🐬 NullSec Flipper Zero Suite

The Ultimate Flipper Zero Payload & Resource Collection
430+ files — BadUSB, SubGHz, IR, NFC, RFID, Animations & more

Quick Install • BadUSB • SubGHz • Infrared • Resources

📦 Suite Overview

Category	Count	Description
💻 BadUSB	80	Windows, Linux & macOS exploitation payloads
📻 SubGHz	40	RF signal captures and templates (315-915 MHz)
📡 Infrared	16	Universal remote controls for TVs, ACs, streaming
💳 NFC	3	Mifare Classic & NTAG card templates
🏷️ RFID	3	EM4100, HID ProxII, Indala templates
🔑 iButton	2	Dallas/Cyfral key templates
🎵 Music	5	Custom tunes for the Flipper speaker
🐬 Animations	81	Custom dolphin animations & asset packs
📱 Apps	36	Custom application resources
🎨 Assets	158	Icons, graphics & visual resources
	430+	Total files

⚡ Quick Install

Method 1: qFlipper (Recommended)

git clone https://github.com/bad-antics/nullsec-flipper-suite

Connect your Flipper via USB → Open qFlipper → Drag & drop folders to SD card.

Method 2: Direct Copy

git clone https://github.com/bad-antics/nullsec-flipper-suite
cd nullsec-flipper-suite

# Copy everything to Flipper SD card
cp -r badusb/nullsec /ext/badusb/
cp -r subghz/nullsec /ext/subghz/
cp -r infrared/nullsec /ext/infrared/
cp -r nfc/nullsec /ext/nfc/
cp -r rfid/nullsec /ext/rfid/

Method 3: Web Installer

Download the latest release ZIP and extract to your Flipper SD card.

Firmware Compatibility

Firmware	Supported
Official	✅
Momentum	✅
Xtreme	✅
Unleashed	✅
RogueMaster	✅

💻 BadUSB Payloads (80)

The largest BadUSB collection in any single Flipper Zero suite. All payloads use DuckyScript 2.0 syntax.

Recon & Discovery (1-10)

#	Payload	Target	Description
01	SystemRecon	Windows	Full system enumeration
02	WiFiStealer	Windows	Saved WiFi passwords extraction
03	ReverseShell	Windows	PowerShell reverse shell
04	DisableDefender	Windows	Disable Windows Defender
05	CredDump	Windows	Credential dumping
06	BrowserData	Windows	Browser history, cookies, passwords
07	Keylogger	Windows	PowerShell keylogger install
08	NetworkScan	Windows	Network discovery & mapping
09	SAMDump	Windows	SAM database extraction
10	Persistence	Windows	Registry-based persistence

Social Engineering (11-20)

#	Payload	Target	Description
11	FakeUpdate	Windows	Fake Windows Update screen
12	WebcamSnap	Windows	Silent webcam capture
13	ClipboardStealer	Windows	Clipboard history extraction
14	ScreenCapture	Windows	Screenshot exfiltration
15	USBExfil	Windows	USB-based data exfil
16	RickRoll	Windows	Classic RickRoll prank
17	WallpaperPrank	Windows	Desktop wallpaper hijack
18	VoicePrank	Windows	Text-to-speech prank
19	DisableMouse	Windows	Disable mouse input
20	InvertScreen	Windows	Invert display colors

Cross-Platform (21-30)

#	Payload	Target	Description
21	LinuxRecon	Linux	Full Linux enumeration
22	LinuxReverseShell	Linux	Bash reverse shell
23	MacOSRecon	macOS	macOS system info extraction
24	DownloadExecute	Windows	Download & execute payload
25	CreateAdmin	Windows	Create hidden admin account
26	CloudTokenStealer	Windows	AWS/Azure/GCP token theft
27	SSHKeyHarvest	Windows	SSH key extraction
28	VPNCredGrab	Windows	VPN credential extraction
29	GitRepoStealer	Windows	Git credentials & repos
30	SlackDiscordTokens	Windows	Chat app token extraction

Advanced Exploitation (31-40)

#	Payload	Target	Description
31	BrowserBackdoor	Windows	Browser extension backdoor
32	PasswordMgrDump	Windows	Password manager database extraction
33	EDRKiller	Windows	EDR/AV evasion & disable
34	ADRecon	Windows	Active Directory recon
35	CryptoWalletStealer	Windows	Cryptocurrency wallet extraction
36	AzureO365Stealer	Windows	Azure/O365 token theft
37	DBCredHunter	Windows	Database credential hunting
38	MacOSKeychain	macOS	Keychain extraction
39	ContainerSecrets	Linux	Docker/K8s secret extraction
40	RATDropper	Windows	Remote access trojan dropper

Cloud & DevOps (41-50)

#	Payload	Target	Description
41	AWSCredHarvest	Windows	AWS credential files
42	DockerSecretsGrab	Linux	Docker secrets extraction
43	KubernetesTokenGrab	Linux	K8s service account tokens
44	AzureTokenExtract	Windows	Azure managed identity tokens
45	GCPCredStealer	Windows	GCP service account keys
46	TerraformStateGrab	Windows	Terraform state file secrets
47	BrowserSessionHijack	Windows	Browser session cookie theft
48	VSCodeExtensions	Windows	VS Code extension backdoor
49	ChromePasswordDump	Windows	Chrome saved password extraction
50	EnvVarSecrets	Windows	Environment variable secrets

Hardware & Firmware (51-60)

