ESP32-C5 wardriving rig with GPS for Flipper Zero

Flipper Zero Wardriving in 2026: The Complete Dual-Band GPS Guide (WiGLE-Ready)

PINGEQUA Lab · Wardriving field guide · 9 min read · Updated 2026-07-15

Wardriving in 2026 is a solved problem — if your rig can see both Wi-Fi bands and stamp every network with a GPS fix. This is the complete, WiGLE-ready walkthrough for the Flipper Zero, from what the hardware actually does to your first upload.

Quick answerWardriving is passively logging the Wi-Fi networks a device broadcasts in the open — SSID, BSSID (MAC), channel, encryption type — and tagging each one with a GPS coordinate, then uploading that map to wigle.net. On a Flipper Zero you need three things: a Wi-Fi scan board (ideally dual-band, so you also see 5 GHz access points), a GPS receiver, and a microSD card to log WigleWifi CSV. The scan runs through the ESP32 Marauder app; the cleanest one-board setup is an all-in-one like Scout Lite. You only ever record what routers already announce — no connecting, no cracking.

What wardriving actually is (and isn't)

Every Wi-Fi access point continuously shouts a beacon frame into the air: its network name (SSID), its hardware address (BSSID), the channel it's on, and how it's secured. That's not private data you have to break into — it's a public advertisement, transmitted by design so your phone can find the network. Wardriving is the act of driving or walking around while a scanner logs those beacons and pairs each with a GPS position. Aggregate enough of them and you get a map of wireless infrastructure — which is exactly what the crowdsourced WiGLE database is.

The important line: wardriving is enumeration, not intrusion. You are recording metadata that is already public. You are not joining networks, capturing the traffic on them, or cracking passwords — those are separate acts that cross legal lines. For a jurisdiction-by-jurisdiction breakdown of where that line sits in the US, see our companion piece, Is Wardriving Legal in the US.

Field logged per network What it is Public?
SSID Network name Broadcast in beacon
BSSID Access-point MAC address Broadcast in beacon
Channel / band 2.4 or 5 GHz channel Broadcast in beacon
Encryption Open / WEP / WPA2 / WPA3 Broadcast in beacon
GPS lat/long Where you heard it From your receiver

What you need: the three-part rig

A wardriving setup is always the same three functions, whether they live on one board or three:

  • A Wi-Fi scan radio. This is what enumerates access points. A 2.4 GHz-only radio (the classic ESP32 on most Flipper WiFi dev boards) misses every network running purely on 5 GHz — an increasingly large share in 2026. A dual-band radio sees both.
  • A GPS receiver. Without a fix, every network you log has no location and WiGLE rejects it. The receiver streams NMEA sentences that the firmware stamps onto each capture.
  • A microSD card (FAT32). The log is written here as WigleWifi CSV, the exact format wigle.net ingests.

In 2026 the dual-band scanner and the GPS increasingly live on one ESP32-C5 board. You can still piece a rig together from a separate GPS module and a Wi-Fi board, but an integrated module removes the two things that trip people up most: UART pin conflicts between the ESP32 and GPS, and getting the firmware to log location at all.

2.4 vs 5 GHz, in one line: for wardriving you want enumeration of as many APs as possible. A 5 GHz-capable rig sees access points a 2.4-only rig walks straight past — but note that 5 GHz support is scan-only on ESP32 Marauder; handshake work stays on 2.4 GHz. That's fine — wardriving is enumeration, not capture.

How the GPS tagging works

The GPS receiver (on quality boards, a Quectel L86-M33 / MediaTek MT3333 — GPS, GLONASS and Galileo) outputs a stream of NMEA sentences over UART. Two things then have to happen: the ESP32 running Marauder reads that stream so it can write coordinates into the CSV, and — if you also want the Flipper's native GPS app — the same NMEA has to reach the Flipper on the right pins. On a Flipper Zero the ESP32 sits on GPIO 13/14 and the GPS has to go to GPIO 15/16, because the two can't share a UART. Getting that mapping wrong is the number-one reason a GPS app shows "no fix." We cover the exact fix in the GPIO 15/16 UART guide.

