Welcome back, aspiring cyberwarriors!

Lately, we’ve covered several tools you can use with your laptop to track nearby devices and people. While they’re useful, their effectiveness depends on the strength of your Bluetooth adapter, and, of course, you need to have your laptop with you.

This time, we’re doing things differently. We want to show you a device that can automatically monitor nearby devices for extended periods, anywhere you choose to place it, and as often as you want. It doesn’t rely solely on Bluetooth, as it also uses Wi-Fi, which is far more likely to be enabled, increasing the chances of detecting someone in your area.

What is Paxcounter

Paxcounter is an open-source firmware project that takes a cheap little ESP32 development board and turns it into a sensor that can count people. Almost every smartphone in the world is constantly sending out small Wi-Fi signals, called probe requests, and Bluetooth signals too, even when the phone is not connected to anything. Paxcounter listens for these signals in the air. It counts how many different devices it hears during each scan, and from that, it can tell you a real time estimate of how many people are nearby.

The project started out as a simple way to measure how many passengers or pedestrians pass through a certain spot. But over time, it grew into something much bigger. Now it works as a general purpose IoT platform, built on hardware that usually costs somewhere between $10 and $30. Besides its main job of counting Wi-Fi and Bluetooth devices, a Paxcounter can also read environmental sensors, track its GPS position, keep accurate time, and send all of that data out through LoRaWAN, MQTT, a local serial connection, or straight onto an SD card. 

How the Counting Works

The way Paxcounter counts people is simple, but it was clearly built with privacy in mind from the very start. Every scan cycle, which lasts 60 seconds by default, the device switches its Wi-Fi and Bluetooth radios into scanning mode and listens for probe requests and advertisement packets coming from nearby devices. Each of these packets carries a MAC address. Paxcounter takes just the last two bytes of that address and turns them into a short, temporary ID. This ID is only used to check for duplicates during that one scan cycle. Once the cycle ends, the count of unique IDs gets sent out, and the whole list is wiped from memory. The firmware also does not try to fingerprint any device. It never tries to figure out a phone’s brand, its operating system, or who owns it. All it wants to know is whether that device has already been counted in the current window.

This scan and clear cycle just keeps repeating, either nonstop or on a schedule if deep sleep power saving is turned on. The results, which include the Wi-Fi count, the Bluetooth count, and sometimes live sensor readings too, get packed into a small payload and sent out through whatever channel the device is set up to use. One thing worth knowing is that Wi-Fi and Bluetooth scanning actually share the same 2.4 GHz radio hardware on the ESP32. So running both scans at the same time slightly lowers the accuracy of each one. Because of that, the project’s own advice is to split Wi-Fi only counting and Bluetooth only counting across two separate devices whenever the best possible accuracy is needed for both.

One Firmware, Many Boards

Paxcounter comes with a hardware abstraction layer and its own pin mapping files for dozens of ESP32 and ESP32-S3 boards. These come from well known manufacturers like LILYGO and TTGO, Heltec, Pycom, WeMos, M5Stack, and Adafruit, and there is also a generic template ready for boards that are not officially supported yet. LILYGO even sells a ready-made board called Paxcounter LoRa, built specifically to run this firmware. 

Depending on which board you pick, your device can end up supporting a LoRaWAN radio for sending data over long distances while using very little power, an OLED status screen, or a single color, RGB, or larger LED matrix light to show status. It can also support a physical button for flipping through display pages or sending an alarm message, battery voltage monitoring, GPS positioning, a real time clock chip along with IF482 or DCF77 time telegram output, and even an SD card slot for logging data locally when there is no network around.

Because the whole system was designed to be truly portable, the documentation goes into real detail about power draw, which usually sits somewhere between 450 and 1000 milliwatts depending on how the device is set up. It also makes good use of the ESP32’s deep sleep mode, so a device can keep running for a long stretch of time on just one 18650 lithium ion battery cell. Members of the community have already shared several 3D printable enclosure designs on Thingiverse for the more popular boards.