#	Payload	Target	Description
51	WiFiDeauthTrigger	Windows	WiFi deauth via system commands
52	BIOSExtractor	Windows	BIOS/UEFI firmware extraction
53	MemoryForensics	Windows	RAM dump for analysis
54	HypervisorDetect	Windows	VM/hypervisor detection
55	FirmwareExtractor	Windows	Device firmware extraction
56	ADShadowCreds	Windows	AD shadow credentials attack
57	LinuxSSHHarvest	Linux	SSH key & config extraction
58	MacOSKeychainDump	macOS	macOS Keychain full dump
59	CICDCredHarvest	Linux	CI/CD pipeline credential theft
60	BrowserSessionClone	Windows	Browser session cloning

Defense Evasion & Persistence (61-70)

#	Payload	Target	Description
61	WindowsFirewallDisable	Windows	Disable all firewall profiles
62	DNSPoisonLocal	Windows	Local hosts file DNS poisoning
63	WiFiHotspotRogue	Windows	Create rogue WiFi hotspot
64	PowerShellEmpire	Windows	Empire C2 stager deployment
65	CronPersistence	Linux	Crontab backdoor persistence
66	RegistryBackdoor	Windows	Registry run key persistence
67	FileExfiltrator	Windows	Sensitive file search & exfil
68	RDPEnabler	Windows	Enable RDP remote access
69	NetcatListener	Windows	Persistent netcat bind shell
70	LogCleaner	Windows	Windows event log cleaner

Advanced Persistence & Collection (71-80)

#	Payload	Target	Description
71	ScheduledTaskPersist	Windows	Scheduled task persistence
72	DisableUAC	Windows	Disable User Account Control
73	WiFiProbeCapture	Windows	Capture all saved WiFi profiles
74	SystemdBackdoor	Linux	systemd service persistence
75	MacOSLaunchDaemon	macOS	macOS LaunchDaemon persistence
76	BitLockerKeyDump	Windows	BitLocker recovery key extraction
77	ThunderbirdMailDump	Windows	Thunderbird email extraction
78	WMIEventPersist	Windows	Fileless WMI event persistence
79	NTLMRelayCrack	Windows	NTLM hash capture & crack
80	SystemInfoExfil	Windows	Full system inventory + cloud exfil

📻 SubGHz Signals (40)

RF signal captures and templates across common frequencies.

SUB-GHZ SIGNALS: THE COMPLETE MASTER LIST

27 MHz - 50 MHz Band

Signal Name	Frequency	Description
`toy_remote_27mhz`	27 MHz	Low-frequency toy car/boat remote
`cordless_phone_43`	43-50 MHz	Old analog cordless phone base
`baby_monitor_49`	49 MHz	Vintage baby monitor
`over_the_horizon_radar`	3-30 MHz	OTH radar ionospheric bounce
`sinogars_hopset`	30-88 MHz	SINCGARS frequency hop (single channel capture)
`numbers_station_uvb`	Various	Unidentified voice broadcast (UVB-76 "The Buzzer")
`pipers_voice`	Various	Pirate radio feedback link

72 MHz - 162 MHz Band

Signal Name	Frequency	Description
`rc_toy_72mhz`	72 MHz	Old hobby RC (aircraft band)
`rc_toy_75mhz`	75 MHz	Old hobby RC (surface/ground)
`soviet_loran_c`	100 kHz	Russian CHAYKA navigation (legacy)
`avalanche_beacon`	457 kHz	Avalanche transceiver search mode
`mine_rescue_locator`	500 kHz	Through-the-earth comms (mines)
`livestock_tag_id`	134 kHz	Low-frequency animal ID
`submarine_elf`	76 Hz	Extreme low frequency (below sub-GHz)
`weather_alert_162`	162 MHz	NOAA weather radio alert (SAME tone)
`military_satcom_uhf`	240-270 MHz	UHF military SATCOM (transponder)
`pagerv2_biotech`	466 MHz	Old Medical/Numeric pager (Biotech, etc.)

300 MHz - 315 MHz Band

Signal Name	Frequency	Description
`garage_door_dipswitch`	300-400 MHz	Old fixed-code garage door (Dipswitch settings)
`keyless_entry_vintage`	300 MHz	Early 90s keyless entry (fixed code)
`car_alarm_test_315`	315 MHz	Car alarm trigger test
`car_remote_fcc`	315 MHz	Car remote (FCC)
`ceiling_fan_315`	315 MHz	Ceiling fan remote
`fireplace_315`	315 MHz	Electric fireplace
`garage_315mhz`	315 MHz	Garage door (US)
`garage_bruteforce`	315 MHz	Garage brute force
`panic_button_315`	315 MHz	Panic button test
`pool_pump_315`	315 MHz	Pool pump remote
`smart_lock_315`	315 MHz	Smart lock
`tesla_charge_port`	315 MHz	Tesla charge port
`tire_pressure_315`	315 MHz	TPMS sensor
`glass_break_sensor_315`	315 MHz	Wireless glass break detector
`gate_remote_315`	315 MHz	US-style gate opener
`rolling_code_capture_315`	315 MHz	Example capture of a Keeloq or similar rolling code

380 MHz - 390 MHz Band

Signal Name	Frequency	Description
`garage_390mhz`	390 MHz	Garage door (US)
`gate_opener_390`	390 MHz	Gate opener
`tetra_mo_uplink`	380-400 MHz	TETRA mobile station uplink (Europe)

