3D Printed Tripod Mounts for the BSidesSF NOC
Custom 3D printed mounts for attaching Aruba access points and Ubiquiti switches to light stands for the BSidesSF pop-up conference network.
LANRAT
Recent content on LANRAT
Latest posts
2048 Touch for Pebble
2048 Touch is an implementation of the classic 2048 sliding-tile puzzle game for Pebble smartwatches. Combine matching numbered tiles to add them together and work your way up to the 2048 tile and beyond. Board, score, and high score persist across launches so the game can be picked back up anytime. The app supports touch swipes on touch-capable models like the Pebble Time 2 (emery), and falls…
The Sun vs. My Monitor: Winning the Glare War with Home Assistant
Automatically control window blinds based on sun position and cloud cover using Home Assistant, SwitchBot Blind Tilt, and a little trigonometry.
Linux Arbitrary File Write and Privilege Escalation with dd
Exploiting Linux disk group membership for privilege escalation by directly manipulating filesystem blocks with dd to bypass file permissions.
Cloudflare WARP Config Generator
A browser-based and CLI tool for generating WireGuard configurations compatible with Cloudflare WARP. The application generates keypairs locally in the browser or CLI, registers them with Cloudflare’s WARP API, and outputs a complete WireGuard configuration file with QR code for easy mobile import. All processing happens client-side with no server-side storage. Configuration options include…
MikroTik SwOS Python Library
Got a bunch of MikroTik switches running SwOS or SwOS Lite with no good way to manage them centrally? This library has you covered. Built by reverse engineering the SwOS HTTP API, it provides complete programmatic access to all switch features. Works with both SwOS and SwOS Lite, supports everything from port configs and PoE to VLANs and SNMP settings. Comes with a CLI tool for quick lookups and a…
TRMNL Plugins
A collection of custom plugins for TRMNL e-ink displays. The repository provides a Docker-based development environment for creating and testing plugins that extend TRMNL functionality.
Software Supply Chain Security: The Case for Minimal Dependencies
A decade of escalating supply chain attacks shows why dependency management isn't just a technical choice, it's a security decision. Learn practical strategies for minimizing your attack surface.
Drouter
Drouter provides dynamic route injection for Docker containers through label-based configuration. The systemd service monitors Docker containers and automatically configures static routes in their network namespaces without requiring elevated privileges within the containers themselves. The system uses Docker labels to specify routing rules and applies them automatically when containers start or…
Drouter: Dynamic Route Injection for Docker Containers
A systemd service that automatically adds custom routes to Docker containers using labels, perfect for macvlan networks and complex routing scenarios.
ARIN IPv4 Waitlist Tracking
ARIN IPv4 Wait-list Tracking analyzes ARIN’s IPv4 address wait-list and provides statistical insights into wait times and allocation patterns. The Python-based system tracks historical data on IPv4 block requests and clearances to estimate processing times for different network block sizes. The web dashboard displays real-time analytics including current wait-list sizes, estimated wait times…
ESPHome ESP32 Coredump Debugging
Guide for enabling and analyzing coredumps in ESPHome ESP32 projects to debug crashes with detailed stack traces and partition configuration.
Adtran Fiber ISP Hacking
Comprehensive security audit of Adtran 411 fiber ONT revealing UART access, filesystem extraction, and multiple security vulnerabilities.
Day Night Map
A real-time visualization of day and night regions across the world using accurate solar and lunar positioning calculations. The project renders day/night terminator lines, solar and lunar positions, and smooth twilight gradients on an interactive world map using HTML5 Canvas. The visualization integrates the SunCalc library for astronomical calculations and features optimized pixel-level…
VLAN Scout
VLAN Scout discovers active VLANs and their configurations through passive monitoring and active probing. The tool identifies VLAN segments by analyzing network traffic and attempting connections across different VLAN IDs. The implementation supports multiple discovery protocols including DHCP, IPv6 neighbor discovery, LLDP, and CDP. VLAN Scout can operate in both passive monitoring mode to…
Bambu P1S Hacking
Bambu P1S Hacking contains firmware dumps, PCB analysis, and X-ray scans of the Bambu Labs P1S 3D printer’s ESP32-S3 controller board. The repository documents reverse engineering efforts to understand the printer’s firmware architecture and hardware implementation. The collection includes multiple firmware dumps processed through bin-voter to generate corrected flash images, detailed…
Bin Voter
Bin Voter reconstructs correct binary files from multiple corrupted firmware dumps by implementing a voting algorithm across byte positions. The tool compares corresponding bytes from multiple binary files and selects the most frequently occurring value at each position. This Python utility is designed for firmware recovery scenarios where multiple partial or corrupted dumps are available but no…
DPRK.team
DPRK.team is a satirical website that parodies authoritarian cybersecurity organizations through the fictional “Glorious People’s Cybersecurity Directorate.” The site presents cybersecurity services using exaggerated revolutionary rhetoric and propaganda-style messaging that mimics state-controlled digital security agencies. The project serves as a humorous commentary on…
SOCAT and WireGuard: a perfect pair for DPI Bypass
Advanced networking technique using SNI domain fronting and socat to tunnel WireGuard VPN traffic over TLS for bypassing network restrictions.