Getting the Device Up and Running

Paxcounter is built using PlatformIO instead of the plain Arduino IDE. This choice lets it work smoothly with editors like Visual Studio Code, Atom, or Eclipse, and it gives the project reproducible, script driven builds. In fact, the repository runs an automated PlatformIO build check every single time the code changes, using GitHub Actions, and there is even a CodeFactor badge that keeps an eye on ongoing code quality.

The configuration is intentionally spread across a handful of different files instead of being crammed into just one. This keeps board specific settings, behavioral settings, and personal settings nicely separated from each other. The platformio.ini file is where you select which board’s hardware profile you want to compile against. The paxcounter.conf file handles behavioral settings, things like how long a scan cycle lasts, sleep timing, and payload options. The shared lmic_config.h file sets the LoRaWAN region and frequency plan, so it matches the rules where you live. The shared loraconf.h file holds the device’s LoRaWAN join credentials, and the project recommends using OTAA rather than ABP for this. And the shared ota.conf file stores the Wi-Fi credentials the device uses for over the air firmware updates.

You can upload firmware the traditional way, over USB, or once a device has joined a LoRaWAN network, you can push updates over the air instead. A remote command tells the board to connect to Wi-Fi, check a hosted repository called PAX.express for a newer build, and then download and flash it automatically. If anything goes wrong during that process, it will roll back to the previous version on its own. Devices can also be set up to open a small local web based bootstrap menu right when they power on, which lets you upload a firmware file manually, even from a phone in tethering mode, without needing PlatformIO installed on site.

Configuration and Extensibility

Beyond just picking a board, Paxcounter gives you a long list of settings you can tune to fit your needs. It can log environmental data from sensors like the Bosch BMP180, BME280, BMP280, or BME680, read a Nova SDS011 particulate matter sensor to track dust in the air, and keep accurate time using either a DS3231 real time clock or a connected GPS module. 

Display and LED

On boards that come with an OLED display, Paxcounter shows live status information you can cycle through with a short press of the button. This includes the current pax count, meaning the people count, a histogram of recent activity, GPS status, environmental sensor readings, and the time of day. 

A long press of that same button sends an alarm message out over the network instead, which is a simple way to flag a problem from out in the field without needing any other kind of interface. Even on boards that do not have a display at all, a status LED still tells you what the device is doing through its blink pattern. You get a brief flash whenever a new Wi-Fi or Bluetooth device is spotted, a quick blink while the device is joining the LoRaWAN network, a short blink during data transmission, and a slow, long blink if there is a LoRaWAN stack error. Boards that have an RGB LED get a color coded version of these same signals.

How You Receive the Data

Once a Paxcounter has counted the people nearby and packed everything into a message, that data has to go somewhere so you can actually see it. How that happens depends on which output the device is using, and the good news is you can turn on more than one at the same time. If you are using LoRaWAN, which is the most common setup, the device does not send the data straight to you. Instead, a nearby LoRaWAN gateway picks up the signal first and forwards it on to a network server, usually The Things Stack. There is a small decoder script included with the project, and its job is to take that raw message and turn it into numbers you can actually read, something like a pax count of 14. From there, The Things Stack can pass the data along to your own app or dashboard using MQTT or a webhook, or you can simply watch it come in live through the built in console.

If a board does not have LoRa hardware built in, it can just skip the gateway completely and send that same kind of data straight to an MQTT service over Wi-Fi instead. You can also connect the device to a computer using a USB cable and read the numbers directly from a serial connection. This is a simple way to test things out without needing to set up a network at all. If SD card logging is turned on, everything also gets saved locally as a CSV file, so you can pull the card out later and open it up in a spreadsheet. This comes in handy in places where there is no network coverage to rely on. 

Where It’s Used

Because a single Paxcounter device is cheap to build and can be left running unattended for a long time, you will find it popping up in a pretty wide range of places. Retailers and shopping centers use it to measure foot traffic without needing to install cameras. Event organizers use it to watch how crowds move around a venue in real time. Pentesters can get a passive read on how many Wi-Fi and Bluetooth devices are active in a building, or to notice unexpected devices showing up where they shouldn’t, all without needing camera access or network credentials.

