- \n
- Raspberry Pi<\/strong> [Link<\/a>]\n
- \n
- Full-featured computer with an ARM<\/strong> CPU.<\/li>\n<\/ul>\n<\/li>\n
- ZimaBoard<\/strong> [Link<\/a>]\n
- \n
- A compact x86<\/strong> board, excellent for development.<\/li>\n<\/ul>\n<\/li>\n
- VisionFive 2 by StarFive<\/strong> [Link<\/a>]\n
- \n
- An RPi-style board featuring RISC-V<\/strong> architecture.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
- Routers\n
- \n
- GL-iNet GL-AR750S-Ext<\/strong> [Link<\/a>]\n
- \n
- A capable travel router with 3 Gbps ports, independent dual-band access point, MicroSD reader, USB port, native OpenVPN support, programmable physical buttons, and more.<\/li>\n<\/ul>\n<\/li>\n
- Netgate SG-1100<\/strong> [Link<\/a>]\n
- \n
- A professional 3-port router running pfSense (Netgate are the official developers), with USB 3, USB 2, and mini PCIe.<\/li>\n<\/ul>\n<\/li>\n
- Protectli Vault<\/strong> [Link<\/a>]\n
- \n
- Fanless, x64 CPU, 2 to 6 Gbps ports. Supports hypervisors (XCP-ng, Proxmox), bare-metal OSes (Windows, Linux), and more.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
- Gadgets and Microcontrollers\n
- \n
- Raspberry Pi Pico<\/strong> [Link<\/a>]\n
- \n
- A $5 microcontroller suitable for all automation projects.<\/li>\n<\/ul>\n<\/li>\n
- Digispark ATTINY85<\/strong> [Link<\/a>]\n
- \n
- An $8 Arduino-compatible USB development board.<\/li>\n<\/ul>\n<\/li>\n
- Hak5 LAN Turtle<\/strong> [Link<\/a>]\n
- \n
- Runs OpenWRT. Can be used as a versatile toolkit (with an internal MicroSD card reader) or as a permanent physical implant for a reverse shell, Man-In-The-Middle attacks, and more.<\/li>\n<\/ul>\n<\/li>\n
- Hak5 Shark Jack<\/strong> [Link]\n
- \n
- A portable network attack and automation tool that runs OpenWRT.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
\nLAN Turtle<\/strong><\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-14-20-22-13.png\")
<\/p>\n- \n
- IP from the USB side: 172.16.84.1<\/strong>\/16<\/li>\n
- Default credentials: root<\/strong>:sh3llz<\/strong>\n
- \n
- \n
ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa root@172.16.84.1<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n
- To open the configuration menu, type: turtle<\/strong>\n
- \n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-14-20-10-30.png\")
<\/li>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-14-20-10-48.png\")
<\/li>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-14-20-24-40.png\")
<\/li>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-14-20-25-04.png\")
<\/li>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-14-20-25-08.png\")
<\/li>\n<\/ul>\n<\/li>\n- Installed modules live at
\/etc\/turtle\/<\/code>\n- \n
- Example script for the
httppost<\/code> module:\n- \n
- \n
echo \"Turtle is Online!\"\r\necho \"\"\r\n# Wait for IP assigned to eth1\r\nwhile ! ip a show dev eth1 | grep \"global\"; do sleep 1; done > \/dev\/null\r\necho \"Internal IPs\"\r\nip a | grep global | sort\r\necho \"\"\r\necho \"Gateways\"\r\nGWAY=$(route | grep default | awk {'print $2'})\r\necho \"$GWAY\"\r\necho \"\"\r\necho \"Public IP\"\r\nPUB=$(wget -q -O- http:\/\/ipinfo.io\/ip)\r\necho \"$PUB\"<\/pre>\n<\/li>\n - Use a pub-sub service such as ntfy<\/strong> [Link<\/a>] to receive a push notification on your phone.<\/li>\n<\/ul>\n<\/li>\n
- Example packet sniffer for common unencrypted traffic, saved to the SD card:\n
- \n
- \n