Converting Sunbeam Heated Mattress Pad to ESPHome
Hardware modification guide for replacing Tuya WiFi module with ESPHome-powered ESP-12 chip in Sunbeam heated mattress pad controller.
GPM2Spotify History
GPM2Spotify History converts Google Play Music listening history data to Spotify-compatible JSON format. The Python scripts process HTML activity files exported from Google Play Music and generate structured JSON data that can be used with modern music tracking and analysis tools. The conversion tool helps users migrate their historical listening data from the discontinued Google Play Music…
Influencing Linux IP Source Address Selection
Technical guide explaining RFC 6724 source address selection mechanisms in Linux and methods for influencing IP address selection behavior.
Scroller
Scroller is a web application that displays customizable scrolling text messages in fullscreen mode. The single-page application allows users to configure text content, fonts, colors, scroll speed, and background themes before launching a fullscreen display. The application includes URL hash-based message saving, automatic text scaling to fit screens, and responsive design with light/dark mode…
Caddy Signal Proxy
Caddy Signal Proxy implements a Signal TLS proxy using the Caddy web server and the caddy-l4 plugin. The configuration enables Signal messaging clients to connect through a TLS proxy for improved privacy or to bypass network restrictions. The deployment uses Docker Compose with a minimal configuration that can be integrated into existing Caddy setups. The proxy handles TLS termination and…
Creating a Mikrotik BGP.Tools Session
Step-by-step guide for configuring BGP.Tools peering sessions on Mikrotik RouterOS 7 for network routing analysis and mapping.
Portquiz
Portquiz tests outbound TCP and UDP connectivity to remote hosts by attempting connections across specified port ranges. The tool identifies which ports can successfully establish connections through network infrastructure such as firewalls, NAT devices, and proxies. The program can detect deep packet inspection (DPI) filtering and other network-level blocking mechanisms. It supports testing…
Caddy Dynamic RemoteIP
Caddy Dynamic RemoteIP is a Caddy web server module that provides dynamic IP address matching capabilities. The module implements the http.matchers.dynamic_remote_ip matcher, which allows matching requests based on remote IP addresses that are dynamically sourced from configurable modules. Unlike static IP matching, this module enables real-time IP range updates through pluggable IPRangeSource…
TOOR.sh
TOOR.sh is a cloud and VM hosting service operated by ToorCon, a 501c3 non-profit organization that provides free hosting resources for security research and public benefit projects. The service includes dedicated servers for VMs, storage, and databases, along with their own ISP infrastructure (AS22296). The platform offers various free tools including IP address lookup services, network speed…
WebSerial Bruteforce
WebSerial Bruteforce automatically determines the correct baud rate for UART serial devices by testing common communication speeds and analyzing the returned data. The web application uses the WebSerial API to connect directly to serial devices from the browser without requiring additional software. The tool iterates through standard baud rates and measures the amount of ASCII data returned at…
USB Meter
USB Meter is a web application that connects to Atorch power meters via WebBluetooth to log and display electrical measurements. The application reads real-time data including voltage, current, power, energy, capacity, resistance, and temperature from compatible Atorch USB power meters. The web interface provides data logging capabilities with the ability to reset, pause, and save measurement…
OpenWrt Tailscale Repository
An opkg repository that builds Tailscale combined packages for OpenWrt devices, specifically providing a backport of Tailscale for OpenWrt 19.07. The project addresses the lack of official Tailscale packages for older OpenWrt versions by providing a flexible build system that generates installable packages across multiple hardware architectures. The repository includes automated build scripts that…
Mag Encode
Mag Encode is a web-based magnetic stripe card encoder that generates audio signals for encoding data onto magnetic stripe cards. The application runs entirely in the browser, processing encoding operations client-side without transmitting data to external servers. The tool supports configurable encoding parameters including frequency settings, reverse swipe options, and various advanced…
Broken DNS
Broken DNS performs lame delegation checking at scale to identify DNS nameserver configuration issues. The tool validates DNS delegation by checking if nameservers properly respond to queries for zones they are supposed to be authoritative for. The Go implementation can process large numbers of domains and nameservers to detect misconfigurations where nameservers are listed in delegation records…
Minimalin Reborn
Minimalin Reborn is a minimalistic watchface for Pebble smartwatches, featuring a clean design with customizable colors and optional information displays. The watchface uses a custom font called Nupe and provides configurable elements including weather data and step tracking integration. This project is a fork and modernization of the original minimalin watchface, updated to work with current…
Remove SNAP from Ubuntu
Step-by-step guide for completely removing Snapcraft containerized applications and the snap daemon from Ubuntu installations.
