Jump to content

Bash Bunny or Packet Squirrel?


Us3rnotfound
 Share

Recommended Posts

The BashBunny can do USB-HID (keyboard), USB-serial and USB-ethernet, the packet squirrel can only do network-related attacks. Furthermore, the BashBunny has more local storage, more RAM and more computational power. You should think of the Packet Squirrel more like a LAN Turtle except for being inline ethernet. 

  • Upvote 2
Link to comment
Share on other sites

Sundhaugh92 summaries it quite nicely - though I will add that the choice, obviously, depends on what you're going to be using it for.
General pentesting and mucking about? Bash Bunny.
Network-based pentesting and monitoring? Packet Squirrel.

Bash Bunny has a bigger range of payloads (currently, may change in future - may not), and I believe it will have bigger support than the Packet Squirrel since it's a more of a swiss army knife of USB attacks (not to mention can just be used as a normal USB..) while the Packet Squirrel focuses on network. That's just speculation, though..

Link to comment
Share on other sites

1 minute ago, Dave-ee Jones said:

Sundhaugh92 summaries it quite nicely - though I will add that the choice, obviously, depends on what you're going to be using it for.
General pentesting and mucking about? Bash Bunny.
Network-based pentesting and monitoring? Packet Squirrel.

Bash Bunny has a bigger range of payloads (currently, may change in future - may not), and I believe it will have bigger support than the Packet Squirrel since it's a more of a swiss army knife of USB attacks (not to mention can just be used as a normal USB..) while the Packet Squirrel focuses on network. That's just speculation, though..

One thing the Packet Squirrel can do however is things that require a network uplink. For example packet-sniffing, redirects, cookie-theft and such. The BashBunny is something you'll probably remove after a minute, like the ducky, while the Packet Squirrel is intended to stay "behind enemy lines".

  • Upvote 2
Link to comment
Share on other sites

They are tools for two different types of attacks.

Bashbunny is geared toward USB based attacks on the machine by pretending to be different USB devices in different combinations.  You plug it into a USB on the victim and it types out stuff or does something on its brought up USB network, etc.  The BB cannot do MiTM outright.  Some have been trying to do hacks so it can but it doesn't automatically.

The Squirrel, from what I read, is a MiTM device.  It is designed to sit between two network connections.  It can capture packets that go through it on an external usb storage and do a variety of MiTM attacks.

 

One is for network level attacks and one is direct host USB interaction attacks.

  • Upvote 2
Link to comment
Share on other sites

You guys sum it up well. Now that we've rounded out the catalog I've setup a page that hopefully makes it clearer - https://www.hak5.org/gear

Basically the typical use cases of the USB physical access tools, like the bunny and ducky, are for drive-by attacks - usually under a minute for an exploit.

Our Ethernet tools are made more for longer term deployments - like doing a packet capture or recon scan for a few minutes, or planting at the client site semi-permanently (throughout the engagement)

  • Upvote 2
Link to comment
Share on other sites

Great points guys. I started a similar thread asking about the Turtle and Squirrel specifically since they are so similar. I encourage anyone who has input to reply to that thread. I would love to see a detailed comparison of the two so I can better round out my toolkit and processes. Thanks to all who reply!

 

  • Like 1
  • Upvote 1
Link to comment
Share on other sites

  • 1 year later...

nano is good and the tetra is better.  both do the same thing, but the tetra has more power and 5ghz

  • Upvote 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...