Hacking Hardware

Hacking Hardware#

Reference of physical hardware tools an offensive-security practitioner reaches for. The categories below cover the everyday kit, USB / HID injection, RFID / NFC / wireless, network implants, hardware-debug interfaces, and signal interception.

For SDR specifically, see SDR Hardware. For techniques, see Hacking. For groups using these tools, see Hacker Groups.

Use only on systems you own or have written authorization to test.

USB / HID injection#

Tool

Notes

Rubber Ducky

Hak5; HID keyboard injection; $50; updated payloads via DuckyScript v3.

Bash Bunny

Hak5; full attack platform; multi-mode (HID, mass storage, Ethernet, serial); $99-149.

Bash Bunny Mark II

Newer revision; faster CPU.

USB Ninja

Cable form-factor; HID payload triggers from BLE remote.

USB Killer

Capacitor surge into USB; permanently damages target; forensic / destructive.

O.MG Cable

Mischief Gadgets; USB-C / Lightning / micro-USB; remote activation via WiFi; HID + keylogger.

O.MG Plug

AC power-strip variant.

P4wnP1

Custom Pi Zero W payload framework; flexible.

Cactus WHID

WiFi-controlled HID; cheap.

Digispark / Tiny85

$1 cheap HID-injection MCU; AVR.

Network implants#

Tool

Notes

LAN Turtle

Hak5; man-in-the-middle Ethernet implant; SSH back-channel.

Packet Squirrel

Hak5; passive packet capture / MITM in-line.

Plunder Bug

Hak5; LAN tap; passive listening.

Shark Jack

Hak5; portable Ethernet pentest box; quick recon.

Throwing Star LAN T ap

passive tap (no active components).

Sensepost / Snoopy

drone-mounted reconnaissance.

PoisonTap

Pi-Zero-based; drops AJAX into browsers; cookie theft.

Throwing Star tap

Great Scott Gadgets; passive 100M Ethernet tap.

WiFi / Bluetooth / mesh#

Tool

Notes

WiFi Pineapple Mark VII

Hak5; rogue AP / Karma / WiFi MITM.

ESP32 Marauder

Open ESP32-based WiFi / BLE attack platform.

ESP8266 deauther

Cheap; deauth attacks (now patched in many APs).

WiFi Coconut

Hak5; wide-band WiFi monitor (14 channels).

RTL8812AU adapters

monitor mode + injection on 2.4 + 5 GHz.

ALFA AWUS-036ACH

Long-time pentester WiFi adapter.

ALFA AWUS-036ACS

802.11ac monitor / injection.

WiFiBroadcast HW

long-range FPV / video links via injection.

ESP32 BLE / Wifi

cheap BLE / WiFi attack base.

Ubertooth One

Bluetooth Classic / BLE sniffer (Great Scott Gadgets).

Sniffle / nRF52840

BLE 5 sniffer; cheap.

Bladerunner WiFi

multi-channel high-power adapter.

HamGeek / Ricoh

wide-coverage WiFi / 2G handset.

RFID / NFC / smartcard#

Tool

Notes

Proxmark3 RDV4

LF (125 kHz) + HF (13.56 MHz); the de-facto standard.

Proxmark3 Easy

cheaper variant; less precise.

Iceman fork

actively maintained Proxmark firmware.

Chameleon Mini

NFC (HF) emulation; programmable.

Chameleon Ultra

Chameleon Mini successor; broader protocol support.

HydraNFC v2 / Shiel

d NFC + LF/HF.

Flipper Zero

sub-GHz + LF + HF + iButton + IR + GPIO; the everyman tool.

ChipWhisperer

side-channel power-analysis platform (Newae).

USRP / SDR + GNU Ra dio

for non-standard NFC / RFID protocols.

ACR122U / PN532

cheap USB NFC reader / writer.

PN532 NFC HAT

Pi GPIO HAT for PN532.

Magstripe writers

MSR-x6 family; PoS card writes.

Hardware-debug / firmware#

Tool

Notes

Bus Pirate

Hex-debug for SPI / I2C / 1-Wire / UART; the original.

JTAGulator

Discover JTAG / UART pinouts on unknown boards.

Glasgow Interface E

xplorer Open-source FPGA-based hardware-debug tool.

