Hak5 Attack Hardware
Hak5 sells purpose-built penetration-testing devices — small, plausible-deniability hardware that automates the two hardest parts of a physical engagement: getting payloads onto machines and getting a foothold on wireless networks. The two flagship lines are the Bash Bunny (USB attack platform) and the WiFi Pineapple (rogue access point). 1 2
Bash Bunny — USB multi-attack platform
The Bash Bunny (Mark II, 2021) is a quad-core Linux computer in a USB-A shell, the spiritual successor to the USB Rubber Ducky. Where the Ducky only emulates a keyboard and injects pre-recorded keystrokes, the Bunny presents composite USB gadget personalities — simultaneously any of:
- HID keyboard (DuckyScript payload injection)
- Mass storage (deliver/pick up files; exfil staging)
- Ethernet gadget (RNDIS/ECM — presents as a network adapter, giving the Bunny a link into the host for network attacks,Responder-style credential capture, or a reverse tunnel; conceptually the same USB-gadget capability as raspberry-pi-usb-gadget-mode)
- Serial console
A physical switch selects the payload slot, an RGB LED reports attack state, and payloads are text files on a flash partition — pull the device, edit, reinsert. Attack library payloads (bunny_helpers) abstract target-OS detection and staged exfiltration. Typical engagements: unlock-workstation credential harvesting, browser-password dumping, and “jackpot” keystroke-injection shells.
WiFi Pineapple — rogue AP / auditing platform
The WiFi Pineapple (Mark VII, ~2021) is a dedicated wireless-auditing appliance built around hostapd manipulation rather than commodity-adapter hacks:
- PineAP — the core engine: harvests probe requests (the SSIDs nearby devices are shouting for), then impersonates those SSIDs (“KARMA-style” association) so clients auto-join the Pineapple. Paired with deauthentication to force reconnection.
- Management over its own WPA2 management SSID or USB-C Ethernet tether to a phone/laptop; web UI for recon, live packet capture (pcap export to wireshark), and canned campaigns (captive-portal “Evil Portal” credential phishing).
- Filters (client/SSID allow-deny) to keep an engagement scoped to authorized targets — the feature that makes it defensible in a red-team kit.
The Mark VII also ships an “Airbase”-style Open AP mode and integrates with Hak5’s Cloud C2 for remote tasking of multiple devices.
Defensive significance
These devices are why “don’t plug in found USBs” and “disable auto-join / prefer 802.1X (EAP) on enterprise SSIDs” are real policies rather than superstition — see conference-device-security for the corresponding travel/venue hardening checklist. Detection-side: unexpected USB composite devices (USBGuard), 802.11 deauth flood monitoring, and WIDS/WIPS for rogue-AP signatures.
Sources
- Bash Bunny — Hak5 Shop
- WiFi Pineapple — Hak5 Shop
- Bash Bunny by Hak5 — Documentation
- WiFi Pineapple Mark VII — Documentation
Related
- raspberry-pi-usb-gadget-mode — the DIY equivalent of the Bunny’s composite-gadget trick
- raspberry-pi-network-tap — passive Ethernet interception, the wired cousin of the Pineapple
- conference-device-security — defending against exactly these device classes in the field
- wi-fi — the protocol layer the Pineapple abuses
- wifi-deauthentication-attacks — the deauth + evil-twin pairing the Pineapple operationalizes