Physical pentesting tools: the complete guide

There has never been a better time to be a hardware hacker – tools are cheap, access to information is widespread and free, and possibilities are almost limitless.

With this piece, we begin a series of articles about hardware tools used for “hacking” – not only in ethical contexts. Every ethical hacker or red-teamer employs these devices during security tests to evaluate how well a client’s infrastructure is prepared to defend against real-world attackers.

Our Pentesting Tools Series

When security testing leaves the keyboard and enters the physical world, the threat model shifts: radios, badges, USB sticks, cables, and unattended screens suddenly matter. Physical pentesting tools let a tester probe those surfaces in a controlled, auditable way. They’re small, portable gadgets that recreate realistic attacker behavior so you can see what actually fails in practice – not just what looks risky on paper.

This series will walk you through the physical pentester’s toolbox. You’ll learn what each class of device actually does, why an operator would pick one tool over another, and how defenders spot and stop these techniques. This isn’t a how-to for operators; it’s a practical map that helps you understand risk, ask the right questions, and follow the device deep dives linked throughout the article.

RFID, NFC & Access-Control Tools

Most office buildings rely on access cards or NFC tags for entry. RFID (Radio-frequency identification), NFC (Near Field Communication) & access-control tools can read, emulate, and test these systems, showing whether a card can be cloned or a door spoofed. These gears are a class of portable and desktop devices, plus software designed to interact with contactless cards and tags. At a basic level, they transmit and receive the short-range radio signals that power passive tags: a reader generates an electromagnetic field, the tag answers with an identifier or data block, and the reader interprets that response. Their functions can be broken down into a few key jobs:

• Readers/Writers are used to capture a card’s ID or dump its memory contents.
• Emulators pretend to be a card, allowing a tester to spoof a door reader into accepting a signal.
• Cloners copy a captured tag’s contents onto blank, writable media.

More advanced tools act as protocol analyzers or “sniffers,” capturing raw frames to help reverse-engineer how a system authenticates, while relay or bridge devices forward a live card’s signal over distance to bypass proximity requirements. Software suites add decoding, key-testing, and scripted interaction, so an operator can replay messages, test challenge-response flows, or check for weak keys at scale. In practical terms, these tools let testers demonstrate whether a badge only exposes a static ID, whether stored data is readable, and whether a genuine authentication handshake exists. 

During a professional engagement, a tester might use such a device to demonstrate how easily outdated badge systems – especially those using old 125 kHz protocols or unsecured MIFARE Classic deployments – can be copied in seconds. A surprising number of corporate sites still use them. Typical weaknesses are predictable: low-entropy identifiers, a lack of mutual authentication, or door controllers that accept an ID without verifying its source. Relay attacks, in particular, effectively show how a single-factor badge check can be defeated.

It’s important to see these as diagnostic tools, not just “hacking toys.” They are used for security assessments, interoperability testing, and research on legacy systems to prove whether a badge is just broadcasting a static ID or if a real authentication handshake is taking place. Flipper Zero is an example of a multi-tool that testers use for these checks, and here you can also explore our detailed guide to the device.

Flipper Zero – device capturing RFID signal.

Rogue APs / Evil Twin platforms

Rogue Access Points create fake Wi-Fi networks that mimic legitimate SSIDs (the name of the Wi-Fi network – e.g., “Home_WiFi”) so devices or people connect automatically. The goal is usually not to “break” encryption, but to combine social engineering with network capture. In a typical test, you might see a captive portal that looks like the company login page, or a transparent proxy that grabs session cookies. In the field, this plays out in two ways: broad, mass phishing (lots of devices, low targeting) or a focused evil-twin attack aimed at a specific team, matching SSID names and signal behavior.

Whether an attack works often comes down to client behavior – auto-connect settings or remembered networks – and how well apps validate TLS and certificates. Mobile apps that skip cert checks are easy to intercept; browsers using HSTS or certificate pinning are much harder. Defenders can spot fakes with enterprise Wi-Fi controllers and WIPS that look for duplicate SSIDs, BSSIDs that appear in strange locations, odd channel usage, or abnormal transmit power.

If you want to stop these attacks, focus on what actually prevents them: WPA2/3 Enterprise with certificate-based EAP and client certs where possible, NAC to block unknown clients from sensitive VLANs, and active monitoring for duplicate SSIDs or suspicious beacons. An example of a tool that enables these attacks is the WiFi Pineapple, and here is a video demonstrating an attack performed with it, and you can also check out our in-depth overview of the device here.

Wi-Fi Pineapple is a wireless auditing platform designed to perform authorized network auditing and security analysis.