HydraBus / HydraNFC

USB MCU + HF NFC.

J-Link / Black Magi

c Probe professional ARM debug.

Saleae Logic

logic analyzer; high-rate sampling.

DSLogic

cheap logic analyzer.

Hantek / Rigol

USB scope + LA combos.

Tigard

UART / JTAG / SWD / SPI / I2C in one USB stick.

USB-to-TTL

generic FTDI / CP2102 serial adapters.

ChipWhisperer-Lite

power-analysis platform; entry-level.

ChipWhisperer-Husky

next-gen.

ChipShouter

electromagnetic fault injection (EMFI).

Faraday cage / RF l ab

test environment.

SPI / I2C / EEPROM clip

pomonas; CH341A flash programmer for chip dumps.

Lock / physical#

Tool

Notes

Pick set

Bogota / Sparrows / Peterson; standard SPP / raking.

Bypass tools

Knife, traveler, latch slip.

Magnet

Maglock bypass.

Under-door tool

Door release.

Try-out keys

Common keyway bypass.

Tibbe / wafer set

Vehicle locks.

Bump keys

Pin-cylinder bypass.

RFID badge cloners

See RFID section above; ESPKey for Wiegand.

ESPKey

Wiegand-line implant (badge reader MITM).

Long Reach Tool

Door / lock manipulation.

Ladder / hook

Physical access.

Cellular / GSM / 5G#

Tool

Notes

LimeSDR + OpenBTS

DIY GSM basestation.

USRP + srsRAN

Open 4G / 5G eNB / gNB.

USRP + Open5GS

Open EPC / 5GC core.

PocketEPC / RangePo int

packaged 4G core.

osmocomBB / IMSI ca tchers

public research code.

Stingray-class

proprietary IMSI catchers; restricted; usually law-enforcement.

SIMcard reader

Smartcard reader (PC/SC); modify SIM contents.

Quectel / Sierra

LTE modules with AT-command access; useful for testing.

Vehicle / CAN bus#

Tool

Notes

OBD-II adapter

USB / Bluetooth; ELM327 chip.

CANtact / CANable

USB-CAN converter.

Vector CANalyzer

commercial.

PCAN-USB

Peak CAN tool.

Macchina M2 / A0

Arduino-style automotive dev.

RAMN

Reconfigurable automotive multi-board.

Cool-CAN

Open-source CAN sniffer.

Software: SocketCAN

, Wireshark, savvyCAN.

General / networking#

Tool

Notes

Raspberry Pi 5 / 4

universal pentest dropbox; runs Kali / Pwnagotchi.

Pi Zero 2 W

tiny implant.

Beaglebone Black

similar role.

Pwnagotchi

AI-driven WiFi handshake-capture Pi project.

GL.iNet routers

OpenWrt-based portable routers (AR300M, Slate AR750S, Beryl AX MT3000, Flint).

Travel routers

inexpensive OpenWrt platforms.

Capture-the-flag ha ndheld

purpose-built CTF gear.

Yubikey / Nitrokey

defensive (FIDO2) but key for hardware research.

Hardware token fore nsics

Faraday bags, mounts.

Defensive / forensic#

Tool

Notes

Faraday bags

prevent over-the-air remote-wipe of seized devices.

Cellebrite UFED

commercial mobile forensics.

GrayKey / Magnet

iOS / Android forensic.

Tableau write-block er

hardware write-blocker for forensic imaging.

LogiCube Falcon

forensic imager.

ChipOff toolkit

remove and image NAND chips.

JTAGulator (above)

for JTAG-based forensic.

USB write blockers

read-only USB-bridge boards.

Operator notes#

  • Power, field tools live on a 10-50 W power budget. Pi 5 hits 15 W under load; HackRF + amplifier ~5 W; LTE eNB variants 50+ W. Plan accordingly.

  • Storage, payloads, captures, and rainbow tables fill drives quickly. Carry a 1-2 TB NVMe.

  • Authorization, transmitting in regulated bands or attaching to networks without permission is regulated; many of these tools are legal to own but not legal to use outside authorized engagements.

  • Customs, some hardware (cell-site simulators, certain RF amplifiers) faces export-control restrictions in transit.

  • Operational hygiene, keep firmware updated; sanitize before next engagement; image storage between deployments.

References#

Contents