HAK5 Key Croc

It not only records and streams keystrokes online, but exploits the target with payloads that are triggered upon entering keywords of interest.

By emulating trusted devices such as serial, memory, HID, and Ethernet devices, it opens multiple attack vectors - from keystroke typing to network hijacking.

Imagine capturing credentials and systematically using them to exfiltrate data. Or pentest from anywhere, live in a web browser with Cloud C2.

That's easy too. A hidden button turns it into a flash drive where changing settings is just editing a text file. And with a root shell, you have your favorite pentest tools like nmap, responder, impacket, and metasploit at your fingertips.

From the pioneers of keystroke injection comes the next generation of keylogging - with active payloads.

PATTERN MATCH PAYLOADS

Trigger payloads when the target's input matches a pattern—from a simple keyword to an advanced regular expression—even if the target makes a typo and hits a backspace.

Store a number of keystrokes typed before or after a payload is matched. Then use those keystrokes in a Cloud C2 notification or actively against the target in an extended payload.

Imagine capturing the keys pressed after a key combination like [CTRL-ALT-DELETE] or [CTRL-CMD-Q] and then using the captured credentials to automatically trigger a silent network exfiltration payload.

MULTI-VECTOR ATTACKS

Simultaneously emulate numerous trusted USB devices. Pass through and inject keystrokes with HID attack mode. Gain network access to the target with Ethernet Attack Mode. Present the Key Croc as a flash drive with memory attack mode. Even emulate a serial device for some sophisticated attacks with serial attack mode.

The fully equipped Linux box comes with a root shell. And with its quad-core 1.2GHz ARM CPU and desktop-class SSD, your favorite tools - from Nmap and Responder to Impacket and Metasploit - are just a few commands away.

CLOUD C2 READY

Test online from anywhere with the free, self-hosted Cloud C2 and watch keystrokes in real time. Or live-inject your own keystrokes, exfiltrate loot, manage payloads, and even get a root shell for advanced attacks right from your web browser.
Learn more about Cloud C2

Easy configuration

The Key Croc is already set up to record keystrokes outside of the box. Just plug it in and off you go. It even automatically clones the keyboard's hardware IDs.

Then, to get the loot, just press a hidden arming button. It becomes a flash drive that you can use to copy logs with drag and drop.

Enabling payloads and configuring settings like WiFi and SSH is as easy as editing a text file.