USBNinja
Introduction
The USBNinja is a highly covert USB exploit framework allowing for wireless remote triggering of custom payloads.
While dormant, the USBNinja functions as a regular USB Cable: Data Transfer, Recharging, etc. However, when triggered (via smartphone or dedicated long-range antenna) - it executes its preprogrammed payload on the host device.
Emulating keyboard and mouse actions, payloads are completely customisable, and can be highly targeted.
Undetectable by firewalls, AV software or visual inspection, the USBNinja is an ideal tool for penetration testers, police and government.
Functionality in a glance
Undetectable
Invisible to firewalls, anti-virus and visual inspection.
Highly targetable
Customise payloads to match specific environments.
Wireless triggering
Payload can be triggered wirelessly at any time.
What's Included
The USBNinja is available individually or in packs.
| Individual | Standard Kit | Complete Pack |
|
|---|---|---|---|
| Version | 1 Cable USB-C / MicroUSB / Lightning |
1 Cable USB-C / MicroUSB / Lightning |
3 Cables USB-C & MicroUSB & Lightning |
| Remote | No | Yes | Yes |
| Programming Ring | Yes | Yes | Yes |
Product Presentation: USB Ninja
Usage Instructions
The USBNinja has three distinct modes:
-
Programming
Because the device acts as a standard USB cable, it needs to be pushed into programming / DFU mode. This is done by using the "Programming Ring".
The Programming Ring must be placed on the host-side plug within three seconds of being connected to the programming / host computer.
This will place the device in programming mode, and allow for payloads to be uploaded to the device.
Programming is possible via the standard Arduino IDE.
-
Deployed
The device is 'Deployed' when it is connected to the target machine.
It will operate as a standard USB cable, allowing for data transfer and power transfer. It is able to stay in this state indefinitely until it is triggered.
-
Triggered
The device is triggered wirelessly via Bluetooth. It can be triggered by smartphone, or by dedicated remote control.
Typical smartphone trigger distance is up to 7 meters.
Typical remote control trigger distance is up to 50 meters.
Technical Specifications
-
Cable Physical Characteristics
- Length: 1 m
- Color: white
- Connector options: Micro-USB, USB Type-C, Lightning
- Voltage range: 4-25 V (supports fast charging)
- Current consumption: 10 mA (typical)
- Full-rate USB data transmission
-
Remote Control
- High-powered Bluetooth wireless (customizable name and password)
- Battery: 3.6 V, 40 mAh, rechargeable
- Standby current: 80 μA
- Transmission current: 30 mA
- Range (under ideal conditions with antenna):
- 30 m with 2 dBi, 3 cm antenna
- 50 m with 3 dBi, 11 cm antenna
- 100 m with 18 dBi directional panel antenna
-
Mobile App
- Alternative to remote control for triggering payload
- Open source and freely available
-
Programming
- Payload programmable with standard Arduino IDE (Windows/Mac/Linux/Android)
- Access bootloader with non-contact magnetic ring
- Source code provided for example payload
Technical Resources:
- Setting up your USBNinja
- Installing the USBNinja Driver
- Installing the USBNinja Programming Environment
- Using an Android Phone to Trigger a Payload
- Assembling a USBNinja Remote
- USBNinja Remote Password Updating
- USB Ninja FAQs
USB Ninja Source Code