Apple’s iPhone 18 Pro adds a variable-aperture camera, A20 Pro chip, Siri AI and longer battery life. Here’s what buyers need to know before upgrading.
Apple’s iPhone 18 Pro adds a variable-aperture camera, A20 Pro chip, Siri AI and longer battery life. Here’s what buyers need to know before upgrading.
Explore the Honor Robot Phone’s 200MP gimbal camera, flagship specs, China pricing, key trade-offs, and whether this experimental phone is worth buying.
Explore the Honor Robot Phone’s 200MP gimbal camera, flagship specs, China pricing, key trade-offs, and whether this experimental phone is worth buying.
We recently updated our article on ShadowBroker, which a lot of you liked. The latest release brought some new features and made the dashboard even richer.
But ShadowBroker is resource intensive and might need you to allocate a good chunk of resources to your VM, which not all systems have. Instead, there’s Osiris and it can do similar things without any installation. You can run it in the browser or host it on your Kali. Both versions are identical.
Osiris
Osiris is a global intelligence dashboard that aggregates live flight tracking, CCTV, earthquake monitoring, conflict zone mapping and 24/7 news feeds. It’s made to give you situational awareness across multiple intelligence domains. The tool was built with Next.js 16 and MapLibre GL and every data point is rendered via WebGL for 60fps performance even with thousands of concurrent entities on screen.
Dashboard
Let’s start with the live version. It’s available here.
The world looks busy once you enable all the data layers on the left side of the screen.
Camera Feeds
There’s a huge number of cameras available around the world that are free to access. They are usually scattered across different websites and don’t look nearly as good as they do on a map. The dashboard has integrated a big number of them, marked with green dots on the map.
Here’s a camera in Toronto. Looks empty at 5 am.
Aircraft Tracking
All kinds of aircraft and maritime vehicles can be tracked. Not only that, you can do a deep dive on the intel available for each one. Below you can see we picked a random flight over the UAE and the dashboard pulled up the company it belongs to, Tim Clark who is the CEO and some publicly known information on him.
You can do similar things with other objects on the map.
So if you’re monitoring military activity in a certain region, that can come in handy.
Critical Infrastructure
There are different data assets you can display by clicking the database icon on the right side of the screen. The data is relevant for various places, but mostly for the US.
Above you can see the critical infrastructure in New York (red) and nationwide (yellow).
Conflicts and Dangerous Zones
Wars, tensions and threats are differentiated by color and notes are assigned to each with a severity level.
Market Analysis
When someone loses, someone else wins. Osiris can do some Market AI overview, which you obviously shouldn’t take as legit advice. But you can see it does some basic analysis and warns of potential price spikes.
Satellite Tracking
All kinds of satellites are available on the dashboard and they can also be tracked. Here you can see Starlink flying over the Atlantic and Canada.
Malware Threats
Finally, you can view malware threats and attacks on the map. There was a big node in China linked to a lot of attacks, with more scattered around the rest of the country.
Hosting Locally
Although the live version is stable and its uptime is good, you might still want to run it locally. It’s pretty easy to set up:
kali > sudo apt install npm
kali > git clone https://github.com/simplifaisoul/osiris.git
kali > cd osiris
kali > npm audit fix --force
kali > npm run dev
Then it’ll be available at http://localhost:3000
Summary
As you can see, there are different platforms available for different setups. Having compared the two, ShadowBroker looks richer and more professional, but Osiris hosts a live version you can use without any installation and it already has most of what you’d want to test. The installation itself is quick and easy and the dashboard consumes way fewer resources than ShadowBroker. Test it yourself and see what you like.
You can learn more with us! Get our Cybersecurity Starter Bundle II and unlock WiFi Hacking, Python for Hackers, Radio Basics and other training.
Communities from Lansing, Michigan, to Pflugerville, Texas, are ending their relationship with Flock, largely over concerns regarding out-of-control surveillance, unwanted data sharing, high expenses, and reports of police abusing the tool.
The Pixel 11 may look familiar, but after a week of using it, a few clever features have completely caught me by surprise. Here’s what I’m already loving about Google’s baby Pixel.
Some cameras protect a building, others betray it. Camera hacking isn’t hard, and that’s the problem. These devices are often the most vulnerable in any environment. Once installed, they aren’t maintained until there’s a problem. Many “problems” can go unnoticed if you know how vulnerable cameras are. Hackers can use them for persistence or as an entry point into an organization.
We do have different articles on this topic, but this time there’s something else we want to show. It’s PwnEye.
PwnEye
PwnEye is a newer tool that didn’t get enough attention yet. It works with both ONVIF and RTSP and that’s pretty much all you need. Once it has compromised a camera, it can reboot it, factory reset and open an interactive shell via ONVIF.
You also black out the operator’s view. Just like in movies.
Setting Up
Let’s set up the tool. You’ll need ffmpeg first.
kali > sudo apt install ffmpeg
Then install pipx and grab the tool.
kali > sudo apt install pipx
kali > pipx install git+https://github.com/Hackerest/pwneye.git
Once it’s ready, you can test it:
kali > pwneye -h
The help menu’s large. The tool can be used to find cameras in a local network with –discover, but it can be pointed at any camera IP. That’s where we’ll start.
ONVIF Attacks
ONVIF is the protocol that lets cameras from different manufacturers talk to each other without buying the same product. It’s basically a standard, but it’s also an attack vector.
kali > pwneye -t IP
If the camera’s running default or weak credentials, you get access. The tool extracts everything after compromise. Below you can see the network config, MAC address, DNS entries and configured users. DNS entries may sometimes point to interesting internal servers.
