I have a lot of appliance manuals that I've collected over the years. They rarely need looking at, but when they do, finding the right manual can be a chore. I decided to stick NFC tags to my appliances so that I could access their manuals more easily.
Motion sensors are popular smart home devices. They're relatively cheap and simple to set up, but often people only use them for basic automations such as turning on the lights when you walk into a room. With the right automations, there's a lot more you can do using motion sensors.
Overpriced home appliances with lackluster smarts are a pet peeve of mine. Iβd never upgrade a perfectly functioning fridge or dishwasher just to get access to half-baked smart features, and Iβd choose value or performance over features I donβt need, or that might backfire on me down the line.
OpenAIβs GPT-6.1 Terra cuts standard API token prices by 50%. Explore its automation capabilities, availability and what IT teams should test before adoption.
OpenAIβs GPT-6.1 Terra cuts standard API token prices by 50%. Explore its automation capabilities, availability and what IT teams should test before adoption.
Weβre continuing our series on Artificial Intelligence in Cybersecurity with another tool called Shannon. Shannon is a white-box AI pentester. It was created to test the security of your project by pointing it at the source code and the test stand. That means it needs both the running application and the source code. First, Shannon does an in-depth analysis of the code in the repository, then looks for attacks against that same project youβre hosting locally. This white-box approach is certainly more effective, as models donβt have to guess possible vulnerabilities, since guessing varies greatly depending on the model you use. Vulnerabilities can only make their way to the report if they have a working PoC. As always, only test systems you own or have explicit written authorization to test.
Now letβs take a closer look at Shannon and test our Juice Shop with it.
Setting Up
Juice Shop is just a Docker container, so we will install Docker and npm first.
kali > sudo apt update
kali > sudo apt install -y docker.io nodejs npm
kali > sudo systemctl enable docker --now
kali > sudo usermod -aG docker $USER
kali > newgrp docker
Then comes the Juice Shop.
kali > docker pull bkimminich/juice-shop
kali > docker run -d --name juice-shop --restart unless-stopped -p 3000:3000 bkimminich/juice-shop
Itβs up and running. Now we need to copy the repository to our disk.
kali > git clone --depth 1 https://github.com/juice-shop/juice-shop.git
Once we have it all set, we can get Shannon. Unlike Pentestcode and other tools, Shannon runs differently. By default, it expects your AI API keys in the env. In the next sections weβll show how to run Shannon with OpenRouter and Ollama.
OpenRouter
Shannon wants to see your API key in the env. You will also need a models.json file somewhere on your disk. Copy the following command to create it.
This will take a while and your free daily tokens wonβt be enough to complete the scan.
As the security test progresses, youβll see all the commands and prompts it runs. Obviously, the frontier models will give better results.
Ollama
Shannon isnβt only limited to APIs. You can perform the same scan with a local model. Many openweight models will be a great fit for it if you have the necessary hardware to make it work smoothly.
Just for the demonstration weβll use Qwen 2.5-coder 7b.
kali > curl -fsSL https://ollama.com/install.sh | sh
kali > ollama pull qwen2.5-coder:7b
Weβll create the same models.json file to point Shannon to our Ollama.
Make sure your Ollama is accessible, and change the IP address if needed.
kali > export SHANNON_AI_API_KEY=ollama
kali > export SHANNON_AI_MODEL=ollama:qwen2.5-coder:7b
kali > npx @keygraph/shannon@latest start -u http://172.17.0.1:3000 -r /home/kali/juice-shop -c ~/juice-quick.yaml --models-config ~/models.json --validate-model
Before we do anything, letβs validate the model.
If your model has been validated and you can start scanning your project.
kali > kali > npx @keygraph/shannon@latest start -u http://172.17.0.1:3000 -r /home/kali/juice-shop -c ~/juice-quick.yaml --models-config ~/models.json --follow
Reporting
When the scan finishes, Shannon creates PDF and Markdown reports with the evidence attached to them. You will also see structured JSON and SARIF files for downstream systems.
Below is an example of a PDF report. As you can see, multiple vulnerabilities were found in the project, some of them are classified as High. As mentioned before, all the findings here were validated with PoCs.
Summary
Shannon was made to find flaws in your web apps to make them more secure. It digs through the project repository and runs checks against a live system. It then creates a report with findings that were discovered with PoCs, so you get a clean report. As AI becomes more prevalent in cybersecurity, it should be used to improve the security of your projects before their release. Of course, that doesnβt replace a human in the loop, but it makes things faster. Stick to better models and donβt cut back on your security.
AI is evolving rapidly and the sooner you learn how to work with it, the greater the advantage youβll have. Thatβs why we invite you to join ourΒ AI for CybersecurityΒ training. During this training, you will see you different ways of using AI in cybersecurity, set up local models and solve labs.
I don't know about you, but I have more bills, invoices, bank statements, and healthcare documents than I know what to do with. Finding a specific detail, understanding a complicated term, or comparing this month's charges with last month's can take up more time than I'd like, not to mention the frustration involved. Tools like ChatGPT and Claude can make this much easier, but I'm not particularly comfortable with the idea of handing my financial, medical, or other sensitive information over to big tech companies just to get a few questions answered. I have enough concerns about how much data these companies collect without voluntarily giving them more.
Barclays plans 5,000 job cuts in 2026 as AI and restructuring improve efficiency. Learn what the changes mean for developers, IT staffing, and budgets.
Barclays plans 5,000 job cuts in 2026 as AI and restructuring improve efficiency. Learn what the changes mean for developers, IT staffing, and budgets.
The number of features packed into Home Assistant is insane. The problem is that there are so many features that it can be easy to overlook some of the best ones. I slept on some of Home Assistant's features for far too long; here are some more of the best features that I wish I'd started using much sooner.
βCHRA will make a mistake β¦ We'll fix them,β CHRA Director Karen Pane said. βIn order to be creative, you sometimes have to have the possibility of failing.β
I loved my first Walkman to the point where I used it until it fell apart, but my favorite music player was still my iPod. There was nothing quite like flipping through the albums in the Cover Flow view by spinning my thumb around the click wheel. When I found an old remote that had its own wheel-style input, I wondered if I could bring those days back.
NFC tags are really useful for triggering smart home automations. They're cheap to buy, they don't need batteries or to be connected to power, and you can stick them almost anywhere. I wondered if it would be possible to use my expired credit cards as NFC tags, and it turned out that they can be even more useful than the standard stickers.