Option to later add modules for wireless connection and attacks or even a cellular interface for connecting to it via a backchannel.Cost cheap enough where if it got destroyed or taken by someone, it wouldn’t kill my budget.Fast enough hardware where I could use pentesting tools and not have horrible lag/sluggishness.Decent storage space (32GB-64GB or more).Have the capability to use a persistent reverse SSH tunnel and/or OpenVPN for command and control.Device had to be relatively small in size where I could hide it behind a computer/under a desk, or by a network switch without being noticed.My desired requirements were the following: Looking at various options for devices that could be used as dropboxes, I wanted something that was dependable, light, small, fast, and cheap. Lastly, I wanted another attack method against employees who used vulnerable wireless mice and keyboards. I also wanted a backup method incase their egress firewall blocked my outbound traffic so I opted to include a wireless setup for the device. With this type of dropbox, I could walk into a facility in disguise, place the dropbox on their network (preferably on a network switch), then leave the area and have access to their network through an OpenVPN connection and reverse SSH tunnel.

Since Raspberry Pi recently came out with their Raspberry Pi 4, I decided to give it a try. I also wanted a device that would connect back to me using multiple methods in case the client’s firewall blocked certain ports outbound. Normally, I would use tools such as a LAN Turtle, which is great, but I wanted something that had a full Kali Linux toolset already on it where I could remote in without having to forward traffic through it.

Aside from my usual tools like shims, lockpicks, and networking gear, I wanted to create a dropbox that I could place on the client’s network that would “phone home” to my attack server, then use tools directly from the dropbox on their network. Not long ago, I was scheduled for an upcoming Red Team simulation for an energy company and I started going through all of my gear that I usually bring for the engagement. Attack your client’s network, wireless APs, and peripherals using a full Kali instance with wireless attacks, mousejacking attacks, and more. Learn how to setup and connect to your Penetration Testing Dropbox Raspberry Pi 4 using reverse ssh tunnels, OpenVPN, and hostapd.

Wireshark alternative for raspberry pi