Legal and Privacy Considerations

Since Paxcounter’s whole job involves listening to wireless traffic, its documentation is unusually upfront about the legal side of things. It points out that sniffing Wi-Fi and Bluetooth MAC addresses may be regulated or restricted depending on where you live, and it links to specific starting references for the US, the UK, the Netherlands and the EU, and Germany. It also makes clear that the legal responsibility for how a device is built and deployed falls on the person doing it, especially for public deployments where the results might get published somewhere. On the technical side of privacy, the project’s own design actually holds up pretty well against that legal backdrop. Identifiers are only ever built from the last two bytes of a scanned MAC address, they are kept in memory just for the length of one scan cycle, and then they are discarded completely. No MAC addresses or identifiers are ever sent out over the network, and the firmware does not do any extra tracking or fingerprinting of the devices it scans.

Summary

What really makes Paxcounter stand out is not any single feature on its own. It is the whole combination working together. One piece of open source firmware supports dozens of cheap boards, runs for a long time on a small battery, counts people without saving anything identifying about them, doubles as a general environmental sensor node, speaks LoRaWAN, MQTT, serial, and SD card all at once, and can be fully reconfigured from a distance once it is out in the field. The full source code, the complete board list, and all the documentation are available on GitHub.

If you enjoy experimenting with frequencies and trying new things, we recommend signing up for our SDR for Hackers training. With Master OTW, you’ll learn how to use your computer and inexpensive SDR hardware to explore and hack a wide range of radio signals.

The post SDR (Signals Intelligence) for Hackers: Tracking People with ESP32-Paxcounter first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Think back to the first time you installed Kali Linux. It was probably one of those moments where you realized just how many cybersecurity tools existed. Your applications menu was packed with hundreds of tools covering everything from recon and vulnerability scanning to exploitation, password attacks, wireless security and much more.

At first, it was exciting. But most beginners spend hours clicking through the menus wondering what every tool does and when they should actually use it. Unfortunately, the sheer number of applications quickly becomes overwhelming. Even if you dedicate time to learning them, chances are you’ll forget many of their names simply because there are so many available. On top of that, documentation isn’t always beginner-friendly. Some projects have excellent documentation, while others assume you already know exactly what the tool is supposed to do before you even start reading.

The good news is that you don’t have to memorize hundreds of commands or remember every tool available. Instead, you can build your own arsenal of references that helps you quickly find the right tool.

In this article, we’re going to build exactly that. We’ll explore two resources called Arsenal-NG and Arsenal, both of which are designed to make finding offensive security tools, payloads, commands much faster.

Arsenal-NG

The first tool we’ll look at is Arsenal-NG. The name pretty much explains what it does. Arsenal-NG is essentially a searchable collection of offensive security tools, commands, and predefined workflows. Whether you’re doing reconnaissance, exploiting a service, generating payloads, Arsenal-NG can help you find the right tool for the job.

Let’s install it.

kali > git clone https://github.com/halilkirazkaya/arsenal-ng.git
kali > cd arsenal-ng
kali > make build

Once compilation finishes, you can launch the program directly. For convenience, you may also want to move the binary into one of the directories listed in your PATH environment variable. Doing so allows you to start Arsenal-NG from any directory. 

kali > arsenal-ng

When it starts, you’ll immediately notice a large collection of tools organized inside the interface. Each tool includes predefined presets for different kinds of operations. 

To display the complete list of available tools, simply run tools

If you already know what kind of task you’re trying to accomplish but don’t remember what tool can do it, you can use the built-in search feature. Searching by keywords makes it easy to discover them.

Once you’ve found the tool you need, selecting one of its presets walks you through the required parameters. There you simply provide the requested information and let it generate the command for you.

If you need additional information about the application itself, run help.

Arsenal

Unlike Arsenal-NG, Arsenal focuses primarily on web exploitation and can be used directly from your browser. There is no installation process, making it convenient when you simply need a quick reference.

You can access it here.

One thing worth mentioning is that the website supports multiple languages. If the interface isn’t already in English, simply switch the language using the selector in the upper-right corner. Once inside, you’ll notice that the content is organized into several different sections, each designed to help with a different phase of a web penetration test.

One of them is Payloads.

