Modular Offensive Mobile Operations
Next-Generation Wireless Security Audit Platform
Built for Red Teams, Pentesters & Security Researchers
Quick Start β’
Features β’
Architecture β’
Hardware β’
Ecosystem β’
Docs
MoMo is a comprehensive wireless security audit platform designed for the Raspberry Pi 5 . It combines the best features of industry-standard tools like Pwnagotchi, ESP32 Marauder, and WiFi Pineapple into one powerful, extensible, and professional-grade platform.
Challenge
MoMo Solution
π Multiple disconnected tools
β
Unified platform with modular architecture
π± Limited headless operation
β
Management network + OLED display + Web UI
π Manual data synchronization
β
Real-time sync with Nexus central hub
π» Requires laptop in field
β
Fully autonomous operation with Auto-Pwn
π WPA3 bypasses existing tools
β
Native WPA3/SAE detection and downgrade
π Limited social engineering
β
Evil Twin, Karma/MANA, Evilginx AiTM
Multi-Radio Management
WPA2/WPA3 Attacks
PMKID Capture
Evil Twin (6 templates)
Karma/MANA
Evilginx MFA Bypass
π Credential Harvesting
LLMNR/NBT-NS Poisoning
NTLM Hash Capture
HTTP Auth Sniffing
Kerberoast
AS-REP Roasting
LDAP Enumeration
Auto-Pwn Mode
GPS Wardriving
Cloud Cracking
Session Persistence
Real-time Sync
Event-driven Alerts
π₯ Wireless Security Testing
WiFi Attacks - Click to expand
Feature
Description
Status
Wardriving
GPS-correlated AP scanning with SQLite persistence
β
Multi-Radio
Manage multiple WiFi adapters simultaneously
β
PMKID Capture
Clientless WPA2 attack via hcxdumptool
β
Deauth Attacks
Targeted client disconnection
β
Handshake Capture
EAPOL 4-way handshake collection
β
WPA3/SAE
Detection, downgrade attacks, PMF handling
β
Evil Twin
Rogue AP with captive portal (6 templates)
β
Karma/MANA
Auto-respond to probes, EAP credential capture
β
Evilginx AiTM
MFA bypass via session cookie capture
βοΈ VPS
Bluetooth Attacks - Click to expand
Feature
Description
Status
BLE Scanner
Device & beacon detection with RSSI tracking
β
GATT Explorer
Service/characteristic discovery & read/write
β
Beacon Spoofing
iBeacon & Eddystone frame injection
β
HID Injection
Bluetooth keyboard emulation
β
SDR Integration - Click to expand
Feature
Description
Status
RTL-SDR Support
V3 & V4 with HF direct sampling, bias tee
β
HackRF Support
TX/RX capable for replay attacks
β
Spectrum Analyzer
Frequency scanning & peak detection
β
Signal Decoder
433/868 MHz IoT signal capture
β
π Credential Harvesting (NEW in v1.6.0)
MoMo-Creds Module - Click to expand
Feature
Description
Status
Responder
LLMNR/NBT-NS/mDNS poisoning
β
NTLM Capture
NTLMv1/v2 hash capture via SMB/HTTP
β
NTLM Relay
Hash relay to target systems
β
HTTP Sniffer
Basic/Digest/Form/Bearer credential capture
β
Kerberoast
Service ticket extraction for offline cracking
β
AS-REP Roast
Target accounts without pre-authentication
β
LDAP Enum
AD user/group/computer enumeration
β
Auto Export
Hashcat/John format export
β
Export Formats:
Hashcat: 5500 (NTLMv1), 5600 (NTLMv2), 13100 (Kerberos RC4), 18200 (AS-REP)
John the Ripper: NETLM, NETNTLMv2, krb5tgs
π€ Autonomous Operation
Auto-Pwn Mode - Click to expand
Feature
Description
Target Discovery
Automatic network scanning and prioritization
Attack Chaining
PMKID β Deauth β Evil Twin fallback sequence
Session Persistence
Resume after reboot, save progress
Safety Features
Battery monitoring, max duration limits
Cloud Integration
Auto-sync captures to Nexus for cracking
Modes:
passive - Scan only, no attacks
balanced - Smart targeting, avoid detection
aggressive - Maximum speed, all techniques
π₯οΈ Headless Operation
Feature
Description
Management Network
Dedicated wlan0 for tablet/phone control
OLED Display
128x64 interactive menu with GPIO buttons
Web Dashboard
Real-time dark-theme UI with SSE updates
Auto-Whitelist
Management network protected from attacks
Feature
Description
Web-based Setup
Modern React UI, mobile-friendly
Auto WiFi AP
Connect to MoMo-Setup network
QR Code Display
Scan OLED QR to connect
Nexus Discovery
Auto-find Nexus via mDNS
Headless Mode
/boot/momo-config.yml for fleet deploy
Flash MoMo image to SD card
Power on Raspberry Pi
