--- title: Hacking Gadgets Every Cybersecurity Pro Should Know description: An interview with Darren Kitchen of Hak5 walks through the company's lineup of hacking gadgets used by red teamers and pentesters, grouped into three... canonical: https://daily.dev/posts/hacking-gadgets-every-cybersecurity-pro-should-know-kif9blfju twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hacking Gadgets Every Cybersecurity Pro Should Know | daily.dev og:description: An interview with Darren Kitchen of Hak5 walks through the company's lineup of hacking gadgets used by red teamers and pentesters, grouped into three... og:url: https://daily.dev/posts/hacking-gadgets-every-cybersecurity-pro-should-know-kif9blfju og:image: https://api.daily.dev/og/posts/kIF9bLFjU.png og:image:alt: Hacking Gadgets Every Cybersecurity Pro Should Know og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hacking Gadgets Every Cybersecurity Pro Should Know **[David Bombal](https://daily.dev/sources/davidbombal)** · 42 min read · 5 upvotes · 0 comments ## Summary An interview with Darren Kitchen of Hak5 walks through the company's lineup of hacking gadgets used by red teamers and pentesters, grouped into three categories: pentest implants (Packet Squirrel, Key Croc, Screen Crab, LAN Turtle), hot-plug attack tools (USB Rubber Ducky, Bash Bunny, Plunderbug, Shark Jack), and Wi-Fi tools (the Wi-Fi Pineapple line, including a new pager-shaped portable model). Darren explains how each device works, from keystroke injection and screen capture over HDMI to Wi-Fi probe-request exploitation and captive-portal social engineering, and shares backstory including FBI use of the Bash Bunny and Facebook declining to stock LAN Turtles for internal security training due to how convincing they look. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the USB Rubber Ducky and how does keystroke injection work? The USB Rubber Ducky is a device that looks like a flash drive but identifies itself to a computer as a keyboard, exploiting the fact that computers implicitly trust human input devices. It is pre-programmed with keystrokes using a scripting language called Ducky Script and can inject over 9,000 keystrokes per minute, enabling automated tasks like installing backdoors or bypassing malware detection within seconds. _daily.dev keeps pentesters current on the hardware and scripting techniques behind keystroke injection attacks._ ### What is the difference between the Bash Bunny and the USB Rubber Ducky? The Bash Bunny is a Debian Linux box with a quad-core ARM processor, storage, and RAM, giving it more capability than the USB Rubber Ducky. It can present as mass storage, a keyboard, a serial device, or a network adapter simultaneously, and it runs Ducky Script combined with bash scripts, letting operators bring additional Linux tools like Nmap into a payload. _track hardware comparisons like this on daily.dev when choosing pentest tools for a red team kit._ ### How does the Key Croc capture and act on typed passwords? The Key Croc is an inline USB keylogger built on a quad-core ARM Debian Linux box that duplicates keystrokes rather than passively sniffing them, and it can inject keystrokes back into the target later. It uses regular expressions written in Ducky Script to detect patterns like a sudo password entry, even accounting for backspaces, so the operator can capture credentials and later run commands as root. _daily.dev helps security practitioners stay on top of techniques like regex-triggered credential capture._ --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/hacking-gadgets-every-cybersecurity-pro-should-know-kif9blfju) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hacking Gadgets Every Cybersecurity Pro Should Know","url":"https://daily.dev/posts/hacking-gadgets-every-cybersecurity-pro-should-know-kif9blfju","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hacking-gadgets-every-cybersecurity-pro-should-know-kif9blfju"},"datePublished":"2026-08-23T14:23:25.874Z","dateModified":"2026-09-13T20:10:34.418Z","description":"An interview with Darren Kitchen of Hak5 walks through the company's lineup of hacking gadgets used by red teamers and pentesters, grouped into three...","image":"https://i.ytimg.com/vi/6ckvxEQEBn8/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/6ckvxEQEBn8/sddefault.jpg","isAccessibleForFree":true,"articleSection":"David Bombal","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"David Bombal","logo":"https://media.daily.dev/image/upload/s--Dz6oUxSb--/f_auto/v1710503980/logos/davidbombal","url":"https://daily.dev/sources/davidbombal"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hacking-gadgets-every-cybersecurity-pro-should-know-kif9blfju","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT42M","video":{"@type":"VideoObject","name":"Hacking Gadgets Every Cybersecurity Pro Should Know","description":"An interview with Darren Kitchen of Hak5 walks through the company's lineup of hacking gadgets used by red teamers and pentesters, grouped into three...","thumbnailUrl":"https://i.ytimg.com/vi/6ckvxEQEBn8/sddefault.jpg","uploadDate":"2026-08-23T14:23:25.874Z","duration":"PT42M","url":"https://api.daily.dev/r/kIF9bLFjU","embedUrl":"https://www.youtube.com/embed/6ckvxEQEBn8"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"David Bombal","item":"https://daily.dev/sources/davidbombal"},{"@type":"ListItem","position":3,"name":"Hacking Gadgets Every Cybersecurity Pro Should Know"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hacking-gadgets-every-cybersecurity-pro-should-know-kif9blfju#faq","mainEntity":[{"@type":"Question","name":"What is the USB Rubber Ducky and how does keystroke injection work?","acceptedAnswer":{"@type":"Answer","text":"The USB Rubber Ducky is a device that looks like a flash drive but identifies itself to a computer as a keyboard, exploiting the fact that computers implicitly trust human input devices. It is pre-programmed with keystrokes using a scripting language called Ducky Script and can inject over 9,000 keystrokes per minute, enabling automated tasks like installing backdoors or bypassing malware detection within seconds. daily.dev keeps pentesters current on the hardware and scripting techniques behind keystroke injection attacks."}},{"@type":"Question","name":"What is the difference between the Bash Bunny and the USB Rubber Ducky?","acceptedAnswer":{"@type":"Answer","text":"The Bash Bunny is a Debian Linux box with a quad-core ARM processor, storage, and RAM, giving it more capability than the USB Rubber Ducky. It can present as mass storage, a keyboard, a serial device, or a network adapter simultaneously, and it runs Ducky Script combined with bash scripts, letting operators bring additional Linux tools like Nmap into a payload. track hardware comparisons like this on daily.dev when choosing pentest tools for a red team kit."}},{"@type":"Question","name":"How does the Key Croc capture and act on typed passwords?","acceptedAnswer":{"@type":"Answer","text":"The Key Croc is an inline USB keylogger built on a quad-core ARM Debian Linux box that duplicates keystrokes rather than passively sniffing them, and it can inject keystrokes back into the target later. It uses regular expressions written in Ducky Script to detect patterns like a sudo password entry, even accounting for backspaces, so the operator can capture credentials and later run commands as root. daily.dev helps security practitioners stay on top of techniques like regex-triggered credential capture."}}]} ```