Raspberry Pi 5 Wardriving & Wireless Pentest Platform
WiFi β’ BLE β’ SDR | WPA3 Downgrade β’ Karma/MANA β’ Evil Twin | Part of MoMo Ecosystem
Features β’ Quick Start β’ Ecosystem β’ Docs β’ Contributing
Nexus β’ GhostBridge β’ Mimic
MoMo is a Raspberry Pi 5 based wireless security audit platform designed for penetration testers and security researchers. It combines the best features of Pwnagotchi, ESP32 Marauder, and WiFi Pineapple into one powerful, modular platform.
| π‘ Multi-Radio | π WPA2/WPA3 Attacks | π€ Handshake Capture |
| πΏ Evil Twin | π Karma/MANA | π£ Evilginx MFA Bypass |
| π¦· BLE Attacks | πΊοΈ GPS Wardriving | π₯ Cloud Cracking |
| π₯οΈ OLED Display | π§© Plugin Friendly | π Nexus Integration |
| Feature | Description | Status |
|---|---|---|
| Wardriving | GPS-correlated AP scanning with SQLite persistence | β |
| Multi-Radio | Manage multiple WiFi adapters simultaneously | β |
| PMKID Capture | Clientless WPA2 attack via hcxdumptool | β |
| Deauth Attacks | Targeted client disconnection | β |
| Handshake Capture | EAPOL 4-way handshake collection | β |
| WPA3 Attacks | SAE detection, downgrade attacks, PMF handling | β |
| Evil Twin | Rogue AP with captive portal (6 templates) | β |
| Karma/MANA | Auto-respond to probe requests, EAP credential capture | β |
| Evilginx AiTM | MFA bypass via session cookie capture | βοΈ VPS |
| Feature | Description | Status |
|---|---|---|
| BLE Scanner | Bluetooth device & beacon detection | β |
| GATT Explorer | Service/characteristic discovery & read/write | β |
| Beacon Spoofing | iBeacon & Eddystone frame injection | β |
| HID Injection | Bluetooth keyboard emulation & keystroke injection | β |
| Feature | Description | Status |
|---|---|---|
| RTL-SDR Support | V3 & V4 (HF direct sampling, bias tee) | β |
| HackRF Support | TX/RX capable SDR | β |
| Spectrum Analyzer | Frequency scanning & peak detection | β |
| Signal Decoder | 433/868 MHz IoT signal capture | β |
| Feature | Description | Status |
|---|---|---|
| Hashcat (Cloud) | GPU-accelerated via Nexus β VPS | βοΈ Cloud |
| John the Ripper | CPU-based lightweight cracking | β Local |
| Auto Sync | Handshakes auto-sync to Nexus β Cloud | π Nexus |
| Wordlist Management | Custom wordlist support | β |
|| Feature | Description | Status | ||---------|-------------|--------| || Management Network | Dedicated wlan0 for tablet/phone control | β | || AP Mode | Creates MoMo-Management hotspot | β | || Client Mode | Connects to known WiFi network | β | || Auto-Whitelist | Management network protected from attacks | β | || Interface Isolation | wlan0=management, wlan1+=attack | β | || Web UI Binding | Bind to management IP only | β |
- Async-First Architecture - Non-blocking I/O with
asyncio - Clean Architecture - 4-layer separation (Presentation β Application β Domain β Infrastructure)
- Modern Plugin System - Marauder-inspired with lifecycle hooks & event communication
- Real-time Web UI - Dark theme dashboard with SSE updates
- Event-Driven - Pub/Sub event bus for decoupled components
- Hardware Auto-Detection - Automatic USB device identification & configuration
- Headless Ready - Management network separation for screenless operation
- 445 Unit Tests - Comprehensive test coverage with pytest-asyncio
- Nexus Integration - Seamless sync with MoMo-Nexus hub
curl -fsSL https://raw.githubusercontent.com/Momo-Master/MoMo/main/deploy/momo-quickstart.sh | sudo bash# Clone repository
git clone https://github.com/Momo-Master/MoMo.git
cd MoMo
# Create virtual environment
python3 -m venv venv
source venv/bin/activate
# Install dependencies
pip install -e ".[dev]"
# Verify installation
momo version
momo doctor# Install with dev dependencies
pip install -e ".[dev]"
pre-commit install
# Run tests
pytest tests/ -v
# Run with dry-run (no hardware needed)
momo run -c configs/momo.yml --dry-runmomo/
βββ core/ # Event bus, plugin system, utilities
β βββ events.py # Pub/Sub event system
β βββ plugin.py # Modern plugin architecture
β βββ security.py # Input sanitization
βββ domain/ # Pydantic models
β βββ models.py # AccessPoint, GPSPosition, etc.