Wardrive walkthrough: from power-on to WiGLE

This is the full loop on a Flipper Zero running Momentum firmware (it bundles the Marauder app and maps the GPS pins for you):

  1. Seat the module on the Flipper's GPIO header and insert a FAT32-formatted microSD card.
  2. Boot Momentum and open the ESP32 Marauder app. If you're using a separate GPS and want the native GPS app too, set the NMEA UART to Extra 15,16 under Momentum → Protocols → GPIO Pins.
  3. Wait for a GPS fix. Outdoors, a cold start takes a minute or two; boards with MediaTek EASY orbit prediction fix faster.
  4. Start Wardrive in Marauder. Every access point is logged with timestamp, signal strength, channel and GPS location as WigleWifi CSV.
  5. Drive or walk. Keep moving; the log grows one row per unique network seen.
  6. Pull the card and upload the CSV at wigle.net → Uploads. Your networks appear on the map after processing.

Pick your rig

The 2026 Flipper wardriving modules mostly share the same ESP32-C5 dual-band chip, so they all see 2.4 and 5 GHz. Where they split is how much else is bolted on — and for wardriving, which only uses the Wi-Fi radio and GPS, extra radios are cost and RF noise you don't use:

Lean board (Scout Lite) Do-everything C5 module (e.g. Apex 5)
Bands scanned 2.4 + 5 GHz (ESP32-C5) 2.4 + 5 GHz (ESP32-C5)
On the board C5 + GPS only C5 + GPS + sub-GHz + (often) NRF24
2.4 GHz scan environment Nothing else in-band Shares 2.4 GHz with an NRF24
Price $69.98 ~$99 (Apex 5)
Focus Wardriving All-in-one pentest

Roughly three routes exist. A DIY kit like JustCallMeKoKo's C5 Adapter (you flash a DevKit yourself) is cheapest on parts and endlessly flexible. A do-everything module (Apex 5, Rabbit-Labs) adds sub-GHz and NRF24 if you want one board for everything. An integrated-lean board like Scout Lite hard-wires the GPS and ships pre-flashed for grab-and-go wardriving. We put them head-to-head, with prices, in Scout Lite vs koko C5 vs Apex 5 vs Rabbit-Labs, and explain the single-chip dual-band story in the ESP32-C5 breakdown.

Scout Lite — dual-band wardriving, one board

ESP32-C5 (2.4 + 5 GHz Wi-Fi 6) + onboard L86-M33 GPS + microSD WiGLE logging, pre-flashed with Marauder. No NRF24, no sub-GHz — a quieter board built for one job.

Get Scout Lite GPS module only

FAQ

Is wardriving legal?
Passively logging the beacon metadata routers broadcast in the open — SSID, BSSID, channel, GPS — is generally legal in the US; connecting to or capturing traffic on a network you don't own is not. See Is Wardriving Legal in the US. This is general information, not legal advice.
Do I need 5 GHz for wardriving?
You don't strictly need it, but a dual-band rig logs 5 GHz access points that a 2.4-only board never sees — a growing share of networks in 2026. On ESP32 Marauder, 5 GHz is scan/enumeration only, which is exactly what wardriving requires.
Why does my GPS app show "no fix"?
Almost always a pin-mapping problem, not bad hardware. The ESP32 sits on Flipper GPIO 13/14, so the GPS UART must be mapped to 15/16 (Momentum → Protocols → GPIO Pins → NMEA "Extra 15,16"). Full fix in the UART guide.
What firmware do I need on the Flipper?
Wardriving runs through the ESP32 Marauder app. Momentum is the smoothest choice because it bundles the Marauder app and maps the GPS pins out of the box; stock firmware pins the UART to 13/14, where the ESP32 already sits.
Why does WiGLE reject my upload?
Usually the file isn't valid WigleWifi CSV, or the rows have no GPS coordinate (logged before a fix). Log with a firmware that writes WigleWifi CSV natively and confirm a GPS fix before you start driving.

Sources: Espressif — ESP32-C5 dual-band Wi-Fi 6 (espressif.com/en/products/socs/esp32-c5, 2025); Momentum Firmware GPIO/Protocols wiki (momentum-fw.dev/wiki/Protocols/GPIO, 2026); justcallmekoko/ESP32Marauder Wardrive wiki (github.com, 2026); WiGLE.net upload documentation. Product specs per PINGEQUA Scout Lite listing.

For authorized network research, security auditing and electronics education only. Only scan or assess networks you own or are explicitly permitted to test. End users are responsible for compliance with local radio and computer-access law. This article is general information, not legal advice.

Back to blog