Quiver

Quiver is a Flask/SocketIO web application for managing penetration testing hardware devices. It provides a centralized interface for configuring, connecting to, and operating the physical tools used in hardware and wireless assessments — from Hak5 devices and Proxmark RFID readers to serial-attached microcontrollers and WiFi Duck keystroke injectors.

Each device registered in Quiver is assigned a shell type that determines how the operator interacts with it. SSH shells use paramiko for network-attached devices like Hak5 gear or Raspberry Pi drop devices. Serial shells use pyserial for REPL/VCP console connections to microcontrollers and embedded devices. Process shells spawn PTY subprocesses for tools like Proxmark3 (pm3), RfCat (rfcat -r), GreatFET (gf shell), or J-Link (JLinkExe). WebSocket shells relay to devices like WiFi Duck that expose a ws:// endpoint. Devices that only support libusb (no interactive CLI) are marked as none shell type.

The browser-based interface provides interactive terminals for each device via Socket.IO, with real-time input/output streaming. Operators can open multiple device terminals simultaneously, manage device inventories (IPs, credentials, connection parameters), and deploy payloads to supported devices. Quiver mirrors the Gauntlet UI theme system for visual consistency across the toolkit's web applications.

Quiver stores device configurations locally and provides payload management — operators can browse, edit, and push payload scripts to devices that support them (e.g., Hak5 Rubber Ducky payloads, WiFi Duck scripts, Proxmark Lua scripts).

Quiver uses the shared _auth.py authentication module. On first launch, credentials are initialized via _auth.init_auth(). All sessions are protected with secure, HTTP-only, SameSite=Lax cookies with a 30-minute expiration. Security headers (Cache-Control, Pragma, Expires for HTML responses) are applied via _auth.apply_security_headers().

Device credentials (SSH passwords, serial parameters) are stored locally in Quiver's configuration. The application is designed to run on the operator's workstation — it should not be exposed to untrusted networks. WebSocket connections for device terminals are authenticated through the Flask session.