βββ infrastructure/ # Hardware abstraction
β βββ wifi/ # Scanner, RadioManager
β βββ gps/ # GPS client, distance tracker
β βββ ble/ # BLE scanner, GATT, HID, Beacon
β βββ capture/ # Handshake capture
β βββ eviltwin/ # Rogue AP, captive portal
β βββ evilginx/ # [MOVED TO VPS] AiTM proxy
β βββ wpa3/ # WPA3 detection & attacks
β βββ karma/ # Karma/MANA attacks
β βββ cracking/ # John local + Cloud proxy
β βββ sdr/ # RTL-SDR, HackRF, spectrum
β βββ hardware/ # Device registry, auto-detection
β βββ management/ # Headless management network
β βββ database/ # Async SQLite repository
βββ plugins/ # Modern plugins (new architecture)
βββ apps/
β βββ momo_core/ # Main service loop
β βββ momo_plugins/ # Legacy plugins
β βββ momo_web/ # Flask API + Web UI
βββ config.py # Pydantic configuration
| Adapter | Chipset | Monitor | Injection | 5GHz | WiFi 6/6E |
|---|---|---|---|---|---|
| Alfa AWUS036AXML | MT7921AUN | β | β | β | β WiFi 6E |
| Alfa AWUS036ACH | RTL8812AU | β | β | β | β |
| Alfa AWUS036ACM | MT7612U | β | β | β | β |
| Alfa AWUS036ACS | RTL8811AU | β | β | β | β |
| TP-Link Archer T2U Plus | RTL8821AU | β | β | β | β |
| Panda PAU09 | RT5572 | β | β | β | β |
| Device | Frequency Range | TX | Notes |
|---|---|---|---|
| RTL-SDR V4 | 500 kHz - 1.7 GHz | β | HF direct sampling, bias tee |
| RTL-SDR V3 | 24 MHz - 1.7 GHz | β | Bias tee support |
| HackRF One | 1 MHz - 6 GHz | β | Full duplex capable |
| YARD Stick One | Sub-1 GHz | β | 300-928 MHz specialist |
| Adapter | Chipset | BLE | Classic | Notes |
|---|---|---|---|---|
| Sena UD100 | CSR8510 | β | β | Long range |
| Plugable USB-BT4LE | BCM20702 | β | β | Reliable |
| ASUS USB-BT500 | RTL8761B | β | β | BT 5.0 |
| Module | Interface | Chipset | Notes |
|---|---|---|---|
| u-blox NEO-6M | USB/UART | u-blox 6 | Budget friendly |
| u-blox NEO-M8N | USB/UART | u-blox M8 | Better accuracy |
| u-blox NEO-M9N | USB/UART | u-blox M9 | Multi-GNSS |
| GlobalSat BU-353S4 | USB | SiRF Star IV | Plug-and-play |
Access the real-time dashboard:
# Get URL and token
momo web-url --show-token
# Access API
curl -H "Authorization: Bearer <token>" http://<ip>:8082/api/status| Endpoint | Description |
|---|---|
/ |
Dashboard |
/map |
Wardriving map (Leaflet.js) |
/handshakes |
Captured handshakes |
/captures |
Capture management |
/config |
Configuration view |
/api/status |
System status |
/sse/events |
Real-time event stream |
/metrics |
Prometheus metrics |
| Endpoint | Description |
|---|---|
/api/wardriver/* |
Wardriving API |
/api/eviltwin/* |
Evil Twin API |
/api/evilginx/* |
Evilginx AiTM API (moved to VPS) |
/api/wpa3/* |
WPA3/SAE Attack API |
/api/karma/* |
Karma/MANA Attack API |
| Endpoint | Description |
|---|---|
/bluetooth |
BLE device scanner UI |
/api/ble/* |
BLE Scanner API |
/api/ble/gatt/* |
GATT Explorer API |
/api/ble/beacon/* |
Beacon Spoofing API |
/api/ble/hid/* |
HID Injection API |
| Endpoint | Description |
