Hardware hacking gadgets: Pwnagotchi, Bjorn, Marauder and more

An overview of the best-known "portable" offensive-security gadgets: small devices (often Raspberry Pi or ESP32-based) for practising WiFi, Bluetooth, RFID and USB attacks. Per tool: what it is, how it works, what you can do with it, and whether to buy or build it. For software tools like Nmap and Burp Suite, see the tool overview cheatsheet.

🐣 Pwnagotchi — AI-driven WiFi handshake collector

• What: open-source "digital pet" on a Raspberry Pi Zero with a tiny e-ink screen that learns from your WiFi environment to collect WPA key material.
• How it works: builds on bettercap (injection/sniffing) and drives it with a reinforcement-learning model (A2C). Runs PMKID attacks and deauth to trigger WPA handshakes, and stores everything as .pcap. It cracks nothing itself — you do that offline afterwards with hashcat.
• What you can do with it: demonstrate WPA2 weaknesses, collect handshakes to test password strength, learn how RL-driven automation works.
• Hardware / price: Raspberry Pi Zero W/2W (€15-20) + e-ink display (€15-25) + battery HAT such as PiSugar (€10-20) + case → total DIY around €40-80.
• Buy or build: either works. Flashing the image + configuring is low-barrier (no code needed). Ready-made units are for sale via Tindie and specialist shops ($80-150+), but building it yourself is cheaper and more educational.
• Links: pwnagotchi.ai · active fork: github.com/jayofelony/pwnagotchi

🪓 Bjorn (the Cyber Viking) — autonomous network recon on a Pi

• What: open-source offensive-recon tool on a Raspberry Pi with a 2.13" e-Paper screen and a Viking mascot, which keeps exploring your network autonomously (Tamagotchi-style).
• How it works: automates the classic pentest cycle: host/port discovery (incl. Nmap), vulnerability assessment, brute-forcing weak credentials on FTP/SSH/SMB/RDP/Telnet/SQL, and automatically steals files from vulnerable services. Modular so the community can add its own attack scripts, with gamification (achievements/badges) on the little screen.
• What you can do with it: an automated "drop box" for internal network pentests and home-lab practice — scan continuously and find weak passwords without a laptop next to it.
• Hardware / price: Raspberry Pi Zero 2 W (€12-22) + 2.13" e-Paper HAT (€15-25) + power bank (~10,000 mAh) → total DIY around €50-80.
• Buy or build: by default a DIY project (free install script, moderate difficulty, requires Linux/SSH knowledge). A ready-made version is available from Kaizen Labs (around $130-175).
• Links: github.com/infinition/Bjorn

📡 ESP32 Marauder / M5Stack Cardputer — WiFi & Bluetooth toolkit

• What: open-source firmware for ESP32 chips with WiFi/Bluetooth attack tools; the Cardputer is a handheld M5Stack device (QWERTY keyboard, screen, battery) that this firmware most popularly runs on.
• How it works: uses the ESP32 radio's monitor mode/packet injection for WiFi scanning, PCAP capture to SD card, deauth attacks, beacon spam (fake SSIDs), Evil Portal (fake login page for credential harvesting), and BLE scanning/spam (e.g. Swiftpair popups on Windows).
• What you can do with it: test your own WiFi security, collect WPA2 handshakes/PMKIDs for cracking practice, demonstrate phishing awareness with Evil Portal.
• Hardware / price: M5Stack Cardputer (~€30-40, most popular choice), CYD "Cheap Yellow Display" (~€12-18), LILYGO T-Display S3 (~€9-22), or a bare ESP32 devkit + screen wired up yourself (~€10-25, soldering).
• Buy or build: the Cardputer is available ready-made; you flash the firmware yourself via a web-based flasher in Chrome/Edge (no drivers, no code) — very low-barrier. DIY with a separate ESP32 + screen can be cheaper but requires wiring.
• Links: github.com/justcallmekoko/ESP32Marauder · M5Stack Cardputer

Similar/related gadgets in the same category:

🐬 Flipper Zero — multitool for physical access systems

• What/how: handheld with a sub-GHz radio, RFID/NFC reader, infrared, iButton and GPIO. Reads, analyzes and replays protocols of garage doors, card readers and remotes.
• Use: test MIFARE Classic weaknesses, clone IR remotes, analyze sub-GHz signals; with add-on boards also WiFi/Bluetooth.
• Buy/build: ready-made only (no legal DIY clone), around €170-200. A successor "Flipper One" has been announced for under $350.

🍍 WiFi Pineapple (Hak5) — rogue access point platform

• What/how: rogue access point that mimics a trusted SSID (PineAP suite), after which devices connect automatically and traffic can be intercepted via a web interface.
• Use: WiFi penetration tests, evil-twin demonstrations, mapping wireless environments.
• Buy/build: only as an official Hak5 product (from ~$100 for the Mark VII); a Raspberry Pi + hostapd approaches similar functionality as a DIY alternative.

🔌 O.MG Cable (Hak5 / O.MG) — cable with a hidden implant

• What/how: a seemingly normal USB(-C)/Lightning cable that, once activated over WiFi, presents itself as a keyboard and runs payloads; the keylogger variant stores up to 650,000 keystrokes.
• Use: red-team social engineering — get a "forgotten" cable used to gain access.
• Buy/build: ready-made only (highly specialized manufacturing), around $80-200+.