This area contains a huge collection of payloads covering many different types of web vulnerabilities and exploitation techniques. Whether you’re working with command injection, SQL injection, XSS, SSTI, XXE, deserialization, or other common web vulnerabilities, chances are you’ll find useful examples here.

Another valuable section is Attack Chains.

Rather than simply providing payloads, Attack Chains guide you through the overall exploitation process. They outline the sequence of steps typically required to compromise a target.

The Commands section is another good reference.

You can build the command you need by selecting the appropriate options.

Then we have Wordlists.

There are numerous wordlists organized into logical categories, making it much easier to find exactly what you’re looking for. Each category often contains several different wordlists optimized for different situations. 

You’ll also find a large collection of Scripts.

These scripts cover a wide variety of purposes, including reconnaissance, AI-related security checks, subdomain takeovers, automation and more.

Of course, we’ve only scratched the surface. Arsenal contains more additional sections that are worth exploring on your own. Spend some time clicking through the different categories and seeing what they have.

Summary

Building your own cybersecurity arsenal isn’t about memorizing every command ever written. In fact, no experienced pentester or hacker remembers every tool, every option or every payload. There are simply too many of them, and new ones are being developed all the time. Arsenal-NG and Arsenal can help you organize knowledge. They are valuable when you’re getting started and they remain just as useful years later when you’re experienced.

Since many of these tools fall into different categories, such as network pentesting, web pentesting, bug bounty hunting, and more, the best way to develop your skills is through our Member Gold subscription. It gives you access to a wide variety of training courses covering different areas.

The post Linux for Hackers: Building Your Tool Arsenal first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Open Source Intelligence, or OSINT, is a powerful yet underrated cybersecurity discipline. A solid reconnaissance phase uncovers vast target information before active probing even begins.

Traditionally, effective OSINT was a painful process. It meant juggling fragmented tools and manually parsing disjointed data to map a target. AI can completely automate this workflow. It calls the right tools in order and explains its analytical reasoning.

This article explores OpenOSINT, an automated intelligence agent built for security researchers. We will install the framework and test its core capabilities using real commands. Let’s get rolling!

What is OpenOSINT?

OpenOSINT is an artificial intelligence assistant designed to automatically gather public information and conduct digital investigations. To interact with OpenOSINT, you can choose from four different methods depending on your comfort level with computers. Beginners will likely prefer the web interface. For those who prefer working with text, the tool offers an interactive terminal. There is also a direct command line interface for running quick commands. Finally, it can act as a background server using MCP that plugs directly into other AI applications, like Claude Desktop.

The way this AI works makes it super reliable and gets rid of that annoying problem of AI making stuff up. When we ask OpenOSINT to do something, it connects to an AI engine. If the AI realizes it needs to look something up, it totally pauses and waits. Your computer then boots into tools, runs the actual program it needs, gathers the right info, and sends that back to the AI. Because the model has to wait for real results instead of just guessing, it can’t fake or invent any findings (or at least will do that less often).

If OSINT is a skill you want to develop seriously, we strongly encourage you to check out the dedicated OSINT series. It covers passive and active reconnaissance techniques, social media intelligence, geolocation, and much more, all taught by practitioners who do this work professionally.

Step 1: Installing OpenOSINT

Let’s clone and install the framework.

kali > git clone https://github.com/OpenOSINT/OpenOSINT.git

kali > cd OpenOSINT

From the observation of the source file, we can confirm that it’s a Python project. Our next step should be the installation of dependencies. Before that, it’s wise to create a dedicated virtual environment.

kali > pip install -e .

The command above uses the -e flag to install the package in editable mode. This means that any changes we make to the source files will be reflected immediately without the need to reinstall the package.

Next, we will install the external dependencies for OpenOSINT. Each dependency supports a specific investigation module, and the framework will still function properly even if some dependencies are missing. Holehe is used for email account enumeration, while Sherlock conducts username enumeration across more than 300 platforms. Sublist3r is utilized for subdomain enumeration. Installation is simple and can be done easily using pip.

kali > pip install holehe

kali > pip install sherlock-project

kali > pip install sublist3r

Another important tool for OpenOSINT is PhoneInfoga. It’s distributed as a standalone binary rather than a Python package, so download the latest release for your architecture from its GitHub releases page.

kali > tar -xzf phoneinfoga_Linux_x86_64.tar.gz

kali > sudo mv phoneinfoga /usr/local/bin/

Step 2: Configuring API Keys

OpenOSINT becomes significantly more effective when supplemented with additional information from external tools like VirusTotal. This integration allows OpenOSINT to gain a clearer understanding of the situation and ultimately make better decisions.