400 MHz - 433 MHz Band (Medical & Implant)

Signal Name	Frequency	Description
`implanted_pump_ctrl`	402 MHz	MICS band (Medical Implant Comm.) - infusion pump
`pacemaker_programmer`	402 MHz	Pacemaker programming downlink
`ingestible_sensor`	400 MHz	Ingestible event marker
`neural_recording`	413-419 MHz	Neural recording system (research)
`tactical_link_11`	225-400 MHz	Link 11 data (NATO, maritime/air)
`have_quick_hop`	225-400 MHz	Have Quick (anti-jam) SATCOM hop

433 MHz Band (Consumer & Industrial)

Signal Name	Frequency	Description
`alarm_jammer_433`	433 MHz	Alarm system jammer
`alarm_remote`	433 MHz	Alarm system remote
`doorbell_433mhz`	433 MHz	Doorbell signal
`doorbell_spam`	433 MHz	Doorbell spam
`drone_rth_trigger`	433 MHz	Drone RTH trigger
`ev_charger_unlock`	433 MHz	EV charger unlock
`fan_remote`	433 MHz	Fan remote
`gas_station_sign`	433 MHz	Gas station sign
`hotel_lock_rf`	433 MHz	Hotel lock RF
`industrial_sensor_spoof`	433 MHz	Industrial sensor
`intercom_433`	433 MHz	Wireless intercom
`keyfob_jammer_433`	433 MHz	Keyfob jammer
`led_strip_433`	433 MHz	LED strip controller
`medical_alert_test`	433 MHz	Medical alert test
`outlet_remote`	433 MHz	Power outlet remote
`parking_barrier`	433 MHz	Parking barrier
`projector_screen`	433 MHz	Projector screen
`restaurant_pager`	433 MHz	Restaurant pager
`roller_shade_433`	433 MHz	Roller shade motor
`scooter_unlock_433`	433 MHz	Scooter unlock
`solar_inverter_reset`	433 MHz	Solar inverter
`sprinkler_433`	433 MHz	Sprinkler system
`weather_station`	433 MHz	Weather station
`barrier_gate_433`	433 MHz	Common automatic barrier arm (parking lot)
`driveway_alarm_433`	433 MHz	Magnetic or beam-break driveway alert sensor
`smoke_detector_test_433`	433 MHz	Wireless smoke/CO detector test/silence signal
`hvac_thermostat_433`	433 MHz	Wireless thermostat setpoint command
`heat_pump_remote_433`	433 MHz	Mini-split heat pump remote control
`gas_meter_433`	433 MHz	Automated meter reading (AMR) for gas
`silo_level_sensor_433`	433 MHz	Agricultural or industrial bin level sensor
`nurse_call_button_433`	433 MHz	Hospital or assisted living call pendant
`glucose_monitor_433`	433 MHz	Continuous glucose monitor transmitter
`christmas_lights_433`	433 MHz	Common wireless Christmas light remote
`dog_fence_collar_433`	433 MHz	Test/train signal for invisible fence collar
`soil_moisture_reader`	433 MHz	Wireless soil moisture probe reading
`gas_shutoff_valve`	433 MHz	Remote natural gas shutoff command
`glucose_cgm`	433 MHz	Continuous glucose monitor
`dash7_gateway`	433/868/915 MHz	Dash7 active RFID tag read

450 MHz - 466 MHz Band

Signal Name	Frequency	Description
`cbm_vibration_sensor`	450/868 MHz	Condition-based monitoring vibration sensor (industrial)
`combine_harvester_gps`	450 MHz	Agricultural vehicle GPS correction signal
`vibration_analyser`	450 MHz	High-g vibration sensor testbed
`walkie_talkie_frs`	462 MHz	Family Radio Service (bubble pack radios)

700 MHz - 900 MHz Band (Cellular & IoT)

Signal Name	Frequency	Description
`p25_phase1_trunk`	700-800 MHz	P25 public safety trunking control channel
`lte_m_paging`	700-900 MHz	LTE-M paging cycle for IoT device
`weightless_w_multi`	470-790 MHz	Weightless-W whitespace database signal
`wifi_802_11_af`	54-790 MHz	Wi-Fi in TV whitespaces
`sub_thz_vital_signs`	90-300 GHz	Sub-THz radar for heart rate/respiration
`graphene_thz_test`	100-300 GHz	TERACOMM graphene-based MIMO test signal
`subthz_6g_sensing`	90-300 GHz	6G joint communication and sensing
`smartdust_mesh`	mmWave	Hypothetical smartdust sensor network

868 MHz Band (European)

Signal Name	Frequency	Description
`eu_barrier_868`	868 MHz	EU barrier gate
`gate_868mhz`	868 MHz	Gate remote (EU)
`motion_sensor_868`	868 MHz	PIR motion detector (EU security systems)
`hvac_rooftop_unit_868`	868 MHz	Commercial HVAC unit control (EU)
`boiler_control_868`	868 MHz	Wireless boiler/underfloor heating controller
`water_meter_868`	868 MHz	Wireless M-Bus water meter reading
`patient_monitor_alarm_868`	868 MHz	Bed/chair exit alarm or vitals monitor alert
`silage_temp_probe`	868 MHz	Temperature probe in agricultural silage
`wireless_mbus`	868 MHz	Wireless Meter-Bus (gas/water meter read)
`water_pressure_node`	868 MHz	Municipal water pressure monitoring point
`streetlight_fault`	868 MHz	Streetlight failure report
`ecg_bodywave`	868/915 MHz	Bodyworn ECG transmitter
`bodywave_on_metal`	868/915 MHz	Bodywave antenna test (on metal surface)
`enocean_switch`	868 MHz	EnOcean energy-harvesting light switch
`lorawan_join_request`	868/915 MHz	LoRaWAN device joining network
`miwi_p2p_beacon`	868/915 MHz	MiWi peer-to-peer discovery frame
`sigfox_uplink`	868/915 MHz	Sigfox uplink message (UNB)
`telensa_streetlight`	868 MHz	Telensa smart streetlight telemetry
`wirepas_mesh`	868/915 MHz	Wirepas mesh network heartbeat
`z_wave_command`	868/915 MHz	Z-Wave command class frame

