PoisonTap
Exploits locked computers via USB to hijack internet traffic, steal browser cookies, and install persistent web backdoors using a Raspberry Pi Zero.
What is PoisonTap?
PoisonTap is a security research tool that demonstrates how a locked computer can be compromised via a USB device. It emulates an Ethernet-over-USB device to hijack all internet traffic, enabling cookie theft, installation of persistent web backdoors, and remote access to the internal router, even after the device is removed.
Security researchers, penetration testers, and cybersecurity professionals who need to demonstrate physical access vulnerabilities and protocol weaknesses in locked systems.
Developers choose PoisonTap for its ability to bypass multiple security mechanisms like lock screens, routing priorities, HttpOnly cookies, and two-factor authentication in a single, cascading attack, providing a comprehensive demonstration of USB-based network hijacking and persistent compromise.
Overview
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
Use Cases
Best For
- Demonstrating physical access vulnerabilities via USB on locked computers.
- Security research on network hijacking and traffic interception over USB/Ethernet emulation.
- Penetration testing scenarios requiring cookie theft and session hijacking bypassing HttpOnly and HTTPS.
- Installing persistent web backdoors that survive device removal via HTTP cache poisoning.
- Gaining remote access to internal routers using DNS rebinding attacks.
- Bypassing two-factor authentication by hijacking existing browser sessions.
Not Ideal For
- Organizations seeking real-time intrusion detection or endpoint protection solutions
- Beginners in cybersecurity without deep networking and protocol knowledge
- Environments where HTTPS with HSTS and Secure cookies is strictly enforced
- Legal penetration testing without explicit authorization and consent
Pros & Cons
Pros
Exploits trust in USB, DHCP, DNS, and HTTP to demonstrate cascading vulnerabilities, bypassing lock screens and routing priorities as described in the network hijacking section.
Installs web backdoors via HTTP cache poisoning that survive device removal, enabling ongoing remote access even after the attacker leaves, as detailed in the backdoor mechanism.
Bypasses HttpOnly cookies, SameSite attributes, X-Frame-Options, and two-factor authentication by hijacking existing sessions, listed explicitly in the README's evasion section.
Built for the $5 Raspberry Pi Zero with minimal additional components, making it accessible for researchers on a budget, as highlighted in the demo and installation sections.
Cons
Requires flashing Raspberry Pi, installing dependencies like Node.js and isc-dhcp-server, and editing system files such as /etc/network/interfaces, which can be daunting and prone to misconfiguration.
Released in 2016, it may not work on modern operating systems with updated USB stacks or security patches, reducing its reliability for current demonstrations.
Largely ineffective against servers using HTTPS with HSTS and Secure cookies, as admitted in the securing section, limiting its applicability in well-protected environments.
Needs an Internet-accessible server running backend_server.js for remote backdoor management, adding operational complexity and potential points of failure.
Frequently Asked Questions
Related Projects
AdGuard HomeNetwork-wide ads & trackers blocking DNS server
Sonic PiCode. Music. Live.
Pi-KVMOpen and inexpensive DIY IP-KVM based on Raspberry Pi
P4wnP1P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.