Connect to MoMo-Setup WiFi (password: momosetup)
Browser opens wizard automatically
Complete 6-step setup in ~2 minutes
Headless? Copy configs/momo-config.example.yml to /boot/momo-config.yml
One-Line Install (Raspberry Pi 5)
curl -fsSL https://raw.githubusercontent.com/M0M0Sec/MoMo/main/deploy/momo-quickstart.sh | sudo bash
momo version # Show version info
momo doctor # Run system diagnostics
momo run --dry-run # Test without hardware
momo web-url --show-token
# Output: http://192.168.4.1:8082?token=xxxxx
Requirement
Minimum
Recommended
Hardware
Raspberry Pi 4
Raspberry Pi 5
OS
Raspberry Pi OS Lite 64-bit
Raspberry Pi OS Lite 64-bit
Python
3.11
3.12+
Storage
16GB SD
64GB+ SD
WiFi Adapter
1x Monitor Mode
2x (Attack + Management)
Method 1: Automated Install
# Download and run installer
curl -fsSL https://raw.githubusercontent.com/M0M0Sec/MoMo/main/deploy/install.sh | sudo bash
# Configure
sudo nano /etc/momo/momo.yml
# Enable service
sudo systemctl enable --now momo
# Clone repository
git clone https://github.com/M0M0Sec/MoMo.git
cd MoMo
# Create virtual environment
python3 -m venv venv
source venv/bin/activate
# Install dependencies
pip install -e " .[full]"
# Install system dependencies
sudo apt install -y hcxdumptool hcxtools aircrack-ng gpsd gpsd-clients
# Run
momo run -c configs/momo.yml
Method 3: Development Setup
# Install with dev dependencies
pip install -e " .[dev]"
# Setup pre-commit hooks
pre-commit install
# Run tests
pytest tests/ -v --cov=momo
# Run linting
ruff check momo/
mypy momo/
Clean Architecture Design
MoMo follows Clean Architecture principles with clear separation of concerns:
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β PRESENTATION β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
β β Web UI β β REST API β β CLI β β
β β (Flask) β β (FastAPI) β β (Click) β β
β ββββββββ¬βββββββ ββββββββ¬βββββββ ββββββββ¬βββββββ β
βββββββββββ΄βββββββββββββββββ΄βββββββββββββββββ΄ββββββββββββββββββββββ€
β APPLICATION β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β Plugin Manager β β
β β βββββββββββ βββββββββββ βββββββββββ βββββββββββ β β
β β βWardriverβ βEvil Twinβ β Karma β β Creds β ... β β
β β βββββββββββ βββββββββββ βββββββββββ βββββββββββ β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β DOMAIN β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
β β AccessPoint β β GPSPosition β β Handshake β ... β
β β (Model) β β (Model) β β (Model) β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β INFRASTRUCTURE β
β ββββββββββ ββββββββββ ββββββββββ ββββββββββ ββββββββββ β
β β WiFi β β BLE β β GPS β β SDR β β Creds β ... β
β βScanner β βScanner β β Client β βManager β βManager β β
β ββββββββββ ββββββββββ ββββββββββ ββββββββββ ββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
momo/
βββ core/ # Core utilities
β βββ events.py # Pub/Sub event bus
β βββ plugin.py # Plugin system
β βββ capability.py # Feature gates
β βββ security.py # Input sanitization
β
βββ domain/ # Business models
β βββ models.py # Pydantic models
β
βββ infrastructure/ # Hardware abstraction
β βββ wifi/ # WiFi scanner, radio manager
β βββ ble/ # BLE scanner, GATT, HID
β βββ gps/ # GPS client, distance tracking
β βββ sdr/ # RTL-SDR, HackRF, spectrum
β βββ capture/ # Handshake capture
β βββ eviltwin/ # Rogue AP, captive portal
β βββ karma/ # Karma/MANA attacks
β βββ wpa3/ # WPA3 detection & attacks
β βββ creds/ # Credential harvesting (NEW)
β β βββ responder.py # LLMNR/NBT-NS poisoning
β β βββ ntlm.py # NTLM capture & relay
β β βββ http_sniffer.py # HTTP auth sniffing
β β βββ kerberos.py # Kerberoast, AS-REP
β β βββ ldap_enum.py # AD enumeration
β β βββ manager.py # Central orchestrator
β βββ autopwn/ # Autonomous attack engine
β βββ display/ # OLED menu system
β βββ cracking/ # John + Cloud proxy
β βββ hardware/ # Device auto-detection
β βββ management/ # Headless network
β βββ nexus/ # Nexus sync client
β βββ database/ # Async SQLite
β
βββ apps/
β βββ momo_core/ # Main service loop
β βββ momo_plugins/ # Plugin collection
β β βββ wardriver.py
β β βββ evil_twin.py
β β βββ karma_mana.py
β β βββ creds_harvester.py # NEW
β β βββ ...
