The MiniPwner is a penetration testing "drop box".
It is designed as a small, simple but powerful device that can be inconspicuously plugged into a network and provide the penetration tester remote access to that network.
Its made up of a portable router running OpenWrt piggy-backed onto a battery pack. Here it is shown next to an iPhone:
The MiniPwner's key features include:
Integrated Wired and Wireless connections
Once plugged into a target network, the Mini-Pwner can establish an SSH tunnel through the target network, or can be accessed by wifi. In addition, the MiniPwner can be configured as a wifi sniffer and logger - wardriving in your pocket.
Low power consumption, can be run off battery.
With the 1700 mAh battery included in the kit, the Mini-Pwner will run for over five hours of active wired and wireless activity. No need to find a power outlet during the pen test.
Multiple Pen Testing Tools included
tcpdump, nmap, kismet, all come pre-installed
Flexible and Expandable
The MiniPwner runs on the open source OpenWrt operating system. You can easily add or change the installed packages.
The MiniPwner can be easily carried in a pocket, hidden behind a telephone, or hang from a jack by a short ethernet cable.
The MiniPwner is a TP-Link TL-WR703N router with a 4GB flash drive to expand its storage capability. Includes 802.11n Wireless N and a Gig Ethernet port. Operating System is OpenWrt.
What can you do with it?
Pen Testing Drop Box
In this mode, the MiniPwner used to establish rogue access to a target network during a penetration test. The penetration tester uses stealth or social engineering techniques to plug the MiniPwner into an available network port. (common locations include conference rooms, unoccupied workstations, the back of IP Telephones, etc.)
Once it is plugged in, the penetration tester can log into the MiniPwner and begin scanning and attacking the network. The MiniPwner can simultaneously establish SSH tunnels through the target network, and also allow the penetration tester to connect to the MiniPwner via Wifi.
The MiniPwner can run some software directly from the box, such as nmap to map the target network or the samba client to connect to windows shares. Other tools, such as Metasploit or Nessus can be run through the box using a VPN tunnel.
The battery-powered MiniPwner is small enough to fit in your jeans pocket and can run for hours. In wireless war-walking mode you start kismet or aircrack-ng on the MiniPwner and record details about all of the wireless networks detected by the device.
Captive Wifi Portal or Rogue Access Point
Use the Karma application to discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targetted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to probes and association requests for any SSID. Higher-level fake services can then capture credentials or exploit client-side vulnerabilities on the host.
There are many other creative ways to use the MiniPwner. Here is a list of some of the software that comes installed:
- Nmap network scanner
- Tcpdump sniffer
- Netcat Hacker’s swiss army knife
- aircrack Wireless network analysis
- kismet Wireless network analysis
- perl Perl Scripting Language
- openvpn VPN Client and Server
- dsniff suite of sniffing and spoofing tools, including arpspoof
- nbtscan NetBIOS Network Scanner
- snort Sniffer, Packet Logger, Intrusion Detection System
- ***karma*** Wireless Sniffing Tool - not working yet....
- samba2-client Windows File Sharing Client
- elinks Text Based Web Browser
- yafc FTP Client
- openssh-sftp-client Secure File Transfer Client