WifiSpy

BLE provisioning · LAN tunnel
disconnected

Drop an ESP32 on any network — reach it from your server.

Pair with a freshly-flashed ESP32 over Bluetooth and hand it a WiFi network. The device then dials home over WebSocket and exposes every TCP service on its LAN through this backend's SOCKS5 proxy.

No router config. No port forwards. No static IPs.

  • 📶 Scan & join Wi-Fi
    Live signal-sorted list, sent over BLE.
  • 🪪 Editable creds
    Mint a fresh device, paste your own, or rotate. You decide what gets pushed.
  • 🛰 Pick the backend
    Set the ws:// URL the node will dial. Remembered between sessions.
ESP32 not showing up?
  • Power-cycle the device. It advertises as WifiSpy-XXXXXX when un-provisioned.
  • Hold BOOT for 5 seconds to factory-reset an already-provisioned device.
  • Web Bluetooth needs Chrome/Edge over HTTPS or localhost. Linux snap/flatpak Chrome is blocked — install the official .deb.

Status

—
Device
—
Label
—
Firmware
—
MAC
—
WiFi
—
SSID
—
IP
—
Backend
—
Claimed
—
Last result
—

WiFi networks

—

Click a network to enter its password and connect.

  • Not scanned yet.
Connect to a hidden network

Hidden networks don't broadcast their SSID — enter the name manually.

Device name

The BLE name advertised to scanners. The last 3 bytes of the MAC stay appended (-XXXXXX) so each unit remains uniquely identifiable. Pick from the suggestions or type your own.

Full BLE name: —

—

Device credentials

What the ESP32 needs to dial home: a backend WS URL plus its device_id and token. Use Register to mint a fresh record on this backend, or paste your own values and push. The server address is remembered between visits.

—

rsyslog forwarder

Ships every firmware log line and the full UART RX/TX byte stream to an operator-supplied syslog server over UDP (RFC 3164). Each message is tagged with the originating submodule, e.g. [UART-RX], [GPIO], [wifi]. Requires WiFi to be up; messages emitted while offline are dropped from the tail of a 64-line in-memory ring.

—

Quick rsyslog recipe (on the server): module(load="imudp") input(type="imudp" port="514") — then filter on the hostname or [UART-RX] tag.

BLE password

Soft lock on BLE writes. A fresh device ships with the default password wifispy. Operator types it on every BLE connect — the password is never persisted in the browser. Hardware recovery: hold BOOT for 3 s to reset just the password back to wifispy, or 10 s for a full factory reset.

—

Log