β βββ momo_web/ # Flask API + Web UI
β
βββ plugins/ # Modern plugin architecture
βββ configs/ # Configuration files
βββ tests/ # Test suite
β βββ unit/ # Unit tests (484 tests)
β βββ integration/ # Integration tests
β βββ e2e/ # End-to-end tests
βββ docs/ # Documentation
Event-Driven Architecture
βββββββββββββββ publish βββββββββββββββ subscribe βββββββββββββββ
β Plugin A β ββββββββββββΆ β Event Bus β ββββββββββββββ β Plugin B β
β (Scanner) β β β β (Display) β
βββββββββββββββ ββββββββ¬βββββββ βββββββββββββββ
β
ββββββββΌβββββββ
β Plugin C β
β (Logger) β
βββββββββββββββ
Adapter
Chipset
Monitor
Injection
5GHz
WiFi 6/6E
Recommended
Alfa AWUS036AXML
MT7921AUN
β
β
β
β
6E
βββ
Alfa AWUS036ACH
RTL8812AU
β
β
β
β
βββ
Alfa AWUS036ACM
MT7612U
β
β
β
β
ββ
Alfa AWUS036ACS
RTL8811AU
β
β
β
β
ββ
TP-Link Archer T2U+
RTL8821AU
β
β
β
β
β
Panda PAU09
RT5572
β
β
β
β
β
Device
Frequency
TX
Use Case
RTL-SDR V4
500kHz - 1.7GHz
β
IoT sniffing, ADS-B
RTL-SDR V3
24MHz - 1.7GHz
β
General purpose
HackRF One
1MHz - 6GHz
β
Replay attacks
YARD Stick One
300-928MHz
β
Sub-GHz specialist
Category
Recommended Device
Notes
GPS
u-blox NEO-M8N
USB, high accuracy
Bluetooth
Sena UD100
Long range, BT5.0
OLED Display
SSD1306 128x64
I2C, 0.96"
Power
PiSugar 3
5000mAh, UPS
Access the real-time dashboard:
momo web-url --show-token
# β http://192.168.4.1:8082?token=xxxxx
Features:
πΊοΈ Real-time wardriving map (Leaflet.js)
π Live statistics with SSE updates
π Handshake management
βοΈ Configuration editor
π Alert notifications
Core Endpoints
Method
Endpoint
Description
GET
/api/status
System status
GET
/api/stats
Runtime statistics
GET
/api/config
Current configuration
GET
/sse/events
Real-time event stream
GET
/metrics
Prometheus metrics
WiFi Endpoints
Method
Endpoint
Description
GET
/api/wardriver/aps
Discovered access points
POST
/api/eviltwin/start
Start Evil Twin attack
POST
/api/karma/start
Start Karma/MANA
GET
/api/wpa3/networks
WPA3 network list
POST
/api/capture/start
Start handshake capture
Credential Endpoints (NEW)
Method
Endpoint
Description
GET
/api/creds/status
Harvesting statistics
POST
/api/creds/start
Start credential harvesting
POST
/api/creds/stop
Stop harvesting
GET
/api/creds/ntlm
Captured NTLM hashes
GET
/api/creds/http
HTTP credentials
GET
/api/creds/kerberos
Kerberos tickets
POST
/api/creds/export
Export to file
Hardware Endpoints
Method
Endpoint
Description
GET
/api/hardware/devices
Connected devices
GET
/api/ble/devices
BLE scan results
GET
/api/sdr/spectrum
Spectrum data
GET
/api/gps/position
Current GPS position
# Using environment variable
export MOMO_UI_TOKEN=" your-secure-token"
# Using header
curl -H " Authorization: Bearer $MOMO_UI_TOKEN " http://localhost:8082/api/status
# Using query parameter (for browsers)
http://localhost:8082/? token=your-secure-token
MoMo features a modern, Marauder-inspired plugin architecture with full lifecycle management.
