zSecurity ZS Cactus and Cactus PRO: Wi-Fi BadUSB guide

Product photo: zSecurity

What it is

ZS Cactus is zSecurity’s Wi-Fi-managed BadUSB-style platform for keystroke injection and related lab workflows. Cactus PRO adds hardware keylogging features according to zSecurity’s product copy, plus the shared PRO theme of ready payloads, Wi-Fi honeypot helpers, and browser-based control.

What it is actually used for

• Authorised BadUSB demonstrations with wireless operator control
• Teaching honeypot Wi-Fi credential harvesting in isolated labs
• Contrasting plain HID dongles with Wi-Fi-managed implants

Key specs and facts

• HID keystroke injection
• Wi-Fi web control for payloads (vendor-described)
• PRO: hardware keylogging path (zSecurity)
• Ready payloads / honeypot features per vendor pages
• US list pricing appears on zsecurity.org — confirm live figures (often VIP vs regular)

Who it suits / who should pick something else

Pick Cactus/PRO when you want Wi-Fi-operated BadUSB labs. Pick Hak5 Ducky when you want the classic DuckyScript ecosystem. Never for unauthorised use.

Practical setup notes

• Isolate lab Wi-Fi completely
• Change default credentials
• Treat keylogging features as high-sensitivity evidence tools

How I talk about these tools locally

Most Sri Lankan companies I work with do not need a full Hak5 suitcase on day one. They need one or two devices tied to a written lesson or SOW, plus the discipline not to “just try it” on the office SSID. If you are building a teaching kit, write the learning outcome first (“show USB HID trust”, “show Ethernet dropbox risk”) and only then pick the SKU.

Legal and ethical use

Use these tools only on systems you own or systems covered by written authorisation. In Sri Lanka, unauthorised access to computer systems can engage the Computer Crimes Act No. 24 of 2007. This post is practical product guidance, not legal advice. If the use case is unclear, pause and get counsel.

FAQ

Cactus vs PRO?

PRO adds hardware keylogging per zSecurity.

Same as Venom?

Venom is cable-shaped; Cactus is dongle-shaped.

Local LKR price?

Not sold as ALFA catalogue — ask sourcing.

Legal?

Authorisation required — see legal section.

Interested in Sri Lanka?

ALFA does not currently stock this as a standard catalogue line, and I am not listing a local LKR price here. If you need it for authorised testing or training, message Dishan on WhatsApp at +94 75 255 0704 and ask about sourcing. Include a short note on the engagement or lab use case so the reply is useful.

Documentation habit

Whatever you buy, keep a folder with: purchase date, serial/MAC, firmware hash, and the engagement or class where it was last used. That habit matters more than owning every SKU on this list.

Field notes from teaching

I keep coming back to the same failure pattern: people buy the tool before they write the rule. If your team cannot explain, in one paragraph, which systems are in scope and who signed that scope, the device should stay in the cupboard. Sri Lankan SMEs especially benefit from small, boring kits — one radio, one HID trainer, one written lab SSID — used every month until the muscle memory sticks.

When you ask me about sourcing an item ALFA does not shelf as standard stock, say whether you need a single unit for a named test or a classroom set. Lead times and import paperwork differ. I will not invent a local VAT-inclusive price here for non-catalogue gear; we talk that through on WhatsApp with the vendor quote in hand.

Also budget time for detection. Every offensive demo should end with the control that would have made the demo fail: USB allow-listing, 802.1X on wall jacks, DHCP snooping, cable inventory, whatever fits. Tools without that closing loop turn into theatre.

Field notes from teaching

I keep coming back to the same failure pattern: people buy the tool before they write the rule. If your team cannot explain, in one paragraph, which systems are in scope and who signed that scope, the device should stay in the cupboard. Sri Lankan SMEs especially benefit from small, boring kits — one radio, one HID trainer, one written lab SSID — used every month until the muscle memory sticks.

When you ask me about sourcing an item ALFA does not shelf as standard stock, say whether you need a single unit for a named test or a classroom set. Lead times and import paperwork differ. I will not invent a local VAT-inclusive price here for non-catalogue gear; we talk that through on WhatsApp with the vendor quote in hand.

Also budget time for detection. Every offensive demo should end with the control that would have made the demo fail: USB allow-listing, 802.1X on wall jacks, DHCP snooping, cable inventory, whatever fits. Tools without that closing loop turn into theatre.