Gearbox

Gearbox is a device and hardware security assessment orchestration engine that evaluates physical interfaces on target devices through a modular, YAML-driven workflow. The operator defines a project configuration file specifying the device under test, its physical interfaces (Ethernet, USB, HDMI, Zigbee, Bluetooth, serial, etc.), and any credentials or scope constraints. Gearbox reads this configuration and automatically selects the appropriate assessment modules for each declared interface from its registry of 60+ security testing modules.

Each interface type maps to a chain of modules executed in sequence. For example, an Ethernet interface triggers network discovery (nmap), traffic capture (tcpdump), DHCP server detection, port scanning, banner grabbing, web application probing, SSL/TLS analysis, SSH auditing, SMB enumeration, NFS/FTP checks, Nuclei vulnerability scanning, and Responder-based credential harvesting. USB interfaces trigger power analysis, HID injection testing (keyboard/mouse emulation), Bash Bunny payload execution, mass storage enumeration, and Ethernet adapter detection. HDMI/video interfaces trigger EDID extraction, DDC/CI probing, HDCP compliance testing, and CEC command injection analysis.

Gearbox persists all findings in a SQLite database (findings.db) with parallel JSON and CSV output in the universal pr0t31n schema. Every interface assessment begins with photographic evidence capture. The tool integrates with Nessus for enterprise vulnerability scanning when available, and emits __GB_LOG__, __GB_FINDING__, and __GB_STATUS__ protocol tokens for real-time monitoring through the Gauntlet management console. Adaptive concurrency automatically scales thread pools based on available CPU and RAM, with runtime monitoring that throttles under resource pressure.

Gearbox supports checkpoint/resume for long-running hardware assessments, allowing interrupted scans to restart from the last completed module. All third-party tool invocations are routed through pr0t31n_tool_runner for execution logging, version capture, and error detection. Network traffic captures are automatically handed to Trawler for passive traffic analysis.

Gearbox is a CLI tool managed by Gauntlet. No standalone web interface. Security considerations:

• Subprocess safety: All 50+ tool invocations use list-based subprocess calls throughout
• Root required: Many assessment modules (WiFi monitor mode, Bluetooth, USB, traffic capture) require root/sudo
• Database: SQLite database stores findings, hosts, ports, and configurations — local only

Gearbox findings use the GB- prefix for catalogue IDs (e.g., GB-ETH-001, GB-USB-001, GB-HDMI-001). Findings are organized by the interface type that triggered the detection:

• GB-ETH-* — Ethernet/network interface findings (open ports, vulnerable services, weak SSL/TLS, credential harvesting)
• GB-USB-* — USB interface findings (HID injection success, mass storage auto-mount, power analysis anomalies)
• GB-HDMI-* / GB-VID-* — Video interface findings (HDCP bypass, CEC injection, EDID spoofing vectors)
• GB-ZB-* — Zigbee protocol findings (key recovery, PAN ID conflicts)
• GB-BT-* — Bluetooth findings (pairing weaknesses, KNOB, BIAS)
• GB-SER-* — Serial/CAN bus findings (unauthenticated console access, CAN frame injection)
• GB-RF-* — Sub-GHz/LoRa/RFID/Z-Wave radio findings

All findings are persisted in both SQLite (findings.db) and the universal JSON/CSV schema. Risk levels follow the standard CRITICAL/HIGH/MEDIUM/LOW/INFO scale. Each finding includes the interface name, module that generated it, and photo evidence path when available.

Gearbox emits __CRUCIBLE_ACTION_ITEM__ tokens during assessment to flag items requiring immediate operator attention or manual follow-up. Common action items include:

• Manual verification required — When an automated module detects a potential vulnerability that requires physical interaction or visual confirmation (e.g., HDMI output content inspection, USB device behavior observation)
• Credential harvested — When Responder or another credential harvesting module captures authentication material that should be tested for reuse
• Firmware extraction opportunity — When JTAG or SPI flash interfaces are detected and accessible, flagging the device for deeper firmware analysis
• Network segmentation violation — When traffic analysis reveals the device communicating with unexpected network segments or external hosts
• Photo evidence needed — When the photo module cannot automatically capture interface documentation and manual photography is required