"""Example MoMo Plugin."""
from momo .core .plugin import Plugin , PluginMetadata , PluginType
class MyAwesomePlugin (Plugin ):
"""My custom attack plugin."""
@staticmethod
def metadata () -> PluginMetadata :
return PluginMetadata (
name = "my_awesome_plugin" ,
version = "1.0.0" ,
author = "Your Name" ,
description = "Does awesome things" ,
plugin_type = PluginType .ATTACK ,
priority = 100 ,
requires = ["wifi" ],
)
async def on_load (self ) -> None :
"""Called when plugin is registered."""
self .log .info ("Plugin loaded" )
# Subscribe to events
await self .subscribe ("ap_discovered" , self .on_ap_found )
async def on_start (self ) -> None :
"""Called when plugin is activated."""
self .log .info ("Plugin started" )
# Start background task
self ._task = asyncio .create_task (self ._worker ())
async def on_stop (self ) -> None :
"""Called when plugin is deactivated."""
if self ._task :
self ._task .cancel ()
self .log .info ("Plugin stopped" )
async def on_ap_found (self , event : dict ) -> None :
"""Handle discovered access point."""
ap = event ['data' ]
self .log .info (f"Found AP: { ap ['ssid' ]} " )
# Publish event
await self .emit ("my_event" , {"status" : "processing" })
async def _worker (self ) -> None :
"""Background worker loop."""
while True :
await asyncio .sleep (10 )
# Do periodic work
# Entry point
def create_plugin () -> Plugin :
return MyAwesomePlugin ()
ββββββββββββ load ββββββββββββ start ββββββββββββ
β UNLOADED β βββββββββΆ β LOADED β βββββββββΆ β RUNNING β
ββββββββββββ ββββββββββββ ββββββ¬ββββββ
β
stop β
βΌ
ββββββββββββ
β STOPPED β
ββββββββββββ
Hook
Async
Use For
on_load()
β
Event subscriptions, lightweight init
on_start()
β
Start background tasks, connect to hardware
on_tick(ctx)
β
Periodic sync operations
on_stop()
β
Cleanup, stop tasks
on_unload()
β
Final cleanup
Type
Priority
Description
CORE
0
Essential system plugins
SCANNER
10
WiFi/BLE scanning
CAPTURE
20
Data capture
ATTACK
30
Active attacks
ANALYSIS
40
Data analysis
UI
50
User interface
CUSTOM
100
Custom plugins
# /etc/momo/momo.yml
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# General Settings
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
mode : aggressive # passive, balanced, aggressive
interface :
name : wlan1 # Primary attack interface
mac_randomization : true
channel_hop : true
channels : [1, 6, 11] # 2.4GHz channels
channels_5ghz : [36, 40, 44, 48] # 5GHz non-DFS channels
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Headless Operation
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
management :
enabled : true
interface : wlan0 # Pi5 internal WiFi
mode : ap # ap or client
ap_ssid : MoMo-Management
ap_password : YourSecurePassword # β οΈ CHANGE THIS
auto_whitelist : true # Protect from self-attack
bind_web_to_management : true
oled :
enabled : true
i2c_address : " 0x3C"
menu :
enabled : true
idle_timeout : 30.0
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Attack Modules
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
aggressive :
enabled : true
deauth :
enabled : true
max_per_minute : 0 # 0 = unlimited
evil_twin :
enabled : true
pmkid :
enabled : true
ssid_blacklist : [] # Your networks (protected)
eviltwin :
enabled : false
portal_template : generic # generic, hotel, corporate, facebook, google, router
karma :
enabled : false
respond_to_all : true
capture_eap : true
wpa3 :
enabled : true
auto_downgrade : false
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Credential Harvesting
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
creds :
enabled : false
interface : eth0
output_dir : logs/creds
responder :
enabled : true
llmnr : true
nbns : true
ntlm :
enabled : true
smb_port : 445
http_port : 80
http :
enabled : true
ports : [80, 8080, 8000]
kerberos :
enabled : false
dc_ip : " "
domain : " "
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Auto-Pwn Mode
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
autopwn :
enabled : false
mode : balanced # passive, balanced, aggressive
min_signal_dbm : -80
max_concurrent_attacks : 1
enable_pmkid : true
enable_deauth : true
enable_eviltwin : false
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Hardware
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
ble :
enabled : false
scan_duration : 5.0
sdr :
enabled : false
device_type : rtlsdr
hardware :
auto_detect : true
auto_configure : true
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Cracking & Sync
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
cracking :
enabled : true
use_john : true
cloud_enabled : false
nexus_api_url : " "
plugins :
enabled :
- wardriver
- active_wifi
- creds_harvester
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# General Commands
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
momo version # Show version and build info
momo doctor # Run system diagnostics
momo status # Show runtime status
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Running MoMo
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
momo run # Start with default config
momo run -c /path/to/momo.yml # Start with custom config
momo run --dry-run # Simulate without hardware
momo run --debug # Enable debug logging
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Web Interface
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
momo web-url # Show Web UI URL
momo web-url --show-token # Include auth token
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
# Maintenance
# βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
momo rotate-now # Force log rotation
momo export --format hashcat # Export captured data
momo backup # Backup configuration
MoMo is part of an integrated offensive security ecosystem. Each project is designed for seamless collaboration.
