Introduction
The USBNinja is a highly covert USB exploit framework allowing for wireless remote triggering of custom payloads.
While dormant, the USBNinja functions as a regular USB Cable: Data Transfer, Recharging, etc. However, when triggered (via smartphone or dedicated long-range antenna) - it executes its preprogrammed payload on the host device.
Emulating keyboard and mouse actions, payloads are completely customisable, and can be highly targeted.
Undetectable by firewalls, AV software or visual inspection, the USBNinja is an ideal tool for penetration testers, police and government.
Functionality in a glance
Undetectable
Invisible to firewalls, anti-virus and visual inspection.
Highly targetable
Customise payloads to match specific environments.
Wireless triggering
Payload can be triggered wirelessly at any time.
What's Included
The USBNinja is available individually or in packs.
Individual | Standard Kit | Pro Kit | |
---|---|---|---|
Version | 1 Cable USB-C / MicroUSB / Lightning |
1 Cable USB-C / MicroUSB / Lightning |
3 Cables USB-C & MicroUSB & Lightning |
Remote | No | Yes | Yes |
Programming Ring | Yes | Yes | Yes |
Product Presentation: USB Ninja
Usage Instructions
The USBNinja has three distinct modes:
-
Programming
Because the device acts as a standard USB cable, it needs to be pushed into programming / DFU mode. This is done by using the "Programming Ring".
The Programming Ring must be placed on the host-side plug within three seconds of being connected to the programming / host computer.
This will place the device in programming mode, and allow for payloads to be uploaded to the device.
Programming is possible via the standard Arduino IDE.
-
Deployed
The device is 'Deployed' when it is connected to the target machine.
It will operate as a standard USB cable, allowing for data transfer and power transfer. It is able to stay in this state indefinitely until it is triggered.
-
Triggered
The device is triggered wirelessly via Bluetooth. It can be triggered by smartphone, or by dedicated remote control.
Typical smartphone trigger distance is up to 7 meters.
Typical remote control trigger distance is up to 50 meters.
Technical Specifications
-
Cable Physical Characteristics
- Length: 1 m
- Color: white
- Connector options: Micro-USB, USB Type-C, Lightning
- Voltage range: 4-25 V (supports fast charging)
- Current consumption: 10 mA (typical)
- Full-rate USB data transmission
-
Remote Control
- High-powered Bluetooth wireless (customizable name and password)
- Battery: 3.6 V, 40 mAh, rechargeable
- Standby current: 80 μA
- Transmission current: 30 mA
- Range (under ideal conditions with antenna):
- 30 m with 2 dBi, 3 cm antenna
- 50 m with 3 dBi, 11 cm antenna
- 100 m with 18 dBi directional panel antenna
-
Mobile App
- Alternative to remote control for triggering payload
- Open source and freely available
-
Programming
- Payload programmable with standard Arduino IDE (Windows/Mac/Linux/Android)
- Access bootloader with non-contact magnetic ring
- Source code provided for example payload
Technical Resources:
- Setting up your USBNinja
- Installing the USBNinja Driver
- Installing the USBNinja Programming Environment
- Using an Android Phone to Trigger a Payload
- Assembling a USBNinja Remote
- USBNinja Remote Password Updating
- USB Ninja FAQs
USB Ninja Source Code
USBNinja - Unboxing
Hands On - USB Ninja
USBNinja Remote Control Assembly
SHIPPING & PACKAGING
Do you provide free shipping?
Yes:
For European Customers, orders over 100€ have free shipping.
For International Customers, orders over 250€ have free shipping.
Customers that qualify for free shipping can still select rapid shipping options.
When will I receive my order?
Average order times can be estimated below.
Average shipping estimates can be seen by selecting the destination country / region below.
While actual shipping times may vary - these estimations are built off our real delivery statistics. To receive an order as quickly as possible, we recommend:
- Use the express delivery shipping method
- Use same day shipment by placing the order before 12PM GMT+1
Do you ship internationally?
We ship world-wide, but due to logistical or legal restrictions, we are unable to ship to the following countries: Argentina, Brazil, Bolivia, Cambodia, Chile, Ecuador, Iraq, India, Kuwait, Liberia, Libya, Nepal, Oman, Panama, Peru, Russia, South Africa, Turkey.
Due to the current situation, shipping to the Ukraine is currently not possible.
Where do you ship from?
All items are dispatched from France. You will receive a tracking number upon item dispatch. The address used on your purchase is printed as a label - please double check your address to avoid mistakes.
When will my order be dispatched?
Lab401 dispatches orders Monday - Friday.
All orders placed before 12PM GMT+1 will be dispatched the same day. All orders placed after this cutoff time will be dispatched the next business day.
For example:
- An order placed Friday, 9AM GMT+1 will be dispatched the same day.
- An order placed on Friday, 6PM GMT+1 will be dispatched Monday.
- An order placed on Saturday will be dispatched Monday
For any questions, please contact customer support.
What shipping options are available?
We provide four types of shipping:
- EU Standard Post
- EU Express Post
- International Standard Post
- International Express Post
How are import duties / customs handled?
For all European Union destinations, all shipments are DDP - Delivered Duty Paid. This means all applicable VAT/TVA, shipping costs and customs fees are pre-paid.
You will not be charged by the courier service / post office or customs.
For all destinations outside European Union, all shipments are DDU - Delivered Duty Unpaid. This means that your country's custom service impose a VAT/TVA/Import Duty on your shipment.
I am charged VAT ?
Lab401 (ETOILE 401 SAS) is an EU-Registered entity. VAT is applicable to purchases delivered within the EU, with exceptions for VAT Registered entities. VAT is calculated at checkout. For your convenience, you can browse Lab401 with prices Including VAT and Excluding VAT.
Sales are contractual
Please note - a purchase is an explicit agreement of our terms and conditions. Any products refused by clients will not be refunded.
Purchase Security Validation may be applied
To protect against credit card fraud, orders may be flagged for Purchase Security Validation. In this instance, we will reach out to the customer to perform a manual verification process.
Orders that are flagged for Purchase Security Validation are considered to be incomplete until validated. Our delivery deadline obligations begin only when an order is validated.
Delivery Protection
Is my delivery protected?
All Lab401 shipments are insured with the carrier.We also provide an advanced insurance, Lab401 Delivery Protection.
Lab401 Delivery Protection means we remain fully responsible for the package right up to delivery. If the package is lost or damaged, the package can be resent immediately (48 business hours) upon receipt of proof.
For orders without Delivery Protection, lost or damaged packages will pass through the carrier's protocols, which can take up to 30 days.
For orders that are time-sensitive, we recommend Lab401 Delivery Protection.
Delivery Protection can be purchased at checkout easily and cheaply.