900 MHz - 915 MHz Band (Americas)

Signal Name	Frequency	Description
`lora_jam_915`	915 MHz	LoRa jammer
`smarthome_915`	915 MHz	Smart home hub
`lighting_business_915`	915 MHz	Commercial lighting control panel (US)
`infusion_pump_915`	915 MHz	Wireless hospital infusion pump telemetry
`weather_sensor_915`	915 MHz	Add-on temperature/humidity sensor for weather stations
`greenhouse_nose`	915 MHz	Greenhouse node sensor (temperature, humidity)
`greenhouse_noac`	915 MHz	Greenhouse node actuator (fan, vent control)
`pump_jack_status`	900 MHz	Oil well pump jack telemetry (status, flow)
`smart_grid_synch`	900 MHz	Grid synchronization pulse (phasor measurement unit)
`distribution_automation`	900 MHz	Recloser/switch status on power grid
`wisp_4_to_20ma`	919-923 MHz	WISP industrial sensor (4-20mA loop reading)
`wisp_mesh_route`	919-923 MHz	WISP device route advertisement in mesh network
`drone_detection_radar`	900 MHz	Counter-drone radar return
`ec_gsm_iot_uplink`	900 MHz	EC-GSM-IoT extended coverage message
`nb_iot_wake_up`	900 MHz	Narrowband IoT signal (wake-up)
`ingenu_random_slotted`	2.4 GHz	Ingenu random phase multiple access (sub-GHz is 900 MHz)
`isa100_wireless`	2.4 GHz	ISA100.11a industrial automation
`wirelesshart_advertisement`	2.4 GHz	WirelessHART network advertisement
`wifi_802_11_ah`	900 MHz	Wi-Fi HaLow (low power, long range)
`wisun_fan`	900 MHz	Wi-SUN field area network frame
`zigbee_ha`	915 MHz	Zigbee Home Automation device announce
`ubx100_meter_read`	sub-GHz	UBX100 transceiver meter reading burst
`ol2385_sigfox_meter`	915 MHz	OL2385 based Sigfox metering endpoint

900 MHz - 6 GHz Band (Industrial & Radar)

Signal Name	Frequency	Description
`tank_level_radar`	6 GHz	Radar level gauge (low power)
`weightless_n_uplink`	sub-GHz	Weightless-N uplink (ultra narrow band)
`weightless_p_downlink`	sub-GHz	Weightless-P downlink (narrow band)
`zigbee_nan`	sub-GHz	Zigbee NAN (neighbor area network)
`mri_room_monitor`	sub-GHz	MRI room temperature/humidity safety sensor
`buried_pipeline_cathodic`	sub-GHz	Pipeline corrosion protection telemetry

Experimental, Research & Theoretical

Signal Name	Frequency	Description
`muon_tomography`	Varies	Cosmic ray muon detector telemetry
`cavity_ringdown`	Various	Spectroscopic sensor readout
`quantum_key_dist`	Various	QKD sync channel (experimental)
`embassy_warning`	Various	Local staff emergency alert

Summary Count

27 MHz - 50 MHz Band: 7 signals
72 MHz - 162 MHz Band: 11 signals
300 MHz - 315 MHz Band: 14 signals
380 MHz - 390 MHz Band: 3 signals
400 MHz - 433 MHz Band (Medical): 5 signals
433 MHz Band (Consumer & Industrial): 40 signals
450 MHz - 466 MHz Band: 4 signals
700 MHz - 900 MHz Band (Cellular & IoT): 10 signals
868 MHz Band (European): 18 signals
900 MHz - 915 MHz Band (Americas): 22 signals
900 MHz - 6 GHz Band (Industrial): 6 signals
Experimental & Theoretical: 5 signals

Total Unique Signals: 145

SUB-GHZ SIGNALS: THE COMPLETE MASTER LIST

27 MHz - 50 MHz Band

Signal Name	Frequency	Description
`toy_remote_27mhz`	27 MHz	Low-frequency toy car/boat remote
`cordless_phone_43`	43-50 MHz	Old analog cordless phone base
`baby_monitor_49`	49 MHz	Vintage baby monitor
`over_the_horizon_radar`	3-30 MHz	OTH radar ionospheric bounce
`sinogars_hopset`	30-88 MHz	SINCGARS frequency hop (single channel capture)
`numbers_station_uvb`	Various	Unidentified voice broadcast (UVB-76 "The Buzzer")
`pipers_voice`	Various	Pirate radio feedback link

72 MHz - 162 MHz Band

Signal Name	Frequency	Description
`rc_toy_72mhz`	72 MHz	Old hobby RC (aircraft band)
`rc_toy_75mhz`	75 MHz	Old hobby RC (surface/ground)
`soviet_loran_c`	100 kHz	Russian CHAYKA navigation (legacy)
`avalanche_beacon`	457 kHz	Avalanche transceiver search mode
`mine_rescue_locator`	500 kHz	Through-the-earth comms (mines)
`livestock_tag_id`	134 kHz	Low-frequency animal ID
`submarine_elf`	76 Hz	Extreme low frequency (below sub-GHz)
`weather_alert_162`	162 MHz	NOAA weather radio alert (SAME tone)
`military_satcom_uhf`	240-270 MHz	UHF military SATCOM (transponder)
`pagerv2_biotech`	466 MHz	Old Medical/Numeric pager (Biotech, etc.)