HID Injectors & Bad USB 

If you’ve ever wanted to feel a bit like Elliot Alderson from Mr. Robot – dropping a device into a target and watching the world change one keystroke at a time – bad USBs are the tools that make that scene plausible (without the TV drama, thankfully).

Human Interface Device injectors pretend to be keyboards or mice and then type commands at machine speed. Most operating systems trust input devices, so emulating a human lets an attacker bypass many software checks. The classic scenario is a dropped USB in a kitchen or lobby – someone plugs it in out of curiosity and the device executes a PowerShell one-liner before they can react.

Timing and the target’s state matter. A locked screen will usually stop a payload; an unlocked admin session won’t. Modern EDRs and endpoint protections can detect strange process creation patterns from user input, but many environments don’t have those rules tuned. A layered defense works best: require screen locks, enforce USB device control or whitelisting, use application allow-listing, and monitor for rapid scripted input or unexpected shells.

Advanced HID tools can do more than a simple one-liner. They can chain multi-step workflows, manipulate UAC dialogs to gain elevation, or drop a small beaconing script for persistence. Use HID tests to validate real endpoint protections; they’re blunt but effective indicators of real risk. 

If you want the technical specs, the Rubber Ducky’s official product page is here. 

When connected to a computer, Rubber Ducky begins sending pre-programmed strings of characters, commands, and keyboard shortcuts. 

Network implants

Inline packet devices are small appliances you tuck between a host and the network to capture, modify, or tunnel traffic. They’re discreet – battery-powered boxes that let red teams get a foothold without credentials. People use them to bridge segmented zones temporarily, exfiltrate small datasets through encrypted tunnels, or capture traffic on site for later analysis.

Some appliances are passive taps; others act as active bridges or NAT devices. A properly configured switch (port security, MAC binding, 802.1X) reduces the risk, but real sites often have forgotten wall ports or unmanaged patch panels that are exploitable. Detection usually comes from flow monitoring: an unexpected outbound tunnel, a host making connections to unknown brokers, or a new MAC on a critical port should trigger alarms.

Practical mitigations are straightforward: enforce port security and 802.1X, perform regular physical audits of patch panels, and use Network Detection & Response (NDR) to surface unusual flows. Devices you’ll see in tests include Packet Squirrel and SharkJack.

SharkJack is a hot plug attack tool, with the difference that it has an Ethernet plug instead of a USB.

Software-Defined Radio (SDR)

While most devices are limited to one standard, such as Wi-Fi or Bluetooth, an SDR is a true chameleon. It can tune across a vast spectrum of frequencies, letting you listen in and communicate with almost anything wireless – from garage door remotes and alarm systems to custom IoT gadgets.

In practice, a pentester uses an SDR to “learn the language” a specific device speaks. Once they understand it, they can test if a signal can be captured and replayed (a classic ‘replay attack,’ like to open someone’s garage) or if other vulnerabilities exist. The goal, of course, is to find these weaknesses and recommend proper fixes, like implementing rolling codes or strong cryptographic authentication.

But keep in mind, this isn’t a tool for everyone. Diving into SDR comes with a steep learning curve and, more importantly, legal constraints. Transmitting on regulated frequencies without a license is illegal and can disrupt critical services. That’s why professional tests are done in shielded chambers or with signal attenuators. It’s a specialist’s tool, and its power shouldn’t be underestimated.

A great example of such a versatile device is the HackRF One.

HackRF One is a hardware platform designed for testing and developing modern next-generation radio technologies, both as a USB peripheral device and as a standalone tool.

Key Defensive Takeaways

Ultimately, the purpose of these offensive exercises is to build stronger defenses. Across every category we’ve explored, a few core principles stand out: reduce implicit trust, increase visibility into your systems, and harden default configurations. In practical terms, this means validating certificates, controlling USB devices, securing physical network ports, moving to modern cryptographic credentials for access control, and deploying RF monitoring where wireless links are business-critical.

A Final Word on Tools, Tactics, and Legality

The tools we’ve covered are powerful, and their effectiveness depends on choosing the right one for the job. Whether you’re testing user awareness with a rogue AP or checking physical security with an RFID cloner, the goal is to evaluate a specific control.

But “with great power comes great responsibility”. There is a clear, bright line between a professional penetration test and a criminal act. One is a commissioned, controlled exercise to improve security; the other is a crime. Always operate with a written Rules of Engagement document, get explicit authorization before any test, and build solid plans for containment and rollback should anything go wrong.

What’s Next?

This article serves as a high-level map to the world of pentesting hardware. Each of these categories deserves a closer look, which is exactly what our follow-up series will provide. In the upcoming posts, we will deep-dive into specific devices, explain how they are used in realistic (and non-exploitative) scenarios, and detail the practical defensive controls and logging strategies you can implement right away.