Your governance framework, meet reality.
Total image size
USB stick cost
Boot to attack
A bootable USB toolkit demonstrating that policy documents are not security. Everything on this stick is freely available. We just packaged it.
Everything fits on a 4GB USB stick. Your compliance audit cost more.
Automated network reconnaissance. Auto-detects network, scans hosts, enumerates services.
WPA/WPA2 cracking, deauth attacks, evil twin, WPS exploitation, probe capture.
BLE scanning, service enumeration, DoS attacks, MAC spoofing.
ARP spoofing, DNS poisoning, SSL stripping, traffic interception.
Sniff traffic, extract browser passwords, harvest WiFi keys, find SSH keys.
SearchSploit integration, CVE lookup, EternalBlue, Shellshock, Log4j checks.
Reverse shells in every language. Bash, Python, Perl, PHP, PowerShell, Java, Node.
LinPEAS integration, privilege escalation, persistence mechanisms, lateral movement.
Phishing pages, QR code attacks, OSINT, USB payload generation.
+ nmap, metasploit, aircrack-ng, hydra, john, hashcat, sqlmap, bettercap, wireshark...
+ Claude Code for AI-assisted penetration testing
Right-click menu. Point and shoot.
What happens when I plug this into an unlocked machine in your office.
If someone with actual malicious intent had this stick.
Map the network, find file servers, deploy ransomware across all accessible shares. Encrypt backups first.
Find sensitive data, compress it, tunnel it out over HTTPS (looks like normal traffic). Customer data, financials, IP.
Plant backdoors, add SSH keys, create service accounts. Come back anytime. Sell access to others.
Compromise your build systems, inject malicious code into your products. Infect your customers.
Capture credentials via MITM, responder, phishing. Use them for identity theft, account takeover, further attacks.
Steal trade secrets, customer lists, pricing strategies, product roadmaps. Hand them to your competitor.
Five things that might actually stop this.
BitLocker/FileVault with pre-boot PIN. Not just TPM. Attacker boots, sees encrypted garbage.
Password protect BIOS. Disable USB boot. Enable Secure Boot. Lock boot order.
Zero trust. VLANs. Micro-segmentation. Unknown device? Quarantine network.
Detect scanning, ARP anomalies, new MACs, lateral movement. Alert and respond.
Screen locks. Cable locks. USB port blockers. Challenge strangers. Clean desk policy.
"Employees shall not plug in unauthorized USB devices" - written once, ignored forever.
If a USB stick this small can do this much, what does your security policy actually protect?
How many of your employees could build this in an afternoon with AI assistance?
What happens when this capability is assumed, not exceptional?
Is your security model based on capability restriction or threat assumption?
When's your next governance committee meeting?
This project doesn't create new capabilities. It packages existing ones in a way that makes the implications impossible to ignore.
Every tool here is freely available.
Every technique is documented. Every attack has been done before.
The only thing new is putting it on a stick small enough to fit on a keychain.
Total toolkit size
Lines of attack scripts
Governance documents rendered irrelevant
Your compliance audit cost more than this USB stick.
Sleep tight.
Your governance framework, meet reality.