Five Minutes and an Empty Port Part 1: A Field Guide to Network Implant Hardware, and Why This Still Works

Every other offensive series on this site starts with a foothold already in hand. Impacket assumes you’re on WKS01. BloodHound assumes SharpHound already ran. Pivoting and Tunneling assumes you’re already inside CONTOSO.LOCAL and need to reach a segment you can’t route to yet. This series starts a step earlier than all of them: how do you get that first foothold when the target is a building, not a subnet, and the only thing standing between you and a live switch port is a receptionist who’s used to seeing people carry laptop bags.

The tools in this series solve exactly that problem, and they solve it fast. A Hak5 Shark Jack goes from “plugged into a wall jack” to “recon complete and exfiltrated over the internet” in the time it takes to refill a coffee cup. A Raspberry Pi dropbox left under a desk phones home and stays there for weeks. A single swapped USB cable at a help desk types commands into a workstation at nearly 900 keystrokes a second, faster than any human could type or notice. None of this needs a zero-day. It needs thirty seconds alone with a port, an outlet, or a desk drawer.

A short history of the category

The Rubber Ducky is the oldest tool in this space by a wide margin, first sold by Hak5 around 2010 as a USB drive that types instead of storing files. It proved a point that’s still the foundation of half this series: operating systems trust USB keyboards completely, and nothing about the HID (Human Interface Device) class of USB devices carries any concept of “is this really a person typing.” A device that presents itself as a keyboard gets treated as one, full stop.

The LAN Turtle followed a few years later, taking the same “look like something boring” idea and pointing it at the network instead of the keyboard: a device that presents itself as a generic USB-Ethernet adapter, the kind every IT department has a drawer full of, while running a full Linux system underneath. The Bash Bunny (2016) combined both ideas into one platform, capable of emulating a keyboard, a USB Ethernet adapter, and a mass storage device, sometimes all three in the same attack chain. Shark Jack, Packet Squirrel, Key Croc, and the O.MG Cable are the more recent, more specialized descendants: purpose-built for one job each rather than general-purpose platforms, and each cheaper and faster to deploy than what came before it.

Running alongside the commercial Hak5 lineage the whole time has been a homebrew community doing the same thing with a Raspberry Pi and an evening of setup: P4wnP1, pi-turtle, and a long tail of personal projects that clone LAN Turtle or Bash Bunny behavior on hardware that costs a fraction of the commercial equivalent. Part 5 of this series builds one of these for real, on a spare Pi 4.

The wireless side of this story has its own, separate history: the WiFi Pineapple has been Hak5’s rogue-access-point platform since 2008, and the current wave of cheap ESP32-based tools (most visibly the ESP32 Marauder firmware, popular as a Flipper Zero add-on) has done to wireless recon what the Pi dropbox did to wired implants: taken something that used to require a laptop and specialist software and put it on a $20 board the size of a stick of gum.

Why this still works in 2026

None of these tools are exploiting a vulnerability in the traditional sense. They’re exploiting three assumptions that most organizations still make by default, and that are individually reasonable and collectively a problem:

Physical access implies authorization. A person standing at a patch panel, a conference room floor box, or an unattended reception desk is assumed to belong there. Badge readers cover front doors. They rarely cover patch panels, meeting rooms with a spare Ethernet drop, or the ten minutes a visitor spends “waiting for their contact” next to a wall jack.

A network port trusts whatever it’s told. Without 802.1X or port security configured, a switch port has no concept of “the right device” versus “a device.” It hands out an IP and forwards frames to anything that asks, whether that’s the laptop that’s lived on that desk for two years or a Shark Jack that arrived thirty seconds ago. Parts 7 through 9 of this series are entirely about closing this gap.

A USB port trusts whatever identifies as a keyboard. This one is structural, not a configuration oversight: the USB HID class was designed in the 1990s with no concept of device authentication, and neither Windows, macOS, nor Linux have meaningfully changed that default in the decades since. A keyboard is a keyboard. Part 3 covers exactly how far that assumption gets an attacker.

Layer onto that the fact that these tools have gotten cheap, at least at the entry level. The wired and USB implants this series covers first run somewhere between $20 (a bare ESP32 board) and $200 (Bash Bunny, Key Croc). The wireless platforms in Part 4 stretch further, from around $100 for a WiFi Pineapple Nano up to $850 for the Enterprise tier, but even that upper end is a rounding error next to what a comparable capability would have cost a decade ago. That’s the actual shift worth paying attention to: the skill and cost barrier that used to make this class of attack rare has largely gone away.

The three families this series covers

Wired network implants (Part 2) — Shark Jack, Packet Squirrel, LAN Turtle, and their homebrew Pi equivalents. These plug into an Ethernet port or sit inline on a cable run, and they attack the network directly: reconnaissance, DHCP spoofing, man-in-the-middle capture, or a persistent covert channel out.

USB HID implants (Part 3) — Bash Bunny, Key Croc, O.MG Cable, and the original Rubber Ducky. These attack the endpoint, not the network, by exploiting the fact that a USB keyboard is implicitly trusted. This is the vector that every network-side control in this series’ back half, 802.1X included, is structurally blind to.

Wireless rogue tooling (Part 4) — WiFi Pineapple, Flipper Zero with the ESP32 Marauder add-on, and bare ESP32/ESP8266 deauther projects. These don’t need a wired connection or physical proximity to a port at all, just proximity to the air.

Part 5 builds a real homebrew Pi 4 dropbox from scratch, on hardware I actually have on hand, and Part 6 chains everything from Parts 2 through 5 into one attack narrative against a lab scenario. Parts 7 through 9 turn to defense: Layer 2 hygiene, 802.1X and NAC, and the harder-to-solve USB and wireless vectors that switch-side controls can’t touch. Part 10 closes with a vendor comparison and a practical checklist.

Verification note

The commercial Hak5 line, Flipper Zero and ESP32 Marauder, and the bare ESP32 deauther projects are documented in this series from the vendors’ own published documentation, GitHub repositories, and payload source, the same standard this site used for Sn1per Professional’s closed-source features: cited directly, not run live, since I don’t own this hardware. Specific claims worth getting wrong, pricing, spec numbers, and stock status, were checked directly against the vendors’ own live product pages while drafting, rather than recalled from memory. Part 5’s Pi 4 build is the exception to the documented-not-run rule. That one gets built and tested for real, on a spare Pi 4 I already have, with genuine captured output, matching the verification bar this site holds for everything from FRR to hashcat to Sn1per’s Community Edition.

One note before we start

Everything past this point is either how these tools work or how to stop them. None of it is a suggestion to point any of this at a network you don’t own or don’t have explicit written authorization to test. Unauthorized access to a network you don’t control is a criminal offense in most jurisdictions, full stop, regardless of how cheap or easy the hardware makes it look.

Part 2 starts with the wired implants: what a Shark Jack actually does between the moment it’s plugged in and the moment it’s pulled back out, and why a Packet Squirrel sitting inline on a cable run is a fundamentally different threat than a Shark Jack that’s already gone.