|---|---|
/api/sdr/* |
SDR Management API |
/api/sdr/spectrum/* |
Spectrum Analyzer API |
/api/sdr/decoder/* |
Signal Decoder API |
/api/hardware/* |
Hardware Detection API |
/api/management/* |
Management Network API |
/api/capability/* |
Capability Gate API |
| Endpoint | Description |
|---|---|
/cracking |
Cracking jobs UI |
/api/cracking/* |
Local John + Cloud proxy |
/api/cracking/john/* |
John the Ripper API |
MoMo features a modern, Marauder-inspired plugin architecture:
from momo.core import BasePlugin, PluginMetadata, PluginType
class MyPlugin(BasePlugin):
"""My awesome plugin."""
@staticmethod
def metadata() -> PluginMetadata:
return PluginMetadata(
name="my_plugin",
version="1.0.0",
author="Your Name",
description="What my plugin does",
plugin_type=PluginType.CUSTOM,
priority=100,
)
async def on_start(self) -> None:
self.log.info("My plugin started!")
await self.emit("started", {"status": "ready"})
async def on_stop(self) -> None:
self.log.info("My plugin stopped!")UNLOADED β LOADING β LOADED β STARTING β RUNNING β STOPPING β STOPPED
β β
ERROR ββββββββββββββββββββββββββββββββ ERROR
| Hook | When Called | Use For |
|---|---|---|
on_load() |
Plugin registered | Lightweight init, event subscriptions |
on_start() |
Plugin activated | Async init, start background tasks |
on_tick(ctx) |
Periodically | Sync operations (optional) |
on_stop() |
Plugin deactivated | Cleanup, stop tasks |
on_unload() |
Plugin removed | Final cleanup |
| Type | Description |
|---|---|
CORE |
Essential system plugins |
SCANNER |
WiFi/BLE scanning |
ATTACK |
Active attacks (deauth, evil twin, karma) |
CAPTURE |
Data capture (handshakes) |
ANALYSIS |
Data analysis, cracking |
UI |
User interface plugins |
UTIL |
Utilities |
CUSTOM |
Custom plugins (default) |
See momo/plugins/example_plugin.py for a complete template.
Edit configs/momo.yml:
mode: aggressive # Full offensive mode
interface:
name: wlan1
regulatory_domain: "00" # Global (unrestricted)
aggressive:
enabled: true
max_deauth_per_min: 0 # Unlimited
ssid_blacklist: [] # Your networks (protected)
ssid_whitelist: [] # Target focus (optional)
ble:
enabled: true
scan_duration: 5.0
detect_beacons: true
eviltwin:
enabled: false
portal_template: generic # generic, hotel, corporate, facebook, google, router
karma:
enabled: false
respond_to_all: true # Respond to all probe requests
capture_eap: true # Capture EAP credentials
wpa3:
enabled: true
auto_downgrade: false # Auto-attempt WPA3βWPA2 downgrade
sdr:
enabled: false
device_type: rtlsdr # rtlsdr, hackrf
bias_tee: false # Enable bias tee (RTL-SDR V3/V4)
hardware:
auto_detect: true # Auto-detect USB devices
auto_configure: true # Auto-configure detected devices
management:
enabled: true
interface: wlan0 # Pi5 internal WiFi (management only)
mode: ap # ap = hotspot, client = join network
ap_ssid: MoMo-Management # Management network SSID
ap_password: MoMoAdmin2024! # Change this!