300 MHz - 315 MHz Band

Signal Name	Frequency	Description
`garage_door_dipswitch`	300-400 MHz	Old fixed-code garage door (Dipswitch settings)
`keyless_entry_vintage`	300 MHz	Early 90s keyless entry (fixed code)
`car_alarm_test_315`	315 MHz	Car alarm trigger test
`car_remote_fcc`	315 MHz	Car remote (FCC)
`ceiling_fan_315`	315 MHz	Ceiling fan remote
`fireplace_315`	315 MHz	Electric fireplace
`garage_315mhz`	315 MHz	Garage door (US)
`garage_bruteforce`	315 MHz	Garage brute force
`panic_button_315`	315 MHz	Panic button test
`pool_pump_315`	315 MHz	Pool pump remote
`smart_lock_315`	315 MHz	Smart lock
`tesla_charge_port`	315 MHz	Tesla charge port
`tire_pressure_315`	315 MHz	TPMS sensor
`glass_break_sensor_315`	315 MHz	Wireless glass break detector
`gate_remote_315`	315 MHz	US-style gate opener
`rolling_code_capture_315`	315 MHz	Example capture of a Keeloq or similar rolling code

380 MHz - 390 MHz Band

Signal Name	Frequency	Description
`garage_390mhz`	390 MHz	Garage door (US)
`gate_opener_390`	390 MHz	Gate opener
`tetra_mo_uplink`	380-400 MHz	TETRA mobile station uplink (Europe)

400 MHz - 433 MHz Band (Medical & Implant)

Signal Name	Frequency	Description
`implanted_pump_ctrl`	402 MHz	MICS band (Medical Implant Comm.) - infusion pump
`pacemaker_programmer`	402 MHz	Pacemaker programming downlink
`ingestible_sensor`	400 MHz	Ingestible event marker
`neural_recording`	413-419 MHz	Neural recording system (research)
`tactical_link_11`	225-400 MHz	Link 11 data (NATO, maritime/air)
`have_quick_hop`	225-400 MHz	Have Quick (anti-jam) SATCOM hop

433 MHz Band (Consumer & Industrial)

Signal Name	Frequency	Description
`alarm_jammer_433`	433 MHz	Alarm system jammer
`alarm_remote`	433 MHz	Alarm system remote
`doorbell_433mhz`	433 MHz	Doorbell signal
`doorbell_spam`	433 MHz	Doorbell spam
`drone_rth_trigger`	433 MHz	Drone RTH trigger
`ev_charger_unlock`	433 MHz	EV charger unlock
`fan_remote`	433 MHz	Fan remote
`gas_station_sign`	433 MHz	Gas station sign
`hotel_lock_rf`	433 MHz	Hotel lock RF
`industrial_sensor_spoof`	433 MHz	Industrial sensor
`intercom_433`	433 MHz	Wireless intercom
`keyfob_jammer_433`	433 MHz	Keyfob jammer
`led_strip_433`	433 MHz	LED strip controller
`medical_alert_test`	433 MHz	Medical alert test
`outlet_remote`	433 MHz	Power outlet remote
`parking_barrier`	433 MHz	Parking barrier
`projector_screen`	433 MHz	Projector screen
`restaurant_pager`	433 MHz	Restaurant pager
`roller_shade_433`	433 MHz	Roller shade motor
`scooter_unlock_433`	433 MHz	Scooter unlock
`solar_inverter_reset`	433 MHz	Solar inverter
`sprinkler_433`	433 MHz	Sprinkler system
`weather_station`	433 MHz	Weather station
`barrier_gate_433`	433 MHz	Common automatic barrier arm (parking lot)
`driveway_alarm_433`	433 MHz	Magnetic or beam-break driveway alert sensor
`smoke_detector_test_433`	433 MHz	Wireless smoke/CO detector test/silence signal
`hvac_thermostat_433`	433 MHz	Wireless thermostat setpoint command
`heat_pump_remote_433`	433 MHz	Mini-split heat pump remote control
`gas_meter_433`	433 MHz	Automated meter reading (AMR) for gas
`silo_level_sensor_433`	433 MHz	Agricultural or industrial bin level sensor
`nurse_call_button_433`	433 MHz	Hospital or assisted living call pendant
`glucose_monitor_433`	433 MHz	Continuous glucose monitor transmitter
`christmas_lights_433`	433 MHz	Common wireless Christmas light remote
`dog_fence_collar_433`	433 MHz	Test/train signal for invisible fence collar
`soil_moisture_reader`	433 MHz	Wireless soil moisture probe reading
`gas_shutoff_valve`	433 MHz	Remote natural gas shutoff command
`glucose_cgm`	433 MHz	Continuous glucose monitor
`dash7_gateway`	433/868/915 MHz	Dash7 active RFID tag read

