OPX-Demon is a free, open-source mobile penetration-testing suite for Android. WiFi attacks, Nmap, Nuclei, Metasploit, HID & USB gadgets — all running from a real Debian trixie arm64 chroot, or a rootless QEMU VM when root is unavailable.
The engine that made the original famous — rebuilt, patched and hardened by OPX.
MIUI kernels misreport full-speed USB adapters as low-speed, killing Realtek dongles.
OPX-Demon ships a custom 6.12.94 kernel with a hub.c classification fix plus a QEMU
host-libusb quirk. Your rtl8188fu finally enumerates.
rtl8xxxu, rtw88 (8821cu/8822bu/8812au), ath9k_htc,
carl9170, mt76, rt2x00, rtl8187,
zd1211rw — compiled into the kernel. Adapter firmware ships inside the
rootfs, so it just works after install.
No root? No problem. The same Debian rootfs boots in a QEMU VM at
localhost:1050 on stock devices — with resumable downloads, fixed
libslirp boot and no more stuck login prompts.
Grab the latest signed APK straight from GitHub Releases — always current, always free.
Download latest APKSixteen fully-integrated modules cover wireless, network, web, physical-access and post-exploitation workflows — no CLI required, but a full terminal is always one swipe away.
Live overview of the chroot, USB adapters and mount state, with quick actions, app news feed and WiFi history.
COREScan, deauth, capture WPA handshakes and run WPS attacks — Pixie Dust, common PINs and custom PIN sequences via monitor-mode adapters.
WIRELESSLocal handshake vault with rename & share, export to OnlineHashCrack, and on-device cracking via Hashcat.
CRACKINGInline and dedicated MAC randomizer with persistent profiles per interface.
ANONYMITYFast Pair discovery, CVE-2025-36911 checks and full exploit chain, post-pair account-key writes and HFP audio capture/passthrough.
BLENmap host discovery, port scans and OS fingerprinting with per-device exploit dispatch and a live terminal.
NETWORKDirect Nmap interface with custom scripts, NSE engine and exported reports.
NETWORKMulti-target Nuclei scans with severity-grouped findings and per-finding evidence.
WEBCustom exploit & scanner database with template arguments: {IP}, {PORT}, {MAC}, {GW}, {MASK}.
DuckyScript-compatible USB HID injection — pure-Java parser (Hak5 v1 + v3 superset), 7 keyboard layouts and a live execution log.
PHYSICALUSB-gadget profile manager: HID keyboard/mouse, mass-storage, RNDIS/ECM/ACM, custom VID/PID/serial, mount .img/.iso images.
PHYSICALNative MSF console inside the chroot with sessions, payload generation and a module browser.
EXPLOITSOSM-based map of captured BSSIDs and handshakes with WiGLE-style KML/CSV export.
MAPPINGStand up an in-chroot XFCE/Xfce-VNC session and view it locally on the device.
DESKTOPMount, unmount and repair the chroot; manage installed components and incremental core repair.
COREBuilt-in terminal (drawer → Terminal, plus a home-screen launcher icon) dropping straight into the chroot shell.
COREEvery screen of the app, exactly as you'll meet it — the same flow the real UI follows from first launch to full attack surface.
A neon splash slides you into a one-time intro wizard: storage and runtime permissions, root grant (or rootless mode) and engine choice. Skippable, and never shown again.
Mission control. Chroot status, engine health, connected USB adapters and quick actions at a glance — plus the news feed and your WiFi history feed below.
Pick a network from the live scan, then launch deauth, handshake capture or the full WPS battery — Pixie Dust, common PINs or a custom PIN list — with a live packet counter.
Every capture lands here. Rename, share, export to OnlineHashCrack or hand the file to the on-device Hashcat cracker without ever leaving the app.
Host discovery sweeps the subnet, port scans and OS fingerprinting fill the device cards, and each device opens an exploit dispatch sheet with a live terminal attached. A dedicated Nmap screen exposes raw flags, NSE scripts and report export.
Add targets, pick templates, launch. Findings group by severity with per-finding evidence, and full reports open in their own viewer with terminal output retained.
Write DuckyScript in the built-in IDE, choose one of 7 keyboard layouts and fire — the execution log streams live. USB Arsenal manages gadget profiles: keyboard, mouse, mass-storage, RNDIS/ECM/ACM, custom VID/PID/serial and .img/.iso mounting.
A native MSF console inside the chroot: sessions list, payload generator and a browsable module database — all wrapped in the app UI instead of a raw shell.
GeoMac plots every captured BSSID and handshake on an OpenStreetMap layer with WiGLE-style KML/CSV export. WhisperPair discovers Fast Pair BLE devices, checks CVE-2025-36911, runs the exploit chain and can capture HFP audio after pairing.
Core manager mounts, unmounts and repairs the chroot with incremental repair. VNC desktop stands up an XFCE session you view locally, and the Terminal — in the drawer or on your home screen — drops straight into a root shell.
Version, changelog and APK link are fetched live from GitHub Releases every time this page loads. A new release on GitHub shows up here automatically.
Loading the newest GitHub release. On first launch the in-app installer fetches the Debian trixie arm64 core (~1 GB) — Wi-Fi is recommended.
Pulled from the GitHub Releases API. New tags appear here as soon as they are published — no site rebuild required.
Android 7.0 (API 24) or newer. Root via Magisk/KernelSU for the native chroot engine; the rootless QEMU engine runs on stock devices.
For the Debian trixie chroot, bundled tools and firmware signatures.
External monitor-mode adapter for WiFi attacks — Atheros AR9271 or Realtek 88XXAU recommended. OTG cable required.
For HID Attacks & USB Arsenal: USB configfs enabled, kernel ≥ 3.19, populated /sys/class/udc/. Most modern kernels qualify.
localhost:1050.rtl8xxxu, rtw88, ath9k_htc, carl9170, mt76, rt2x00, rtl8187 and zd1211rw are pre-built into the shipped kernel, with firmware bundled in the rootfs.hub.c classification fix plus a QEMU host-libusb quirk — two independent layers that make adapters like rtl8188fu enumerate correctly.