The Flipper Zero is a “learn by poking at things” device, and that’s exactly why it’s such a good teaching tool. It doesn’t hand you exploits, it hands you a friendly interface over a pile of wireless protocols that most people assume are secure and mostly aren’t. The best way to start is with the boring stuff you own, because that’s where the real lessons live.
Here’s a path that gets you comfortable with the interface while actually teaching you how these systems work.
Start with Infrared (the easy win)
IR is the gentlest possible introduction. Point a remote at your Flipper, learn the buttons, save them, and you’ve got a universal remote for your TV, AC, or projector. The built-in universal remote database covers most consumer gear without any setup at all.
There’s no legal gray area here and nothing to break, it’s the perfect place to get a feel for capturing, saving, and replaying a signal, which is the mental model you’ll reuse everywhere else on the device.
125 kHz RFID: clone a fob you already carry
Read one of your own low-frequency fobs: an old gym tag, an apartment fob, a hotel-style card and clone it to a blank. It takes about thirty seconds.
The lesson lands harder than any slide deck: these credentials have no meaningful authentication. If you can hold your Flipper near the card, you can copy it. Once you’ve watched your own building fob duplicate in real time, you understand why low-frequency RFID for access control is a problem, not just that it is.
NFC / 13.56 MHz: a step up in complexity
The high-frequency side is where it gets interesting. Read MIFARE Classic tags, run a dictionary attack against the default keys, and write to a Magic card if the keys fall.
A tamer but eye-opening exercise: read the public data broadcast by your own contactless bank card. You’re not extracting anything you can spend — you’re seeing what actually gets transmitted, which is a useful reality check on how much these systems reveal by design.
Sub-GHz: capture and replay
Capture a signal from a simple 433/315 MHz remote — a ceiling fan, an LED strip controller, a cheap doorbell — and replay it. Instant, satisfying, and a clean demonstration of why static-code remotes are trivially defeated.
Then try it on a modern garage door opener and watch it fail. That failure is the actual lesson. Rolling codes exist precisely to stop replay attacks, and running into that wall teaches you more about the mitigation than reading about it ever would.
A note on transmitting: receiving is passive and low-risk, but transmitting on sub-GHz bands has real legal limits depending on where you live and what frequency you’re on. Know your local rules before you hit send.
BadUSB: your first payloads
The Flipper emulates a USB keyboard, and Ducky Script is about as approachable as scripting gets. Start harmless — open Notepad, type a message — then build up to a payload that plausibly illustrates risk for an awareness demo.
This is also reliable short-form content material if you’re producing any. “This innocent-looking device just typed 200 words per minute into a locked-looking laptop” is a hook that writes itself.
GPIO / UART: the underrated one
This is the part most people skip, and it’s the most valuable. The Flipper works as a USB-to-serial adapter, so you can wire into the serial console on a router or IoT device and drop into its bootloader.
This is the gateway drug to hardware hacking. Once you’re reading UART output off a $15 router you bought specifically to take apart, a whole category of devices stops looking like sealed black boxes and starts looking like something you can interrogate.
Firmware and apps
Install apps from the official catalog first — get comfortable before you go further. When you’re ready, custom firmware like Momentum, Unleashed, or RogueMaster adds features and unlocks region-restricted frequencies.
That last point matters: unlocking restricted frequencies can put you on the wrong side of local regulations. The firmware doesn’t know where you live; you’re the one responsible for staying legal.
Small stuff worth trying
- BLE remote — use the Flipper as a camera shutter for your phone or a clicker for slides.
- iButton — read those little contact-based keys still used in some buildings and older systems.
- Built-in games — level up your dolphin while you learn the menus.
The one rule that matters
Keep everything to hardware you own or have written authorization to test. Reading and cloning your own fob is a lesson. Doing it to your neighbor’s is a crime. Sub-GHz transmit and any Wi-Fi devboard features are where beginners most often drift across a legal line without noticing, so those are the two to be most careful with.
A concrete first afternoon
If you want a starting project rather than a menu: build an IR universal remote for your living room, then clone a 125 kHz fob you already carry. Between those two you’ll have touched capturing, saving, and replaying signals — the core loop of the entire device — and you’ll walk away already understanding something real about why one of your access credentials isn’t as safe as you assumed.
That’s the Ping-Sec way to start: own the hardware, break your own stuff, and learn why before you learn how far.