Exploits locked computers via USB to hijack internet traffic, steal browser cookies, and install persistent web backdoors using a Raspberry Pi Zero.
PoisonTap is a security research tool that demonstrates how a locked computer can be compromised via a USB device. It emulates an Ethernet-over-USB device to hijack all internet traffic, enabling cookie theft, installation of persistent web backdoors, and remote access to the internal router, even after the device is removed.
Security researchers, penetration testers, and cybersecurity professionals who need to demonstrate physical access vulnerabilities and protocol weaknesses in locked systems.
Developers choose PoisonTap for its ability to bypass multiple security mechanisms like lock screens, routing priorities, HttpOnly cookies, and two-factor authentication in a single, cascading attack, providing a comprehensive demonstration of USB-based network hijacking and persistent compromise.
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Exploits trust in USB, DHCP, DNS, and HTTP to demonstrate cascading vulnerabilities, bypassing lock screens and routing priorities as described in the network hijacking section.
Installs web backdoors via HTTP cache poisoning that survive device removal, enabling ongoing remote access even after the attacker leaves, as detailed in the backdoor mechanism.
Bypasses HttpOnly cookies, SameSite attributes, X-Frame-Options, and two-factor authentication by hijacking existing sessions, listed explicitly in the README's evasion section.
Built for the $5 Raspberry Pi Zero with minimal additional components, making it accessible for researchers on a budget, as highlighted in the demo and installation sections.
Requires flashing Raspberry Pi, installing dependencies like Node.js and isc-dhcp-server, and editing system files such as /etc/network/interfaces, which can be daunting and prone to misconfiguration.
Released in 2016, it may not work on modern operating systems with updated USB stacks or security patches, reducing its reliability for current demonstrations.
Largely ineffective against servers using HTTPS with HSTS and Secure cookies, as admitted in the securing section, limiting its applicability in well-protected environments.
Needs an Internet-accessible server running backend_server.js for remote backdoor management, adding operational complexity and potential points of failure.