Homeplate
Homeplate is an ESP32-based e-ink dashboard that displays data from Trmnl and Home Assistant on an Inkplate 10 device. The firmware fetches and renders various dashboard widgets including sensor readings, WiFi QR codes, and system status information. The implementation uses FreeRTOS on ESP32 to manage display updates, network connectivity, and power management for the e-ink display. It supports…
ESPHome Components
ESPHome Components is a collection of custom components that extend ESPHome functionality for ESP8266 and ESP32 microcontrollers. The repository contains C++ implementations of additional sensors, displays, and device integrations not available in the core ESPHome distribution. The components follow ESPHome’s standard architecture and configuration patterns, allowing them to be easily…
DNS2mDNS
DNS2mDNS bridges traditional DNS queries with multicast DNS (mDNS) resolution for .local hostnames. The service allows devices that don’t natively support mDNS, such as many Android devices and Windows systems, to resolve local network hostnames through standard DNS queries. The Go implementation acts as a DNS server that intercepts queries for .local domains and forwards them to the mDNS…
Sena WiFi Adapter Security Assessment & Vulnerabilities
Security analysis and vulnerability assessment of the Sena 50R WiFi adapter, revealing multiple exploitable flaws including command injection and root shell access.
Luxer One
Luxer One is a Python API client for the Luxer One Residential package management system. The library provides programmatic access to check package delivery status, retrieve pending packages, and interact with smart locker systems commonly found in apartment complexes and residential buildings. The client handles authentication with the Luxer One API and includes example code demonstrating basic…
Programming Bare ESP-WROOM-02
Hardware tutorial for programming bare ESP-WROOM-02 chips using UART connections and Arduino IDE without development boards.
Extsort
Extsort is a Go library that implements external sorting algorithms for datasets larger than available memory. The library manages temporary files and memory buffers to sort data that cannot fit entirely in RAM. The implementation uses merge sort with configurable buffer sizes and temporary file management. It provides a standard Go interface for sorting operations while automatically handling the…
Allxfr
Allxfr performs DNS zone transfers (AXFR) against nameservers to retrieve complete zone files. The tool systematically attempts zone transfers against root zone servers and other configured nameservers to discover available zone data. The program supports both IPv4 and IPv6 connections and includes options for parallel transfers, dry-run operations, and zone file storage. It implements the DNS…
Minimalin Watch Face
Minimalin Watch Face is a minimalistic Wear OS watch face featuring clean typography and Material Design aesthetics. The watch face displays time with customizable complications and supports ambient mode for always-on displays with reduced power consumption. Inspired by the original Pebble Minimalin watch face , this Wear OS implementation includes configurable color themes, center complications…
Xiaomi M365 Scooter Authentication Bypass
Security analysis of Xiaomi M365 electric scooter revealing authentication bypass vulnerabilities in the Bluetooth communication protocol.
M365 Toolbox
M365 Toolbox demonstrates a security vulnerability in the Xiaomi M365 electric scooter’s communication protocol. The Java application exploits weaknesses in the scooter’s Bluetooth Low Energy (BLE) authentication mechanism to bypass security controls and execute unauthorized commands. The proof-of-concept tool reveals how the scooter’s authentication can be circumvented through…
Stargate
A Go library and SOCKS5 proxy server that enables egress traffic from multiple IP addresses within a subnet. Stargate randomly distributes network connections across different IP addresses to avoid rate-limiting and provide load balancing across available IP ranges. The tool works best with subnets directly routed to the host and is particularly powerful for IPv6 subnet utilization. It supports…
Binary Analog Watch Face
Binary Analog Watch Face is an Android Wear watch face that combines analog time display with binary representation. The watch face uses binary digits to form the hour and minute hands, creating a unique visualization where time is displayed both analogically and in binary format. The watch face features Material Design aesthetics with customizable color themes and optional center complications.…
BygoneSSL - dealing with residual certificates for pre-owned domains
Security research on SSL certificate vulnerabilities where valid certificates outlive domain ownership, creating potential attack vectors for domain re-registration.
CZDS
CZDS is a Go library and CLI tool for interacting with ICANN’s Centralized Zone Data Service API. It handles authentication, zone file downloads, request submissions, and status monitoring for accessing top-level domain zone data. The implementation supports parallel downloads, request management, and provides both library interfaces for Go applications and standalone command-line…