( tcpdump -U -C 100 -W 10 -i eth0 port '(21 or 23 or 25 or 53 or 80 or 110 or 143 or 161 or 389)' -w \/sd\/unencrypted.pcap &>\/dev\/null ) &<\/pre>\n<\/li>\n
- \n
killall tcpdump<\/pre>\n<\/li>\n
- Writes without buffering and splits output into 100 MB chunks, up to 10 files. The second command stops the capture gracefully.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n
- Speed Test\n
- \n
- File transfer over SSH: 16.3 Mbps<\/strong><\/li>\n
- Speed test with OpenVPN (top) and without (bottom):\n
- \n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot_2021-03-13_20_28_11.png\")
<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
\nShark Jack<\/strong><\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-13-21-59-19.png\")
<\/p>\n- \n
- IP from the USB side: 172.16.24.1<\/strong>\/16<\/li>\n
- Default credentials: root<\/strong>:hak5shark<\/strong>\n
- \n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot-From-2025-04-13-21-44-32.png\")
<\/li>\n<\/ul>\n<\/li>\n- Switch positions:\n
- \n
- OFF\/Charging – Does not boot.<\/li>\n
- Arming Mode – Boots but does not trigger the payload; used for configuration only.<\/li>\n
- Attack Mode – Boots and immediately runs the payload.<\/li>\n<\/ul>\n<\/li>\n
- Main directories:\n
- \n
- \/root\/loot\/ (payload output)<\/li>\n
- \/root\/payload\/ (payloads auto-execute from here)<\/li>\n
- \/tmp\/ (volatile)<\/li>\n<\/ul>\n<\/li>\n
- LED status:\n
- \n
- Green blinking – booting up<\/li>\n
- Blue blinking – charging<\/li>\n
- Blue solid – fully charged<\/li>\n
- Yellow blinking – arming mode<\/li>\n
- Red blinking – error or no payload found<\/li>\n<\/ul>\n<\/li>\n
- Payload repository [Link<\/a>]<\/li>\n
- The RJ-45 connector acts as a light guide and houses an RGB LED for status signaling.<\/li>\n<\/ul>\n
Since it runs OpenWrt<\/strong> 18, packages can be installed with opkg<\/strong>:<\/p>\n
opkg update\r\nopkg list\r\nopkg install nano\r\nopkg install arp-scan\r\nopkg install tcpdump\r\nopkg install nping<\/pre>\n
\nBONUS<\/strong><\/p>\n
PCAPdroid<\/strong> is a Wireshark equivalent for Android. It captures and exports PCAP files, and can also track, analyze, and block connections made by other apps on the device [Link<\/a>]. It works by posing as a VPN to intercept traffic.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/03\/Screenshot_20260420-144017-929x1024.png\")
<\/p>\n
\nBONUS<\/strong><\/p>\n
Learn how to turn your Shark Jack into a semi-permanent network implant: Hacking the Hak5 Shark Jack<\/strong> [Link<\/a>].<\/p>\n
- The RJ-45 connector acts as a light guide and houses an RGB LED for status signaling.<\/li>\n<\/ul>\n
- Default credentials: root<\/strong>:hak5shark<\/strong>\n
- IP from the USB side: 172.16.24.1<\/strong>\/16<\/li>\n
- Speed test with OpenVPN (top) and without (bottom):\n
- File transfer over SSH: 16.3 Mbps<\/strong><\/li>\n
- Example packet sniffer for common unencrypted traffic, saved to the SD card:\n
- \n
- Example script for the
- Default credentials: root<\/strong>:sh3llz<\/strong>\n
- IP from the USB side: 172.16.84.1<\/strong>\/16<\/li>\n
- A portable network attack and automation tool that runs OpenWRT.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
- Raspberry Pi Pico<\/strong> [Link<\/a>]\n
- Routers\n
- VisionFive 2 by StarFive<\/strong> [Link<\/a>]\n
- ZimaBoard<\/strong> [Link<\/a>]\n
- Full-featured computer with an ARM<\/strong> CPU.<\/li>\n<\/ul>\n<\/li>\n