baseline
Observe the host before the unknown cable is connected, to establish what "normal" looks like.
Defensive hardware analysis · v0.4.1
Know what a suspect USB cable actually does.
CableProbe watches a sacrificial Linux host while you connect an unknown USB cable — USB-C or USB-A, data or charge-only — then compares before, during and after to surface hidden HID devices, rogue network gadgets, mass storage, serial channels, keystroke-injection HID descriptors, changes to boot persistence, and — with an INA219 sensor — a power draw the cable can't fake.
It only observes, records and reports. No payloads, no exploitation, no persistence, no remote access — by design.
24 probes · 44 rules · Python 3.11+ · Raspberry Pi OS / Debian · MIT
CableProbe cannot prove a cable is safe
A clean report means CableProbe did not observe anything notable during that session — not that the cable is benign. Treat it as one input to your own judgement, run it on a dedicated disposable Raspberry Pi that holds no sensitive data, and treat every cable under test as hostile hardware.
A session has three phases
CableProbe samples the host continuously and correlates every change with the phase it happened in. A progress bar tracks each phase's timer.
test
You connect or power the unknown cable. CableProbe keeps observing and timestamping everything that enumerates.
post_test
You disconnect the cable. CableProbe watches whether the host returns to baseline — or whether something stayed behind.
Connector type does not matter — CableProbe watches how the host reacts, not the plug. USB-C or USB-A, either orientation, with a passive adapter if you need one. It then diffs the three phases, writes a structured JSON report of everything that appeared, disappeared or changed, and runs YAML-configurable detection rules over those differences to produce prioritised findings.
Watch a full session
A cableprobe run (v0.4.1) — three phases with
progress bars, then the diff, the findings and the plain-language
What this means verdict. The clean cable shows
no differences, no findings; switch scenarios to see a
USB mouse or keyboard flag a HIGH BadUSB finding, or an
external hard drive flag HIGH for the storage it presents — the same
signature whether the device is an implant or one you trust (that's what
cableprobe allow is for).
Recorded and reconstructed output, replayed in the browser. CableProbe never modifies the host.
24 probes, observation only
Every probe reads state that is already on the host and never writes to it.
21 run by default; the rest
(wifi_scan, power, connections) are
opt-in. A probe whose interface the host does not expose is skipped, not an
error.
USB devices & descriptors
usb usb_descriptors usb_topology hid_report
USB device inventory: vendor/model, interface classes, HID, hubs. …and more.
Power & USB-C
usbc_pd power*
USB-C / Power Delivery port and partner state: data and power roles, alternate modes. …and more.
Storage
block mounts
Block devices (disks) and their transport; partitions summarised onto the parent disk. …and more.
Network
network routing listeners connections*
Network interfaces: driver, transport, USB-ness, addresses. …and more.
Peripherals
input serial audio video
Input / HID devices: keyboards, mice, tablets. …and more.
Radio & behaviour
wifi_scan* keystroke_cadence
Wi-Fi access points in range — an implant cable may run its own hidden AP. Off by default: on premises with Wi-Fi, neighbouring APs drift in and out of range on their own. …and more.
System & kernel
udev_monitor persistence pci kernel_modules process kernel_log
Live udev add/remove/change events for subsystems that map to a real device kind. …and more.
* opt-in — not in the default set.
See the documentation for what each probe
observes, or run cableprobe probes.
Why teams use it
Evidence, not vibes
Every finding is backed by the exact device, attribute change and kernel lines that triggered it, in a report you can attach to a ticket.
Tells you what it means
The summary ends with a plain-language verdict — from "treat this as hostile hardware" to "nothing notable" — one sentence per thing seen, and never "the cable is safe".
Signal, not noise
Kernel worker threads, ephemeral-port listeners, duplicate HID nodes and trivial plumbing are filtered out, so a clean cable reads as clean.
Knows the off-the-shelf implants
Matches devices against a packaged blocklist of USB IDs that Digispark, Bash Bunny, Teensy, Malduino and ESP32 cable implants present by default — a hit is its own finding.
Reads the HID descriptor, not the label
The hid_report probe parses HID report descriptors and
flags a device that can send keystrokes even when it never
registered as a keyboard.
Measures what can't be spoofed
Wire an INA219 sensor and the opt-in power probe reads
VBUS voltage and current inline — active electronics in a cable draw
power whatever the descriptors claim.
Stops shouting about your own kit
cableprobe allow registers devices you trust; findings
about them drop to info, so repeat tests of your hardware
stay quiet.
Rules are just YAML
44 built-in rules matching on change, kind,
first_seen_phase, attribute conditions and more. Add your
own without touching Python.
Rig-friendly
--auto advances phases on a timer for unattended testing;
--fail-on-findings gives CI-style exit codes. It tells
you the exact sudo command if you forgot it.