auto_whitelist: true # Protect from self-attack
bind_web_to_management: true
cracking:
enabled: true
use_john: true # Local cracking with John
cloud_enabled: false # Enable when Nexus configured
nexus_api_url: "" # Nexus API for cloud cracking
plugins:
enabled:
- wardriver
- active_wifi
- ble_scannermomo version # Show version
momo doctor # System diagnostics
momo run -c momo.yml # Start capture loop
momo run --dry-run # Simulate without hardware
momo status # Show runtime status
momo rotate-now # Force log rotation
momo web-url --show-token # Show Web UI credentials| Document | Description |
|---|---|
| OPERATIONS.md | Operations guide |
| SECURITY.md | Security hardening |
| HARDWARE.md | Hardware setup |
| ACTIVE_WIFI.md | Deauth/beacon attacks |
| CRACKING.md | Password cracking |
| EVILGINX.md | MFA bypass (AiTM) |
| PLUGINS.md | Plugin documentation |
| ROADMAP.md | Development roadmap |
| DEVLOG.md | Development changelog |
| Phase | Version | Status |
|---|---|---|
| Core Infrastructure | v0.1.0 | β Complete |
| Wardriving & GPS | v0.2.0 | β Complete |
| Multi-Radio | v0.3.0 | β Complete |
| Handshake Capture | v0.4.0 | β Complete |
| Bluetooth Scanner | v0.5.0 | β Complete |
| Evil Twin | v0.6.0 | β Complete |
| Cracking Integration | v0.7.0 | β Complete |
| Plugin Architecture | v0.8.0 | β Complete |
| Evilginx AiTM | v0.9.0 | β Complete |
| WPA3/SAE Attacks | v0.10.0 | β Complete |
| Karma/MANA Attacks | v1.1.0 | β Complete |
| Bluetooth Expansion | v1.2.0 | β Complete |
| Advanced Cracking | v1.3.0 | β Complete |
| SDR Integration | v1.5.0 | β Complete |
| Hardware Auto-Detection | v1.5.1 | β Complete |
| Management Network | v1.5.2 | β Complete |
Total: 445 Tests Passing β
Contributions are welcome! Please read our contributing guidelines:
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing) - Commit changes (
git commit -m 'Add amazing feature') - Push to branch (
git push origin feature/amazing) - Open a Pull Request
pip install -e ".[dev]"
pre-commit install
pytest tests/ -v --cov=momoMoMo is part of a larger offensive security ecosystem. Each project is designed to work together seamlessly.
βοΈ Cloud (Hashcat GPU + Evilginx)
β
ββββββββββββΌβββββββββββ
β MoMo-Nexus β
β Central Hub β
ββββββββββββ¬βββββββββββ
β
βββββββββββββββββββββββββββΌββββββββββββββββββββββββββ
β β β
ββββββββΌβββββββ βββββββββΌββββββββ ββββββββΌβββββββ
β π΅ MoMo β β π» GhostBridgeβ β π Mimic β
β WiFi/BLE β β Network β β USB Attack β
β Pi 5 β β Implant β β Pi Zero β
βββββββββββββββ βββββββββββββββββ βββββββββββββββ
| Project | Description | Platform | Status |
|---|---|---|---|
| MoMo | WiFi/BLE/SDR Audit Platform | Pi 5 | β v1.5.2 |
| MoMo-Nexus | Central Communication Hub | Pi 4 | β v1.0.0 |
| MoMo-GhostBridge | Network Implant | NanoPi R2S | β v0.5.0 |
| MoMo-Mimic | USB Attack Platform | Pi Zero 2W | β v1.0.0 |
MoMo is designed for authorized security testing and educational purposes only.
- Only use on networks you own or have explicit written permission to test
- Respect local laws and regulations regarding wireless security testing
- The developers are not responsible for misuse of this tool
This project is licensed under the MIT License - see the LICENSE file for details.
Part of the π₯ MoMo Ecosystem
Inspired by Pwnagotchi, ESP32 Marauder, and WiFi Pineapple
MoMo β’ Nexus β’ GhostBridge β’ Mimic