450 MHz - 466 MHz Band

Signal Name	Frequency	Description
`cbm_vibration_sensor`	450/868 MHz	Condition-based monitoring vibration sensor (industrial)
`combine_harvester_gps`	450 MHz	Agricultural vehicle GPS correction signal
`vibration_analyser`	450 MHz	High-g vibration sensor testbed
`walkie_talkie_frs`	462 MHz	Family Radio Service (bubble pack radios)

700 MHz - 900 MHz Band (Cellular & IoT)

Signal Name	Frequency	Description
`p25_phase1_trunk`	700-800 MHz	P25 public safety trunking control channel
`lte_m_paging`	700-900 MHz	LTE-M paging cycle for IoT device
`weightless_w_multi`	470-790 MHz	Weightless-W whitespace database signal
`wifi_802_11_af`	54-790 MHz	Wi-Fi in TV whitespaces
`sub_thz_vital_signs`	90-300 GHz	Sub-THz radar for heart rate/respiration
`graphene_thz_test`	100-300 GHz	TERACOMM graphene-based MIMO test signal
`subthz_6g_sensing`	90-300 GHz	6G joint communication and sensing
`smartdust_mesh`	mmWave	Hypothetical smartdust sensor network

868 MHz Band (European)

Signal Name	Frequency	Description
`eu_barrier_868`	868 MHz	EU barrier gate
`gate_868mhz`	868 MHz	Gate remote (EU)
`motion_sensor_868`	868 MHz	PIR motion detector (EU security systems)
`hvac_rooftop_unit_868`	868 MHz	Commercial HVAC unit control (EU)
`boiler_control_868`	868 MHz	Wireless boiler/underfloor heating controller
`water_meter_868`	868 MHz	Wireless M-Bus water meter reading
`patient_monitor_alarm_868`	868 MHz	Bed/chair exit alarm or vitals monitor alert
`silage_temp_probe`	868 MHz	Temperature probe in agricultural silage
`wireless_mbus`	868 MHz	Wireless Meter-Bus (gas/water meter read)
`water_pressure_node`	868 MHz	Municipal water pressure monitoring point
`streetlight_fault`	868 MHz	Streetlight failure report
`ecg_bodywave`	868/915 MHz	Bodyworn ECG transmitter
`bodywave_on_metal`	868/915 MHz	Bodywave antenna test (on metal surface)
`enocean_switch`	868 MHz	EnOcean energy-harvesting light switch
`lorawan_join_request`	868/915 MHz	LoRaWAN device joining network
`miwi_p2p_beacon`	868/915 MHz	MiWi peer-to-peer discovery frame
`sigfox_uplink`	868/915 MHz	Sigfox uplink message (UNB)
`telensa_streetlight`	868 MHz	Telensa smart streetlight telemetry
`wirepas_mesh`	868/915 MHz	Wirepas mesh network heartbeat
`z_wave_command`	868/915 MHz	Z-Wave command class frame

900 MHz - 915 MHz Band (Americas)

Signal Name	Frequency	Description
`lora_jam_915`	915 MHz	LoRa jammer
`smarthome_915`	915 MHz	Smart home hub
`lighting_business_915`	915 MHz	Commercial lighting control panel (US)
`infusion_pump_915`	915 MHz	Wireless hospital infusion pump telemetry
`weather_sensor_915`	915 MHz	Add-on temperature/humidity sensor for weather stations
`greenhouse_nose`	915 MHz	Greenhouse node sensor (temperature, humidity)
`greenhouse_noac`	915 MHz	Greenhouse node actuator (fan, vent control)
`pump_jack_status`	900 MHz	Oil well pump jack telemetry (status, flow)
`smart_grid_synch`	900 MHz	Grid synchronization pulse (phasor measurement unit)
`distribution_automation`	900 MHz	Recloser/switch status on power grid
`wisp_4_to_20ma`	919-923 MHz	WISP industrial sensor (4-20mA loop reading)
`wisp_mesh_route`	919-923 MHz	WISP device route advertisement in mesh network
`drone_detection_radar`	900 MHz	Counter-drone radar return
`ec_gsm_iot_uplink`	900 MHz	EC-GSM-IoT extended coverage message
`nb_iot_wake_up`	900 MHz	Narrowband IoT signal (wake-up)
`ingenu_random_slotted`	2.4 GHz	Ingenu random phase multiple access (sub-GHz is 900 MHz)
`isa100_wireless`	2.4 GHz	ISA100.11a industrial automation
`wirelesshart_advertisement`	2.4 GHz	WirelessHART network advertisement
`wifi_802_11_ah`	900 MHz	Wi-Fi HaLow (low power, long range)
`wisun_fan`	900 MHz	Wi-SUN field area network frame
`zigbee_ha`	915 MHz	Zigbee Home Automation device announce
`ubx100_meter_read`	sub-GHz	UBX100 transceiver meter reading burst
`ol2385_sigfox_meter`	915 MHz	OL2385 based Sigfox metering endpoint

900 MHz - 6 GHz Band (Industrial & Radar)

Signal Name	Frequency	Description
`tank_level_radar`	6 GHz	Radar level gauge (low power)
`weightless_n_uplink`	sub-GHz	Weightless-N uplink (ultra narrow band)
`weightless_p_downlink`	sub-GHz	Weightless-P downlink (narrow band)
`zigbee_nan`	sub-GHz	Zigbee NAN (neighbor area network)
`mri_room_monitor`	sub-GHz	MRI room temperature/humidity safety sensor
`buried_pipeline_cathodic`	sub-GHz	Pipeline corrosion protection telemetry

