Recent content on Blog
A while ago, I picked up a Sportstech S-Walk treadmill, a compact walking pad with built-in Bluetooth support. Naturally, I wanted to get more out of it than the default app experience and the default app just sucked big time. So I started digging into the treadmill’s BLE (Bluetooth Low Energy) capabilities to read real-time speed, distance, and workout time. I found myself in FTMS (Fitness…
Jooki was a dream come true for parents—an intuitive, screen-free audio player that let kids enjoy music and stories with the tap of a token. But that dream turned into frustration when the company behind Jooki went bankrupt, leaving countless devices bricked and families frustrated. But what if Jooki isn’t as dead as it seems? This blog post isn’t just about fixing a broken audio player—it’s…
A while ago, I reached out to Mats, the creator behind the YouTube channel Topfvollgold, offering my help with data scraping. I thought it might be useful for his projects and mentioned that I’d be happy to assist if the need ever arose. Recently, Mats reached out with an intriguing request: he needed help scraping data directly from YouTube for an interesting video idea. Naturally, I jumped at…
Close to a year ago, I stumbled upon the Kekz Headphones, which seemed like an interesting approach on the whole digital audio device space. They claimed to work without any internet connection and all of the content already on the headphones itself. They are On-Ear Headphones, which work by placing a small chip (I call them “Kekz” or “Cookie”) into a little nook on the…
I’ve identified a security concern within the self-hosted file sharing tool ProjectSend in the current version r1605. By exploiting a chain of vulnerabilities – including Cross-Site Scripting (XSS), Insecure Direct Object Reference (IDOR), and weaknesses in its change password implementation – an authenticated attacker can force a logged-in user to unknowingly change their account password,…
A couple of months ago, i asked around on Mastodon if anybody was able to provide some HDDs with hardware faults. Clicking, Buzzing, Silent. Whatever. I wanted to learn the art of Head Swapping and other shenanigans. Two weeks later, somebody I know, answered my call into the Fediverse, with a drive i could try to get the data from it. I was delighted and scared. Why scared, you might ask.
The first electronic device which a young child autonomously uses, is most likely an audio device to chose their own music or stories. I am in my mid 30s now and we used cassette tapes, which we were pretty much a common standard back then. Nowadays multiple different licensing methods exists. Tonies, Kekz, Jooki, Coins, you name it. Every company has their own methods and ways to store, encrypt…
From time to time my girlfriend brings electronic children’s toys home which she found in give-away boxes. Most of the time these don’t work and i am intrigued in fixing them. It was a beaten up “Vtech Pinguin Rasselspass”.
tl;dr; My knowledge in Bluetooth LE Communication got quite rusty over time and i wanted to refresh it with an easy target the other day. I wanted to open up the lock with a simple bluetooth command but ended up having access to their entire backend database with a lot of unique users across their entire product lineup. It didn’t go as planned. The Lock and API As all BLE-Locks work, they…
Storyline It all started with a simple question from my beloved girlfriend: “A friend of mine has problems connecting her external harddrive to her PC. She said she transported the USB drive with the cable attached and now the USB Port looks weired. Can you fix it?”. Okok…No Problem. “No Backup, no pity” doesn’t mean “No Backup, no help” and that…
Storyline It all started with a simple question from my beloved girlfriend: “Is it possible to download the entire map from this page?”. Okok…we have to look back a little bit. She was asked by a friend of ours to scan an old map of an area in the local university library. But: Scanning such a massive picture would cost ~40 Euro and nobody was willing to pay that. I can…
I like a good challenge. During some reconnaissance, i found the career challenges of contextis and was kind of drawn into the web application ones. The challenge The challenge itself is a basic PHP Code Review with the following task: You have downloaded a fancy CMS. Can you identify a way to extract the administrator hash? The accepted solution is the payload used to receive the hash. IF YOU…
Ich werde keinen Downloader anbieten, weil mir das Coden dieses zu Muehseelig ist. Das hier ist ein Proof of Concept mit einzelnen Scripten, die fuer sich zum jetzigen Zeitpunkt funktionieren. Vor einiger Zeit hab ich mit dem Online Archiv Douding (http://docin.com) aus China beschaeftigt. Hierbei handelt es sich um eine Moeglichkeit Dokumente online auszutauschen. Man kann sich jedes Dokument…
(Source: https://github.com/nv1t/freeElmo/) Vor ein paar Wochen ist mir eine Document Camera in der Schule aufgefallen. Genauer gesagt handelt es sich im eine L-12 von Elmo. Zu diesem Zeitpunkt wussten wir bloss, dass es keine normale Webcam ist und eigene Software fuer Windows und MacOSX bereitgestellt wurde. Also musste es ein eigenes Protokoll sein. Ich moechte hier nicht so tief reingehen in…
Einleitung: Was ist eine CSRF? HTTP ist im Grunde ein stateless Protokoll. Man stellt eine Anfrage an einen Server und bekommt darauf die Antwort. Der Server schliesst nun die Verbindung und das Spiel beginnt von neuem. Damit der Server weiss wer man ist, muss zwingend eine Art Token mitgeschickt werden. Dies geschieht traditionell mit Cookies. Mit Cookies kann der Server auf dem Client…