βοΈ CLOUD LAYER
βββββββββββββββββββββββββββββββββββ
β GPU Cracking β Evilginx VPS β
ββββββββββββββββββ¬βββββββββββββββββ
β
ββββββββΌβββββββ
β β
β π’ NEXUS β
β Central Hub β
β β
ββββββββ¬βββββββ
β
βββββββββββββββββββββββββββΌββββββββββββββββββββββββββ
β β β
ββββββββΌβββββββ βββββββββΌββββββββ ββββββββΌβββββββ
β β β β β β
β π΅ MOMO βββββββββββΆβ π» GHOSTBRIDGEββββββββββΆβ π MIMIC β
β WiFi/BLE β β Network β β USB Attack β
β Pi 5 β β Implant β β Pi Zero β
β β β β β β
βββββββββββββββ βββββββββββββββββ βββββββββββββββ
Project
Description
Platform
Links
π΅ MoMo
WiFi/BLE/SDR Audit Platform
Pi 5
GitHub
π’ Nexus
Central C2 Hub
Pi 4
GitHub
π» GhostBridge
Transparent Network Implant
NanoPi R2S
GitHub
π Mimic
USB Attack Platform
Pi Zero 2W
GitHub
# Enable Nexus sync in momo.yml
nexus :
enabled : true
api_url : " http://nexus.local:8080"
device_id : " momo-field-01"
sync_interval : 30
sync :
handshakes : true
credentials : true
wardriving : true
Version
Phase
Status
v0.1.0
Core Infrastructure
β
v0.5.0
Bluetooth Scanner
β
v0.7.0
Cracking Integration
β
v1.0.0
WPA3/SAE Attacks
β
v1.2.0
Bluetooth Expansion
β
v1.5.0
SDR Integration
β
v1.5.2
Management Network
β
v1.6.0
Credential Harvesting
β
v1.7.0
First Boot Wizard
β
NEW
Statistics:
π 527 Tests passing
π 87% Coverage
π 52 Plugins available
π‘ 6 Attack Modules
Contributions are welcome! Please read our contributing guidelines.
Fork the repository
Create a feature branch (git checkout -b feature/amazing)
Commit changes (git commit -m 'feat: add amazing feature')
Push to branch (git push origin feature/amazing)
Open a Pull Request
type(scope): description
Types: feat, fix, docs, style, refactor, test, chore
# Setup
git clone https://github.com/M0M0Sec/MoMo.git
cd MoMo
pip install -e " .[dev]"
pre-commit install
# Test
pytest tests/ -v --cov=momo
# Lint
ruff check momo/
mypy momo/
# Format
black momo/
MoMo is designed for authorized security testing and educational purposes only.
β
Only use on networks you own or have explicit written permission to test
β
Respect local laws and regulations regarding wireless security testing
β
Follow responsible disclosure practices
β The developers are not responsible for misuse of this tool
β Unauthorized access to computer systems is illegal
This project is licensed under the MIT License - see the LICENSE file for details.
Part of the π₯ MoMo Ecosystem
Inspired by Pwnagotchi β’ ESP32 Marauder β’ WiFi Pineapple
π΅ MoMo β’
π’ Nexus β’
π» GhostBridge β’
π Mimic
Made with β€οΈ by the MoMo Team