0
$0.00
0

Cart

Zoom

FlatSat – DEFCON 34

Learn real satellite cybersecurity hands-on: a 3-level CTF with instant visual feedback, safe by design so you never touch real satellites or restricted frequencies.

$100.00

Out of stock

Email when stock available

  • Works with: CatSniffer, Electronic Cats' LoRa sniffer (single-radio overlay mode)
  • Works with: RTL-SDR USB dongle + SDR++ for passive RF verification
  • Ships with: a preloaded, intentionally vulnerable firmware that mimics real spacecraft systems
  • Works with: Linux, macOS, and Windows -- FlatSat Ground Station (Docker or native Python 3.11+)

In the box

FlatSat kit
Exclusive DEF CON 34 commemorative patch

Not included

An SDR. The RTL-SDR dongle and sub-GHz antenna used to verify FlatSat’s LoRa telemetry over the air are sold separately.

You also need

RTL-SDR USB dongle + sub-GHz antenna, for passively verifying FlatSat’s over-the-air LoRa telemetry (not included in the kit)
SDR++ software (free, sdrpp.org), to visualize the RF spectrum and confirm the downlink signal
A second FlatSat unit + a laptop running the FlatSat Ground Station webapp, for the full CTF curriculum’s Base hardware tier and Attack/Defend workshop mode
SWD probe (e.g. a second Raspberry Pi Pico as debugger) + soldering 3 wires to the board’s SWD pads, needed only for the Advanced firmware-hacking tier
Arduino IDE + arduino-pico board package, needed only if compiling or flashing custom firmware instead of the pre-compiled UF2
  • 40 GitHub Stars
  • Presented at DEF CON 34, with an exclusive DEF CON 34 patch in the bundle.
  • Designed and built in Aguascalientes, Mexico
  • Hardware CERN-OHL v1.2 · firmware GPL-3.0

What is FlatSat?

FlatSat is a hardware-based training board for learning satellite and space-systems cybersecurity hands-on, built to be vulnerable on purpose. It ships preloaded with intentionally vulnerable firmware that mimics real spacecraft systems, so you can practice binary exploitation and reverse engineering safely on hardware you own. Setup starts simple: connect over USB, enter bootloader mode, and drag a precompiled firmware file onto the board — no coding or soldering required to begin. From there, FlatSat guides you through a 3-level CTF (web and RF, systems and the CCSDS protocol, then firmware and crypto), with an onboard NeoPixel LED confirming your progress at each stage. It runs only on license-free ISM radio bands and never touches real satellites or production ground infrastructure, so training stays safely self-contained on your own board. It suits solo learners and instructor-led workshops alike.

Work through a 3-level satellite CTF

Progress through three levels of challenges: Level 1 covers web interfaces and cleartext RF, Level 2 covers onboard systems and the CCSDS protocol, and Level 3 tackles firmware and cryptography. A NeoPixel LED changes color to confirm every milestone, so you always know where you stand without a serial monitor.

Confirm the downlink without touching the board

Confirm FlatSat’s simulated satellite is actually transmitting by capturing its LoRa downlink with an RTL-SDR dongle and SDR++ — no cable, no connection to the board required. It’s a genuine over-the-air signal, captured entirely within license-free ISM bands.

Run a workshop or classroom lab, solo or in teams

Offer FlatSat as a self-paced Home Lab for independent study, or run it as a condensed, instructor-led Workshop for a group — the same board and curriculum, just paced differently. For a full Attack/Defend exercise between teams, pair a second FlatSat unit with a laptop running the FlatSat Ground Station webapp, so each team works from an identical unit.

Start in 10 minutes

  1. Connect the FlatSat board to your computer via USB.
  2. Enter bootloader mode: hold BOOT, tap RST, then release BOOT — the board mounts as a USB mass-storage drive.
  3. Download the latest firmware.ino.uf2 file from the FlatSat_Firmware GitHub releases.
  4. Drag and drop firmware.ino.uf2 onto the board’s mass-storage folder; it unmounts automatically once flashing succeeds.
  5. Head to the FlatSat wiki to pick your starting CTF level and curriculum format (Home Lab or Workshop).
MCU

RP2040 (dual-core ARM Cortex-M0+)

Radio

2x SX1262 LoRa transceivers (uplink + downlink)

Environmental sensor

BME280 (pressure, humidity, temperature)

Accelerometer

LIS2DH12, 3-axis (I2C)

Status LED

WS2812B NeoPixel (GPIO 15)

Exposed interfaces

I2C, UART, SWD

Operating voltage

3.3V I/O

Dimensions

41 mm x 78 mm

Flash memory

4 MB (no filesystem partition)

RF band

433 MHz / 915 MHz (license-free ISM)

Open hardware

CERN Open Hardware Licence v1.2

What is FlatSat?
FlatSat is a hardware-based training platform for satellite and space-systems cybersecurity, built to be vulnerable on purpose for hackers, engineers and space enthusiasts. It ships preloaded with firmware that mimics real spacecraft systems, so you can practice binary exploitation and reverse engineering safely on hardware you own. You work through it via the FlatSat Ground Station, a web dashboard and CLI that runs on Linux, macOS or Windows and talks to the board over USB.
By drag and drop, no tools needed. Connect the board over USB, enter bootloader mode (hold BOOT, tap RST, release BOOT) so it mounts as a USB drive, download the latest firmware.ino.uf2 from the FlatSat_Firmware releases and drop it onto that drive; it unmounts by itself when flashing succeeds. If you prefer to build your own firmware, use the Arduino IDE with the arduino-pico core.
Install the FlatSat Ground Station (Python; Docker or native) and connect the board over USB: you get a web dashboard at localhost:5000 and a `flatsat` command-line tool. Then follow the wiki page ‘First time using FlatSat’. Your first mission is CTF Level 1, web and cleartext RF, and each level you clear is confirmed by the NeoPixel LED changing colour.
FlatSat is a satellite simulator built to be vulnerable on purpose, for hackers, engineers and space enthusiasts. You can work through three CTF levels (web and cleartext RF, systems and the CCSDS protocol, firmware and crypto), capture its LoRa downlink with an RTL-SDR and SDR++ without touching the board, practise RF command-and-control techniques such as spoofing, fuzzing and replay against your own unit, and prototype your own payloads.

You may also like…

Minino

Minino

Security
$65.00
Add to cart