Web Flasher

v1.0.1 · ESP32-S3 · 16 MB flash · firmware + web UI in one pass

Install

Plug the LilyGo T-Dongle-S3 in with a data USB cable, then press Connect. Everything — bootloader, partition table, firmware and the encrypted web UI — is written in one pass. No drivers, no toolchain.

Web Serial is not available in this browser. Use Chrome or Edge (desktop). Flashing needs a HTTPS or localhost page — see flasher/serve.py.

Click Connect & Install and pick the dongle's serial port.
First-time install: tick Erase device for a clean start (optional but recommended).
Wait for the write + verify to finish (~1 min), then unplug and replug the dongle.

Re-flashing keeps your data. Firmware updates overwrite the app slot only — scripts, settings and captures on the SD card survive. Tick Erase device only for a factory-fresh device. Already running LilyStrike? You can update over WiFi from the web UI instead (Settings → Firmware Update).

What you're installing

BadUSB / DuckyScript50+ command interpreter — variables, conditionals, OS fingerprinting, human-like typing, HID combos.

Live ControlDrive keyboard, mouse and media keys of the host from the browser, in real time.

WiFi Attacks & ReconDeauth + EAPOL capture with hashcat 22000 export, EvilAP captive portal, Karma probing, live packet analyzer, host recon.

AI Interface (MCP)Drive the whole device from Claude or any MCP client — payloads, scripts, system control.

Encrypted StorageAES-256-GCM for scripts, logs and captures. Exfiltrated files land encrypted on the dongle.

False ThumbdriveBoots as an innocent read-only USB stick backed by an isolated disk image.

Stealth by DesignSleepy screen, dark LED, spoofable USB identity and MAC, kill switches on BOOT.

Web UI + OTAFull management interface over WiFi; firmware and web-UI updates over the air.

After the first boot

Config WiFi	`Dongle-Setup` / `dongle1234`
Web UI	`http://192.168.4.1` (or `http://lilystrike.local`)
Login	`admin` / `admin` — change it in Settings
License	Accept the EULA on first load
Join WiFi	BadUSB page → autostart script `CONNECT_AP your-ssid your-pass`

Full guides in the repository — DUCKYSCRIPT.md, WEB-UI.md, MCP.md, SECURITY.md, TROUBLESHOOTING.md.

Authorized use only. LilyStrike is dual-use security-testing hardware. Run payloads exclusively on systems you own or have explicit written permission to test. Unauthorized access to computer systems is a crime in most jurisdictions.

MIT License + responsible-use addendum · LilyStrike Project · flashing via ESP Web Tools