Disposable by design
Build your own headless Raspberry Pi image from the shipped pi-gen recipe. Flash, test one cable, re-flash.
Privacy-aware
Reports are 0600; device text is stripped of control
characters; the keystroke probe keeps timing only and discards key
identity; command-line capture is a toggle.
Tested without hardware
The analysis, rules and report layers are pure, with 100+ unit tests.
Every probe's parser runs against captured samples or a fake
/sys tree.
Built to be trusted
Open source under MIT, observation-only by design, no telemetry — and a website with zero third-party tracking.
Run a session in one command
You are prompted before each phase, or pass --auto to run
on a timer.
# Check the host is ready
cableprobe check
# Run a session (prompted before each phase)
sudo cableprobe run --name "suspect-cable-01" \
--baseline 30 --test 90 --post-test 30
# Inspect a saved report
cableprobe report cableprobe-sessions/2026*.cableprobe.jsonFrequently asked questions
Short answers about what CableProbe is, what it can and cannot do, and how to get it.
What is CableProbe?
CableProbe is a free, open-source command-line tool for Linux that analyses an unknown USB cable on a sacrificial test host. It runs a three-phase session (baseline, test, post-test) with 24 observation-only probes (21 on by default), then reports every device, process, network and kernel change that appeared, disappeared or changed while the cable was connected, and applies 44 detection rules and a known-implant blocklist.
Does CableProbe work with USB-A cables, or only USB-C?
Both. Connector type does not matter — CableProbe watches how the host reacts, not the plug. Any cable you can get one end of into a port on the test host works: USB-C or USB-A, data or charge-only, with a passive adapter if needed. The usbc_pd probe additionally reports Type-C power-delivery state when the host exposes a Type-C port, and skips otherwise.
Can CableProbe prove a USB cable is safe?
No. CableProbe cannot prove a cable is safe or uncompromised. A clean report means nothing notable was observed during that session, not that the cable is benign. Use it as one input to your own judgement.
Does CableProbe attack or modify the cable?
No. CableProbe only observes, records and reports. It does not inject payloads, exploit anything, capture credentials, establish persistence or provide remote access. It writes a single JSON report (mode 0600) and changes nothing else on the host.
What hardware do I need to run CableProbe?
A dedicated, disposable Linux host — typically a Raspberry Pi — that holds no sensitive data and is isolated from networks you care about. CableProbe is developed and tested on Raspberry Pi OS and Debian and needs Python 3.11 or newer. Run it with sudo so every probe has the access it needs.
What can CableProbe detect?
Anything that changes on the host only while the cable is connected. Its probes cover hidden HID devices such as BadUSB keyboards, devices whose HID report descriptor can inject keystrokes without registering as a keyboard, rogue USB network adapters, unexpected mass storage, serial channels, covert microphones and cameras, USB-C alt-mode and Thunderbolt/PCIe (DMA) exposure, changes to boot and login persistence points, kernel modules and processes that start on connect, DNS or gateway changes, and new listening sockets. It also matches devices against a blocklist of USB IDs that off-the-shelf BadUSB tools present by default (Digispark, Bash Bunny, Teensy, ESP32 cable implants, …). Opt-in probes add inline power measurement and a Wi-Fi scan.
Can CableProbe measure how much power a cable draws?
Yes, with the opt-in power probe. Wire an INA219 current sensor to the Pi's I²C bus and CableProbe reads the USB VBUS voltage and current inline. Active electronics hidden in a cable draw current whatever the descriptors claim, so this is the one measurement a cable cannot spoof. It does not do e-marker interrogation or signal-integrity analysis.
How do I stop CableProbe flagging my own USB devices?
Register them with "cableprobe allow". Findings about an allowlisted device are downgraded to info, so repeat tests of your own hardware stop shouting. "cableprobe allow --from-report" adds every device from a saved report. The allowlist lives at <output_dir>/allowlist.yaml.
Does the keystroke probe record what I type?
No. The keystroke_cadence probe reads only the timing of key-press events; the key code of every event is discarded before anything is stored, so it never learns which keys were pressed. Set capture_keystroke_timing to false to disable it entirely.
How much does CableProbe cost and how is it licensed?
CableProbe is free and open source under the MIT License, created by Stable State Consulting Ltd. You can read, modify and redistribute the source.
Where do I download CableProbe?
Install from PyPI with "pipx install cableprobe", or get the source and releases from GitHub. The website hosts documentation only — no binaries.
Does CableProbe send any data over the network?
No outbound connections, no telemetry, no auto-update. The default probes only read local state. The opt-in wifi_scan probe performs an active scan for nearby access points (it never associates with one); the opt-in connections probe watches for outbound TCP but makes none itself.
Analyse your first cable today
Install with pipx, or build a disposable Pi image from the recipe.