samyk/poisontap
Poisontap
PoisonTap is a hardware attack tool designed for the Raspberry Pi Zero that exploits a USB connection to a locked or password-protected computer, extracting browser cookies and session data from the top million websites without requiring the device to be unlocked. It operates by bypassing the lock screen through USB and network stack exploitation, then siphoning HTTP cookies and intercepting all outbound Internet traffic by overriding network routing through a local device.
The tool distinguishes itself through multiple persistence and recovery mechanisms that maintain access even after cookies are cleared. It stores session data across browser history, cached PNG images, and HSTS pins, and can detect when stored cookie data has been removed and recreate it from remaining storage. PoisonTap also deploys a persistent web cache backdoor by injecting malicious JavaScript into cached CDN files for thousands of domains, enabling ongoing remote control and same-origin proxy execution that forces the victim's browser to make authenticated requests on backdoored domains.
Additional capabilities include DNS rebinding to expose internal routers for remote exploitation, reading the target's ARP cache to reveal internal network routes, and deploying a WebSocket-based backdoor through injected CDN resources. The tool is implemented in JavaScript and is designed to run on a Raspberry Pi Zero as a dedicated attack platform.
Features
- Attack Platforms - The entire tool is designed as a Raspberry Pi Zero attack platform for compromising locked computers.
- Locked-Device Exploitations - Exploits USB connections to bypass lock screens and extract browser data from password-protected computers.
- Cookie Siphoning Tools - Captures HTTP cookies and session data from browsers by intercepting all Internet traffic through a rogue device.
- Rogue Device Interceptions - Redirects all outbound Internet traffic through a local device by exploiting LAN subnet route priority.
- USB Network Hijackers - Redirects all outbound Internet traffic through a local device by exploiting USB network routing.
- Locked-Computer Exploitations - Exploits locked computers over USB to extract browser cookies and gain remote access without unlocking.
- Network Hijacking Exploitations - Exploits USB connections to override network routing and redirect all traffic through a local device.
- CDN Backdoor Injections - Replaces CDN-hosted JavaScript files with backdoored versions to grant same-origin access to any site loading them.
- Exfiltration Persistences - Siphons HTTP cookies from locked computers and persists them across multiple browser storage mechanisms.
- USB Cookie Extraction Backdoors - Connects to locked computers via USB and extracts browser cookies, exposing saved web sessions.
- Web Cache Backdoors - Installs hidden web server and cached JavaScript backdoor on compromised machines for persistent remote control.
- USB Lock Screen Bypasses - Bypasses lock screens on password-protected computers by exploiting USB and network stack behavior.
- Browser Cookie Exfiltrators - Extracts browser cookies and session data from locked computers via USB connection.
- Stolen Cookie Proxies - Forces victim browsers to make authenticated requests on backdoored domains using stolen cookies and returns responses.
- Cache Backdoor Injections - Injects malicious JavaScript into browser cache for thousands of domains to maintain remote control.
- Cookie Encoding Stores - Encodes cookie data into visited URLs and recovers it via the browser history API for persistence.
- Multi-Store Persistences - Persists session data across multiple browser storage mechanisms to survive cookie deletion.
- Persistence Hijackers - Stores identifying data across multiple browser storage mechanisms to maintain client identity after cookie clearing.
- Same-Origin Proxy Executions - Forces victim browsers to make authenticated requests on backdoored domains and proxies responses to attacker.
- Router Hijacking Exploits - Uses DNS rebinding to expose internal routers for remote exploitation via HTTP requests.
- ARP Cache Exposures - Reads target's ARP cache from locked machines to reveal internal network routes and router details.
- Web Cache Backdoors - Injects a cached HTML/JavaScript backdoor into thousands of domains and CDN URLs for persistent remote control.
- Persistence Identifiers - Uses HSTS pinning to persist unique identifiers across browser sessions for client tracking.
- Multi-Mechanism Persistences - Stores identifying data across multiple browser storage mechanisms to maintain client recognition after cookie clearing.
- Router Exposures - Uses DNS rebinding to expose internal routers for remote exploitation from a locked machine.
- Cookie Recovery Mechanisms - Detects removed cookie data and recreates it from remaining browser storage mechanisms.
- Image-Encoded Cookie Stores - Encodes cookie data into PNG image RGB values and reads it back via HTML5 Canvas for persistence.
- AI and Automation - Exploits locked computers via USB to siphon data and backdoors.
- Physical Security - USB-based network access and credential theft.
