The Hackitsune ESPKey Wiegand Interception & Replay Module is a compact, inline hardware platform designed for professional access control testing, diagnostics, and research. Designed to sit transparently between a reader and controller, ESPKey operates on standard 5V Wiegand signalling, making it compatible with a wide range of access control systems including card readers, keypads, fobs, and many biometric devices that output Wiegand downstream. Featuring a punchdown cable interface to allow you to tap into exposed cables coming from a range of card readers, once installed, the module can capture credential bitstreams in transit, store them in onboard non-volatile memory (up to ~80,000 records depending on format), and replay them via its built-in Wi-Fi web interface. Small enough to fit behind most readers, yet powerful enough to demonstrate real-world access control weaknesses, ESPKey is a practical tool for authorised red team engagements, system validation, and security training. This module is based on the original open-source hardware and firmware by OctoSavvi, with updates to the design to make it easier to flash (via pins on the back of the ESPKey using a compatible FTDI serial adaptor or similar.) Boot and Reset buttons have been added to make the flash process easier, we recommend using a pin clamp or pin clip to avoid having to solder contacts to the pcb. In the spirit of Open Source updated Hackitsune PCB designs and build files available github Small enough to fit behind most readers, powerful enough to demonstrate real-world vulnerabilities. Technical Requirements • Compatible access control system using 5V Wiegand interface• Inline installation between reader and controller• Wi-Fi capable device (laptop/mobile) for interface access Installation Overview • Connect between reader and panel using Wiegand lines (D0, D1, GND, VCC)• Power via standard 5V Wiegand supply• Device operates transparently once installed Firmware Pre-installed: • Latest ESPKey firmware (shipped ready to use) Firmware Updates Firmware can be installed or updated using the Hackitsune Web Flasher (supported browsers only): https://www.hackitsune.com/pages/hackitsune-web-flasher Post-Flash Storage Setup (Important) After flashing ESPKey firmware, you must initialise the onboard storage: Connect your laptop to the ESPKey Wi-Fi access point(SSID format: ESPKEY-*) Download and run the storage setup script locally:ui-update.sh This process prepares the filesystem for credential storage Note:If this step is skipped, credential logging and storage functionality will not operate correctly. How to Use Install ESPKey inline between the reader and controller Power the system using standard Wiegand supply Connect to the ESPKey Wi-Fi access point Access the web interface via browser Capture, store, and replay credential data as required Important Usage Notes • Designed for 5V Wiegand systems only• Ensure correct wiring before installation• Some biometric systems output alternative protocols — verify compatibility• Storage must be initialised after firmware flashing• Device operates passively unless actively used Preventative Measures to Mitigate Risk of Use • Only use on systems you are authorised to test• Avoid deployment on production systems without approval• Ensure safe handling of captured credential data• Follow responsible disclosure practices• Comply with local laws regarding access control testing Product Specifications Specification Details Interface Wiegand (D0/D1) Voltage 5V Connectivity Wi-Fi (web interface) Storage ~80,000 credentials (format dependent) Operation Mode Inline interception and replay Firmware ESPKey (pre-installed) Open Source Base OctoSavvi ESPKey Hardware Files GitHub Form Factor Compact inline module Use Case Access control testing and diagnostics Key Features • Inline Wiegand interception and replay module• Compatible with 5V access control systems• Captures and stores credential bitstreams• Built-in Wi-Fi web interface for control• Stores up to ~80,000 credentials• Based on open-source OctoSavvi ESPKey platform• Hackitsune-enhanced PCB design and build files available• Firmware updatable via Hackitsune Web Flasher Disclaimer Hackitsune hardware is designed for professional security research, development, and authorised testing purposes only. Users are responsible for ensuring compliance with all applicable laws and regulations in their jurisdiction. Always obtain proper authorisation before interacting with systems, networks, or devices you do not own. Hackitsune accepts no liability for misuse of this product. Use responsibly. 🦊
