I’m pleased to introduce our latest addition to the MiniPwner family: the Black Edition. The Black is based off the TP-Link 3040, however it has a few hardware modifications.
First, to allow for more flexibility during a penetration test, the internal antenna has been disconnected, and a RP-SMA connector has been added. This allows you to connect different types of antennas to the Black. Since the stock antenna no longer functions, the Black comes with a 3 dBi antenna.
Second, we've exposed the serial port. The goal here is to have direct hardware access to the system if required. One major advantage is you will have the ability to recover the system through the serial port if you “brick” the device. (We are also working on a few other ideas for the serial port too, so stay tuned.)
Third, the power LED has been removed. This might sound like a bad idea at first; however, you are not able to control the power LED via software, so therefore the only way to have it not be on during operation was to remove it.
Last but not least, you will notice it has been wrapped in a matte black vinyl. This is to help give you an edge in hiding it in plain sight.
Making the Black is quite time consuming, so there will be a limited number produced. Please tweet us at @minipwner and let us know the interest level.
The MiniPwner is a penetration testing "drop box".
It is designed as a small, simple but powerful device that can be inconspicuously plugged into a network and provide the penetration tester remote access to that network.
It's made up of a portable TP-Link MR3040 running OpenWrt.
The MiniPwner's key features include:
Integrated Wired and Wireless connections
Once plugged into a target network, the Mini-Pwner can establish an SSH tunnel through the target network, or can be accessed by wifi. In addition, the MiniPwner can be configured as a wifi sniffer and logger - war walking in your pocket.
Low power consumption, can be run off battery.
With a 2000 mAh built-in battery, the Mini-Pwner will run for over five hours of active wired and wireless activity. No need to find a power outlet during the pen test.
Multiple Pen Testing Tools included
aircrack-ng, elinks, ettercap-ng, karma, kismet, nbtscan, netcat, nmap, openvpn, perl 5, samba client, snort, tar, tcpdump, tmux, yafc, and wget all come pre-installed.
Flexible and Expandable
The MiniPwner runs on the open source OpenWrt operating system. You can easily add or change the installed packages.
The MiniPwner can be easily carried in a pocket, hidden behind a telephone, or hang from a jack by a short ethernet cable (included).
The MiniPwner is a TP-Link MR3040 router with a 16GB flash drive to expand its storage capability. Includes 802.11n Wireless N and an Ethernet port. Operating System is OpenWrt.
What can you do with it?
Pen Testing Drop Box
In this mode, the MiniPwner used to establish rogue access to a target network during a penetration test. The penetration tester uses stealth or social engineering techniques to plug the MiniPwner into an available network port. (common locations include conference rooms, unoccupied workstations, the back of IP Telephones, etc.)
Once it is plugged in, the penetration tester can log into the MiniPwner and begin scanning and attacking the network. The MiniPwner can simultaneously establish SSH tunnels through the target network, and also allow the penetration tester to connect to the MiniPwner via Wifi.
The MiniPwner can run some software directly from the box, such as nmap to map the target network or the samba client to connect to windows shares. Other tools, such as Metasploit or Nessus can be run through the box using a VPN tunnel.
The battery-powered MiniPwner is small enough to fit in your jeans pocket and can run for hours. In wireless war-walking mode you start kismet or aircrack-ng on the MiniPwner and record details about all of the wireless networks detected by the device.
Captive Wifi Portal or Rogue Access Point
Use the Karma application to discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targetted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to probes and association requests for any SSID. Higher-level fake services can then capture credentials or exploit client-side vulnerabilities on the host.
There are many other creative ways to use the MiniPwner. Here is a list of some of the software that comes installed:
- Aircrack Wireless network analysis
- elinks Text Based Web Browser
- ettercap-ng Man-in-the-middle attack tool
- ***karma*** Wireless Sniffing Tool - not working yet....
- kismet Wireless network analysis
- nbtscan NetBIOS Network Scanner
- Netcat Hacker’s swiss army knife
- Nmap network scanner
- openssh-sftp-client Secure File Transfer Client
- openvpn VPN Client and Server
- perl 5 Perl Scripting Language
- samba2-client Windows File Sharing Client
- snort Sniffer, Packet Logger, Intrusion Detection System
- tarFile archiving
- Tcpdump sniffer
- yafc FTP Client