Experimental, Research & Theoretical

Signal Name	Frequency	Description
`muon_tomography`	Varies	Cosmic ray muon detector telemetry
`cavity_ringdown`	Various	Spectroscopic sensor readout
`quantum_key_dist`	Various	QKD sync channel (experimental)
`embassy_warning`	Various	Local staff emergency alert

Summary Count

27 MHz - 50 MHz Band: 7 signals
72 MHz - 162 MHz Band: 11 signals
300 MHz - 315 MHz Band: 14 signals
380 MHz - 390 MHz Band: 3 signals
400 MHz - 433 MHz Band (Medical): 5 signals
433 MHz Band (Consumer & Industrial): 40 signals
450 MHz - 466 MHz Band: 4 signals
700 MHz - 900 MHz Band (Cellular & IoT): 10 signals
868 MHz Band (European): 18 signals
900 MHz - 915 MHz Band (Americas): 22 signals
900 MHz - 6 GHz Band (Industrial): 6 signals
Experimental & Theoretical: 5 signals

Total Unique Signals: 145

GOVERNMENT SIGNALS: THE HIDDEN & THE CLASSIFIED

Unauthorized & Concealed Military Satellite Transmissions

Signal Name	Frequency	Description
`starshield_downlink_uplinkband`	2025-2110 MHz	Classified SpaceX Starshield satellites transmitting in a frequency band reserved exclusively for Earth-to-space (uplink) communications. International regulations (ITU) prohibit space-to-Earth transmissions in this band. Detected by amateur satellite tracker Scott Tilley.
`starshield_sband_covert`	S-band (approx 2-4 GHz)	Of 193 Starshield satellites cataloged by amateur observers, 170 were broadcasting on the S-band—a frequency range not permitted for transmitting data from space to Earth. Experts suggest this may be a deliberate tactic to conceal operations from commercial monitoring systems.
`starshield_swarm_tracking`	Various (hopping)	Signals traced to Starshield satellites exhibit frequency-hopping behavior across lower-frequency bands. This may further obscure the network's activity from outside observers and is consistent with classified surveillance operations.

Covert Collection & Surveillance Systems

Signal Name	Frequency	Description
`nsa_genesis_sdr`	Full spectrum (sub-GHz to GHz)	NSA's GENESIS spy gadget: A modified Motorola cell phone containing a full software-defined radio system. Allows agents to discreetly record local RF spectrum for later analysis—capturing frequencies and protocols used at facilities of interest. Originally classified until 2032, but leaked in 2013.
`nsa_retro_reflector_keystroke`	Various	NSA's "Surlyspawn" retro reflector: A tiny device planted on keyboard cables that harvests keystrokes wirelessly when activated by a radar signal. Reverse-engineered using HackRF SDR.
`nsa_retro_reflector_video`	Various	NSA's "Ragemaster" retro reflector: Fixed to computer monitor cables to capture on-screen images via RF backscatter.

Deliberately Hidden Military Communications

Signal Name	Frequency	Description	Source / Evidence
`low_visibility_tak_radio`	ISM bands (e.g., 900 MHz)	US Government program to develop a low visibility, jamming-resistant RF radio with waveforms "purpose built to avoid detection" and resistant to countermeasures by technologically advanced adversaries. Operates at 1 watt with minimal RF footprint.
`embassy_warning_system`	Various (undisclosed)	Internal staff emergency alert systems used at diplomatic facilities. Frequencies and protocols are closely guarded.	(from previous master list)

Restricted Government Radar Bands

Signal Name	Frequency	Description	Source / Evidence
`government_radar_2700`	2700-2900 MHz	Non-Government land-based radars restricted; primarily used for airport surveillance and weather radar by government entities.
`federal_receiver_protection`	1675-1710 MHz	Frequencies protected for Federal Government operations, including missile test ranges (Point Mugu, Nellis AFB, Fort Lewis, Fort Benning) with specific geographic coordination requirements.

Spectrum Conflicts: What They're Fighting to Keep

Signal Name	Frequency	Description
`aegis_radar_lower3`	3.1-3.45 GHz (Lower 3 GHz)	Critical for Aegis Combat System and ship-based radar operations. The Pentagon is actively fighting to retain exclusive access despite industry pressure to share.
`patriot_radar_xband`	8-12 GHz (X-band)	Essential for Patriot Missile System targeting and tracking. Military leaders insist on "uninterrupted and complete access" for threat detection.
`golden_dome_missile_defense`	Various (classified)	New multilayered missile defense shield (formerly "Iron Dome") requiring exclusive spectrum use for full sensor integration.

Summary of "Hidden" Government Signals

Category	Number of Signals
Unauthorized Satellite Transmissions	3
Covert Collection Systems	4
Deliberately Hidden Communications	2
Restricted Radar Bands	2
Spectrum Conflict (Critical Defense)	3
TOTAL	14

📡 Infrared Remotes (16)

Universal remote controls for TVs, ACs, and streaming devices.