To configure the API keys, we need to open the .env file:

OpenOSINT supports a wide range of services. In this instance, I will specify my Anthropic API, VirusTotal, and Censys.

Step 3: Testing OpenOSINT Web Mode

OpenOSINT offers several ways to use its features. One of them is the AI REPL (Read-Eval-Print Loop), which is a simple, interactive programming environment that accepts user inputs, executes them, and returns the results. Another option is through the web interface, which I will use. There is also a direct tool usage method, but since it does not involve AI, I will not focus on it here, as we can use those tools directly without OpenOSINT.

To start the OpenOSINT web server, use the following command:

kali> openosint web

This command will open a webpage that looks like the one shown below.

Let’s start with a username investigation.

First, the system initiated a broad tool-based check across numerous platforms, returning raw data showing specific profile URLs for the username “tomilov” on sites ranging from Audiojungle and Behance to Codeforces and Discord, indicating presence on creative, social, and gaming platforms.

Finally, it synthesizes these findings into points, such as the subject’s probable Russian origin and their clear professional background. Essentially, the tool executed a digital footprinting task and transformed the results into categorized intelligence.

Next, let’s investigate a domain.

As shown in the screenshot above, the tool initiated its workflow by pulling WHOIS registration data, which fetched the registrar, the creation date from 2009, and the owning organization, LLC KUPISHUZ. At the same time, it performed a subdomain enumeration scan to map out associated hosts and queried VirusTotal to check the domain’s reputation against multiple security vendors.

The system then processed this raw data into a structured intelligence report. It verified that the domain possesses a long-standing, 14-plus year history with no malicious detections on VirusTotal. It also classified the discovered subdomains into operational roles, identifying specific functions such as a main website, a careers portal, internal networking infrastructure, an order tracking portal, and a Single Sign-On authentication platform.

Now, let’s test the email module.

This tool initiated its workflow by running an email enumeration scan using a utility called Holehe, checking the address across 121 websites. This initial check successfully verified active account registrations on Amazon, Flickr, Gravatar, Office365, and Twitter. During this phase, the tool also attempted to query breach data, paste sites, and search engine footprints, but these background tasks failed.

Following the raw scans, the tool generated a series of pre-configured Google dork links targeted at finding the email or username on LinkedIn, Twitter, and Facebook. The system then compiled these results into an Investigation Summary, detailing the discovered platforms and extracting specific metadata, such as the full name and profile URL linked to the target’s Gravatar account.

Finally, the tool outlined a set of next steps for a manual investigator.

Now, let’s run automated open-source intelligence investigation on the specific IP address.

The single successful data extraction came exclusively from the VirusTotal module. This integration successfully returned infrastructure information revealing that the IP address belongs to a network block managed by Senko Digital LLC, which operates as a hosting or virtual private server provider located in Germany. More importantly, the tool retrieved threat assessment telemetry showing that twelve distinct security engines explicitly flagged this specific IP address as malicious, while one categorized it as suspicious, forty-six marked it clean, and thirty-two left it undetected.

Based entirely on this VirusTotal telemetry, the tool synthesized the findings into a security alert status. It concluded that the infrastructure carries a high risk because it is hosted by a VPS provider commonly leveraged for anonymity and possesses a high detection rate across reputable security vendors.

Summary

OSINT remains one of the most high-leverage skills in the cybersecurity field, and tools like OpenOSINT that bring AI-driven automation to the reconnaissance phase will only become more effective and beginner-friendly. If you want to develop your OSINT skills from first principles alongside hands-on tool training, make sure to check out the OSINT Training and join the growing community of intelligence practitioners.

The post Artificial Intelligence (AI) in Cybersecurity, Part 22: Grounding OpenOSINT with Real Tool Execution to Prevent AI Hallucinations first appeared on Hackers Arise.