samyk/poisontap

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

6475 stars · 978 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

PoisonTap is a USB-based attack tool built on a Raspberry Pi Zero and Node.js that exploits locked, password-protected computers by emulating an Ethernet device. It siphons HTTP cookies, exposes the internal router remotely via WebSocket and DNS rebinding, and installs a persistent cache-poisoned web backdoor that survives after the device is removed.

Use cases

• demonstrate USB physical attack risks on locked computers
• siphon browser cookies and sessions from a locked machine
• gain remote access to an internal router via DNS rebinding
• install a persistent browser backdoor via cache poisoning
• physical penetration testing of endpoint security
• security awareness training on lock screen and network trust weaknesses

When to choose

• you need to demonstrate physical USB attack vectors in a security assessment or talk
• you want to test how lock screens, routing priority, and cookie protections hold up against a rogue network device
• you have a Raspberry Pi Zero or compatible USB gadget device for hardware-based pentesting

When to avoid

• you need a maintained or supported tool - it has no license and hasn't been updated since 2018
• you want a general-purpose network scanner or remote-access framework rather than a specific USB exploit demo
• unauthorized use - deploying this against machines you don't own is illegal

Facets

application · maturity maintenance

security networking websocket http-server proxy security penetration-testing hardware networking iot cross-platform usb-attack raspberry-pi-zero cookie-siphoning dns-rebinding backdoor physical-pentest hak5 usb-gadget linux nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="samyk/poisontap")