Remote	Protocol	Description
AC_Daikin	NECext	Daikin air conditioner
AC_Samsung	Samsung32	Samsung air conditioner
AC_Universal	NEC	Universal AC remote
Apple_TV	NECext	Apple TV remote
Fire_TV	NECext	Amazon Fire TV
Hisense_TV	NEC	Hisense TV
LG_TV	NEC	LG TV
Projector	NEC	Universal projector
Roku	NECext	Roku streaming
Samsung_TV	Samsung32	Samsung TV
Sony_TV	SIRC	Sony TV
Soundbar	NEC	Universal soundbar
TCL_TV	NEC	TCL TV
TV_OFF_Universal	Mixed	Turn off ANY TV (18 codes)
TV_Universal	NEC	Universal TV remote
Vizio_TV	NEC	Vizio TV

📦 Other Resources

💳 NFC (3 templates)

Mifare Classic 1K blank
Mifare Classic 4K blank
NTAG215 blank (amiibo compatible)

🏷️ RFID (3 templates)

EM4100 blank
HID ProxII blank
Indala blank

🔑 iButton (2 templates)

Dallas DS1990A
Cyfral

🎵 Music Player (5 tunes)

Custom melodies for the Flipper's piezo speaker.

🐬 Animations & Assets (239 files)

Custom dolphin animations, asset packs, and visual themes.

📁 Project Structure

nullsec-flipper-suite/
├── badusb/nullsec/      # 80 DuckyScript payloads
├── subghz/nullsec/      # 40 RF signal files
├── infrared/nullsec/    # 16 IR remote controls
├── nfc/nullsec/         # 3 NFC card templates
├── rfid/nullsec/        # 3 RFID card templates
├── ibutton/nullsec/     # 2 iButton templates
├── music_player/        # 5 custom tunes
├── asset_pack/          # 81 asset pack files
├── assets/              # 158 visual resources
├── apps/                # 36 app resources
├── README.md
└── LICENSE

🔗 Related Projects

Project	Description
nullsec-pineapple-suite	106 WiFi Pineapple Pager payloads
nullsec-linux	Security-focused Linux distro
nullsec-exploit	Exploit development framework
marshall	NullSec Privacy Browser

⚠️ Legal Disclaimer

For authorized penetration testing and educational purposes ONLY.

❌ Do NOT use on systems without explicit written permission
❌ Unauthorized computer access is a federal crime
✅ Get written authorization before testing
✅ Use in controlled lab environments only
✅ You are solely responsible for your actions

📄 License

MIT License — See LICENSE for details.

NullSec — 430+ tools in your pocket 🐬
github.com/bad-antics

Name		Name	Last commit message	Last commit date
Latest commit History 28 Commits
.github		.github
apps		apps
asset_pack/NullSec		asset_pack/NullSec
assets		assets
badusb/nullsec		badusb/nullsec
docs		docs
ibutton/nullsec		ibutton/nullsec
infrared/nullsec		infrared/nullsec
music_player/nullsec		music_player/nullsec
nfc/nullsec		nfc/nullsec
rfid/nullsec		rfid/nullsec
subghz/nullsec		subghz/nullsec
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
SPONSORS.md		SPONSORS.md
direct-upload.py		direct-upload.py
flipper-cli-upload.py		flipper-cli-upload.py
upload-to-flipper.sh		upload-to-flipper.sh
upload_to_flipper.py		upload_to_flipper.py

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

🐬 NullSec Flipper Zero Suite

📦 Suite Overview

⚡ Quick Install

Method 1: qFlipper (Recommended)

Method 2: Direct Copy

Method 3: Web Installer

Firmware Compatibility

💻 BadUSB Payloads (80)

Recon & Discovery (1-10)

Social Engineering (11-20)

Cross-Platform (21-30)

Advanced Exploitation (31-40)

Cloud & DevOps (41-50)

Hardware & Firmware (51-60)

Defense Evasion & Persistence (61-70)

Advanced Persistence & Collection (71-80)

📻 SubGHz Signals (40)

SUB-GHZ SIGNALS: THE COMPLETE MASTER LIST

27 MHz - 50 MHz Band

72 MHz - 162 MHz Band

300 MHz - 315 MHz Band

380 MHz - 390 MHz Band

400 MHz - 433 MHz Band (Medical & Implant)

433 MHz Band (Consumer & Industrial)

450 MHz - 466 MHz Band

700 MHz - 900 MHz Band (Cellular & IoT)

868 MHz Band (European)

900 MHz - 915 MHz Band (Americas)

900 MHz - 6 GHz Band (Industrial & Radar)

Experimental, Research & Theoretical

Summary Count

SUB-GHZ SIGNALS: THE COMPLETE MASTER LIST

27 MHz - 50 MHz Band

72 MHz - 162 MHz Band

300 MHz - 315 MHz Band

380 MHz - 390 MHz Band

400 MHz - 433 MHz Band (Medical & Implant)

433 MHz Band (Consumer & Industrial)

450 MHz - 466 MHz Band

700 MHz - 900 MHz Band (Cellular & IoT)

868 MHz Band (European)

900 MHz - 915 MHz Band (Americas)

900 MHz - 6 GHz Band (Industrial & Radar)

Experimental, Research & Theoretical

Summary Count

GOVERNMENT SIGNALS: THE HIDDEN & THE CLASSIFIED

Unauthorized & Concealed Military Satellite Transmissions

Covert Collection & Surveillance Systems

Deliberately Hidden Military Communications

Restricted Government Radar Bands

Spectrum Conflicts: What They're Fighting to Keep

Summary of "Hidden" Government Signals

📡 Infrared Remotes (16)

📦 Other Resources

💳 NFC (3 templates)

🏷️ RFID (3 templates)

🔑 iButton (2 templates)

🎵 Music Player (5 tunes)

🐬 Animations & Assets (239 files)

📁 Project Structure

🔗 Related Projects

⚠️ Legal Disclaimer

📄 License

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases 1

Sponsor this project

Uh oh!

Packages 0

Packages