Look at the configured user credentials in the output. You’ll use those to get a shell.
The tool also finds snapshots that the camera captures regularly. You can view them in the browser or wait for PwnEye to open the stream.
Some cameras support deface (black the screen), PTZ movement and factory reset through ONVIF. Not all. Depends on the model.
Finally, once it finishes, you get the stream.
Well, it’s just a bus station. Nothing fancy here.
Defacing Cameras
If the camera supports it, you can deface it.
kali > pwneye -t IP --deface [MESSAGE]
It’s not sophisticated, but it works.
Shell
That’s probably the most interesting part. Take the credentials from the user profile output and get a shell.
kali > pwneye -t IP -ou admin -op ‘’
Once you’re in, run help and see what it has. Some cameras let you do more than others.
RTSP Attacks
ONVIF compromise is worse than RTSP compromise, but RTSP often works when ONVIF doesn’t. The tool tries both by default, but you can skip ONVIF and go straight to RTSP if you want.
kali > pwneye -t IP -so
The tool has more than 450 credentials built in. You can also try common corporate passwords like Company123 or just Company.
Once it gets credentials, you get the stream.
Summary
Some IP cameras might be accessible from the internet and locally. That means compromising them also gives you a foothold on the internal network. They aren’t upgraded regularly and IoT devices in general lack proper software updates. There are dozens of known CVEs on most camera models. Cameras can be used to proxy through them, attack other hosts or maintain persistence.
There are many other attacks on cameras, and it would be a very long article to cover them here. That’s why we created our IP Camera Hacking Training. It’s now part of our Cybersecurity Starter Bundle II. With it you get Wi-Fi Hacking, Python Basics for Hackers, Remaining Anonymous and more.
In the reconnaissance phase of any security engagement, information gathering is crucial. Previously, we discussed using Google Earth Pro for investigations. Today, let’s shift our focus from satellite OSINT to map‑based reconnaissance. Many of you are already familiar with Google Maps and its alternatives, such as OpenStreetMap (OSM). But did you know that you can easily extract specific data from OpenStreetMap, like security cameras or Wi‑Fi hotspots, using a tool called Overpass Turbo?
Let’s explore in this article how to leverage this powerful reconnaissance tool.
Step #1: Understanding Overpass Turbo Basics
Overpass Turbo is accessible at https://overpass-turbo.eu and requires no installation or registration. It provides a web-based interface for querying the Overpass API, which is OpenStreetMap’s data extraction engine.
The interface consists of three main components:
Query Editor (left side): Where you write your queries using the Overpass Query Language (QL)
Interactive Map (right side): Displays your query results geographically
Toolbar (top): Contains the Run button, Wizard, Export options, and settings
When you first access Overpass Turbo, you’ll see a default query loaded in the editor. The map displays the current viewport, which you can pan and zoom to focus on your area of interest.
The Query Wizard
For beginners, the Wizard tool (accessible from the toolbar) provides a simplified interface. You can enter search terms in plain English, and the Wizard converts them into proper Overpass QL syntax. For example:
Type: amenity=atm in London
Click “build and run query”.
The Wizard generates the appropriate query syntax and executes it automatically.
As a result, we can see a map of ATMs in London.
Step #2: Writing Overpass Queries
Overpass Query Language follows a specific structure. Let’s break down the anatomy of our query built by a wizard:
[out:json][timeout:25];
// fetch area “London” to search in
{{geocodeArea:London}}->.searchArea;
// gather results
nwr["amenity"="atm"](area.searchArea);
// print results
out geom;
It already includes comments, but for better understanding, let’s dive a bit deeper.
[out:json][timeout:25] – Sets the output format to JSON and limits the server-side execution time to 25 seconds.
{{geocodeArea:London}}→.searchArea; – A macro that resolves the administrative boundary of London (its OSM relation). The result is stored in a temporary set named .searchArea for later reference.
nwr["amenity"="atm"](area.searchArea); –nwr stands for nodes, ways, and relations.
OpenStreetMap uses three element types: nodes, which represent single-point locations such as cameras or Wi-Fi access points; ways, which represent lines and closed shapes such as roads or building outlines; and relations, which group nodes and ways together to represent features such as building complexes or campuses.
The filter ["amenity"="atm"] selects all OSM elements tagged as ATMs. (area.searchArea) restricts the search to the previously defined London area.
out geom; – Outputs the matching elements, including their full geometry (geom) – points with latitude/longitude, ways with their node lists, and relations with their member geometries.
Tag Filters
The core of your reconnaissance queries are the tag filters. Tags in OSM follow a key=value structure.
you can view a comprehensive list of possible keys and values. From a hacker’s perspective, you can examine the man_made key to discover surveillance‑related options.
Now, let’s edit out query and try to find out surveillance cameras in California.
[out:json][timeout:25];
{{geocodeArea:California}}->.searchArea;
nwr["surveillance"="camera"](area.searchArea);
out geom;
Now, let’s try to find data centers in Moscow.
[out:json][timeout:25];
{{geocodeArea:Moscow}}->.searchArea;
nwr["building"="data_center"](area.searchArea);
out geom;
Summary
OpenStreetMap data helps companies and independent researchers work more efficiently. And Overpass Turbo simplifies tasks such as tracking urban growth and analyzing surveillance patterns. OSINT investigators and cyberwarriors can also use it to extract precise information from OpenStreetMap’s extensive geographic database.
If you’d like to advance in OSINT, consider checking out our OSINT training class.
Login
