (FCC Part 15, ISED RSS, RED, MIC). Product names belong to their respective owners and are referenced for comparison.

Back to blog