The groundbreaking payload platform that introduced multi-vector USB attacks has evolved.
Pull off covert attacks or IT automation tasks faster than ever with just the flick of a switch. The NEW Bash Bunny Mark II goes from plug to pwn in 7 seconds — so when the light turns green it's a hacked machine.
Now with faster performance, wireless geofencing, remote triggers and MicroSD support, the Bash Bunny is an even more impressive tool for your Red Team arsenal.
Simultaneously mimic multiple trusted devices to trick targets into divulging sensitive information without triggering defenses. The Bash Bunny is truly the world's most advanced USB attack platform.
Orders are fulfilled from our California warehouse in 1-3 days. Typical shipping times:
Orders under $2500 are automatically protected against loss & damage via MonkProtect™ shipping insurance with a fast and easy resolution center.
Manufacturer: Hak5 LLC. 5473 Blair Rd, Ste 100 PMB 39371, Dallas, TX 75231. Shop@Hak5.org. https://shop.hak5.org
Responsible Person: Easy Access System Europe - Mustamäe tee 50, 10621 Tallinn, Estonia, gpsr.requests@easproject.com
Safety Information: Warning: Not suitable for children under 14 years. This is not a toy. Contains small parts that may present a choking hazard. Keep out of reach of children. Do not expose the device to water, excessive moisture, direct sunlight or extreme conditions (moisture, heat, cold, dust), as the device may malfunction or cease to work when exposed to such elements. Do not attempt to disassemble or repair the device yourself. Doing so voids the limited warranty and could harm you or the device. This device is not designed, manufactured or intended for use in hazardous environments requiring fail-safe performance in which the failure of the device could lead directly to death, personal injury, or severe physical or environmental damage. Wireless equipped devices are restricted to indoor use only when operating in the 2400 MHz – 2483.5 MHz frequency range within the EU and EFTA countries, as required by Article 10(10) of Directive 2014/53/EU. Battery equipped devices: do not dispose of batteries in household waste. Battery replacement must be carried out by a qualified technician. This USB-powered device complies with the EMC Directive (2014/30/EU) and meets the requirements of EN 55032 and EN 55035 for electromagnetic compatibility. This device is designed in accordance with USB-IF specifications for voltage limits, data integrity, and power safety to ensure reliable and compliant operation. This product has been designed and manufactured in accordance with the RoHS requirements and complies with the European Union’s Restriction of Hazardous Substances (RoHS) Directive 2011/65/EU and Directive (EU) 2015/863. This device is designed to operate reliably within an operating temperature range of 35ºC to 45ºC and a storage temperature range of -20ºC to 50ºC. It is rated for use in environments with 0% to 90% relative humidity (non-condensing). Proper environmental conditions must be maintained to ensure optimal performance and longevity. Made in China. This device is for authorized auditing and security analysis purposes only where permitted subject to local and international laws where applicable. Users are solely responsible for compliance with all laws of their locality. Hak5 LLC and affiliates claim no responsibility for unauthorized or unlawful use. This device is packaged with a limited warranty, the acceptance of which is a condition of sale. See Hak5.org for additional warranty details and limitations. Availability and performance of certain features, services and applications are device and network dependent and may not be available in all areas; additional terms, conditions and/or charges may apply. All features, functionality and other product specifications are subject to change without notice or obligation. Hak5 LLC reserves the right to make changes to the products description without notice. Hak5 LLC does not assume any liability that may occur due to the use or application of the product(s) described herein.
The best red teams know that with the right tools and a few seconds of physical access, all bets are off...
Compromise a locked machine, capture credentials, exfiltrate loot, plant backdoors...
Or perform vulnerability scans, offline patching — even fix printers... All with simple text-file payloads.
Combined with your favorite Linux pentest tools like nmap, metasploit, responder, impacket on this fast Debian box.
Exfiltrate en masse with new out-of-band techniques and ultra-high-capacity MicroSD cards.
Get gigs of loot (or the entire disk) to make a bold impression on the next engagement.
No traversing the firewall or triggering detection systems.
Limit the scope of engagement by preventing payloads from executing off-site.
Immobilize payloads until it enters the premises.
Even destroy loot based on the wireless environment.
Take social engineering to the next level and trigger multiple payload stages when the target's back is turned.
Trigger from a phone app or any discreet bluetooth device.
Even automate tasks when a device is in proximity.
7 second boot with an 8 GB desktop-class SSD.
MicroSD XC for ultra-high-capacity exfiltration.
Bluetooth LE for remote triggers and geofencing.
Easy 3-way payload switch and RGB LED indicator.
Dedicated Serial interface to an unlocked root shell.
DuckyScript™ makes payloads quick, easy and fun. Toss in the power of bash with familiar Linux tools and it's game on!
Mimic a HID keyboard and USB Ethernet adapter simultaneously? ATTACKMODE HID AUTO_ETHERNET
Need the target computer's hostname?
GET TARGET_HOSTNAME
Pause the payload until your phone's bluetooth is on?
WAIT_FOR_PRESENT my-device-name
How about injecting keystrokes into the run dialog?
RUN WIN cmd /K color a \& tree c:\\
Fancy a red light? LED R. Blue? LED B.
Seriously, that simple.
Looking for inspiration? Check out the growing library of community developed payloads from our repo!
Diverse targets? Carry multiple payloads and pick the perfect attack with the flick of a switch.
Keep this must-have tool at the ready for opportunistic loot grabbing on your next physical engagement or social engineering exercise.
For the sake of convenience, computers trust a number of devices. Flash drives, Ethernet adapters, serial devices and keyboards to name a few. These have become mainstays of modern computing. Each has their own unique attack vectors. When combined? The possibilities are limitless. The Bash Bunny is all of these things, alone – or in combination – and more!
Each attack, or payload, is written in a simple Ducky Script™ language consisting of text files. A central repository is home to a growing library of community developed payloads. Staying up to date with all of the latest attacks is just a matter of downloading files from git. Then loads ’em onto the Bash Bunny just as you would any ordinary flash drive.
It's a full featured Linux box that'll run your favorite tools even faster now thanks to the optimized quad-core CPU, desktop-class SSD and doubled RAM. Choose and monitor payloads with the selection switch and RGB LED. Access an unlocked root terminal via dedicated Serial console. Exfiltrate gigs of loot via MicroSD. Even remotely trigger or geofence payloads via Bluetooth.
Flick the switch to your payload of choice, plug in the Bash Bunny and get instant feedback from the multi-color LED. From plug to pwn in 7 seconds with its quad-core CPU and desktop-class SSD.
Mimic trusted devices like keyboards, serial, storage, and Ethernet for multi-vector attacks. From keystroke injection to network hijacking – trick computers into divulging data, exfiltrating files and installing backdoors.
It's simple. Flick the switch and it turns into a flash drive, where changing settings is just editing a text file. And with a root shell your favorite pentest tools like nmap, responder, impacket and metasploit are at the ready.
From plug to pwn in seconds!
The HotPlug Attack Combo Kit includes the infamous USB Rubber Ducky, Bash Bunny and Shark Jack in our signature Hak5 essential gear wrap.
Everything you need to execute payloads in seconds against devices and networks.