🦆 USB Rubber Ducky (Hak5) — keystroke injection

• What/how: USB stick that presents itself as a keyboard and injects pre-written keystrokes (DuckyScript) super-fast into an unlocked session.
• Use: install malware in seconds, change settings, or demonstrate how dangerous "found" USB sticks are (awareness training).
• Buy/build: original only from Hak5 (~$50-80); legal DIY alternatives with an Arduino Leonardo/Digispark running HID payloads exist too.

🐢 LAN Turtle (Hak5) — covert wired network access

• What/how: covert device disguised as a USB ethernet adapter; once plugged in it gives remote access to explore the internal network, poison DNS and set up reverse shells/VPN tunnels.
• Use: leave behind discreetly for prolonged network access during a physical/red-team engagement.
• Buy/build: only as an official product, around $129.

💳 Proxmark3 — RFID/NFC Swiss army knife

• What/how: reads, analyzes, clones and simulates both low-frequency (125 kHz) and high-frequency (13.56 MHz) RFID/NFC tags.
• Use: clone access badges during physical pentests, audit vulnerable MIFARE implementations.
• Buy/build: official RDV4/RDV2 ($300-500) or cheap AliExpress clones (~€30); the firmware (Iceman) is open source.

📻 HackRF One — Software Defined Radio

• What/how: transmits and receives (half-duplex) signals between 1 MHz and 6 GHz; signal processing happens in software (GNU Radio, GQRX) instead of fixed hardware.
• Use: research into garage doors, car keys, ADS-B aircraft tracking, wireless sensors and RF security analysis in general.
• Buy/build: open-source hardware, ready-made from Great Scott Gadgets/Sparkfun (~$320); cheaper clones exist thanks to the open design.

🦷 Ubertooth One — Bluetooth sniffing

• What/how: open-source USB dongle for passive monitoring of Bluetooth Classic and (partly) BLE traffic; follows frequency-hopping and forwards raw packets to Wireshark.
• Use: find vulnerabilities in Bluetooth implementations, analyze BLE traffic from IoT devices.
• Buy/build: open source and ready-made via Great Scott Gadgets/Hak5 (~$110-120) — far cheaper than commercial Bluetooth analyzers.

⌚ Deauther Watch / ESP8266 Deauther

• What/how: an ESP8266 board (DSTIKE series) that forges WiFi management frames to deauthenticate clients, plus creates fake networks — purely software, no encryption is cracked.
• Use: educationally demonstrate how vulnerable unpatched WiFi implementations are to deauth attacks.
• Buy/build: ready-made as a watch (~$39) or DIY with a separate ESP8266 board for a few euros — open-source Spacehuhn firmware.

🐊 Key Croc (Hak5) — hardware keylogger with triggers

• What/how: placed between keyboard and host, stores all keystrokes locally (invisible to antivirus) and automatically triggers payloads on specific keywords.
• Use: red-team engagements where passwords are intercepted the moment a target types a predetermined word.
• Buy/build: only as an official Hak5 product (~$120); watch out for cheap knock-offs on platforms like AliExpress.

🧩 Wi-Fi Devboard / T-Embed / Flipper CompanionApps

• Wi-Fi Devboard: official ESP32-S2 expansion that clips onto the Flipper Zero and adds wireless functionality (incl. Marauder firmware) (~$25-30).
• LilyGO T-Embed CC1101: standalone, cheaper (~$60-67) ESP32-S3 board with a screen and CC1101 radio, a budget alternative to the Flipper with community firmware such as CapibaraZero.
• CompanionApps/FAPs: community-built extra apps for the Flipper (NFC tools, BLE spam, GPIO) — not a separate device, but a low-barrier expansion layer.

🧰 Other notable tools

• Bash Bunny (Hak5): multi-vector USB attack platform that can present itself simultaneously as keyboard, network adapter and storage medium for more complex automated endpoint attacks.
• Packet Squirrel (Hak5): small, discreet ethernet MITM device for packet sniffing between a target and the router.
• CapibaraZero: open-source firmware that brings Flipper-like functionality to cheap DIY ESP32 hardware, relevant if you prefer building over buying.

🧭 Which one to pick?

• Just starting, low budget: buy an M5Stack Cardputer (~€30-40) and flash ESP32 Marauder onto it — no soldering, low-barrier web flasher, a broad range of WiFi/BLE features.
• Learn by building: Pwnagotchi or Bjorn on a Raspberry Pi Zero 2 W — more assembly/configuration, but you understand the whole stack (OS, scripts, AI model) better.
• Testing physical access/badges: Proxmark3 (RFID/NFC) or Flipper Zero (broader, but pricier and ready-made only).
• RF research broader than WiFi/Bluetooth: HackRF One (SDR) or Ubertooth One (Bluetooth-specific).
• Red-team/social engineering with physical access: the Hak5 line (Rubber Ducky, O.MG Cable, LAN Turtle, Key Croc, Bash Bunny, Packet Squirrel) — nearly all available only as an official product, no DIY path.