argus
anti-surveillance firmware for the LILYGO T-Watch Ultra. tracker and rogue-AP detection, threat radar tail scoring, wardriving, Meshtastic, NFC, phone notifications. it notices when something follows you home.
MIT fork of r3dfish.
SOURCEyour pdf scrubber is lying to you. so is your router, your printer, and the camera on that pole. i write the tools that prove it.
the first contact on the scope is the one reading it.
anti-surveillance firmware for the LILYGO T-Watch Ultra. tracker and rogue-AP detection, threat radar tail scoring, wardriving, Meshtastic, NFC, phone notifications. it notices when something follows you home.
strips metadata from 71 file formats, then proves it by searching the output bytes. your PDF scrubber is probably lying to you.
a virtual pet for ESP32 boards that grows up by doing real Wi-Fi and BLE recon. firmware for eight boards, a desktop simulator, and a browser flasher. it evolves by noticing what is around it.
browser-based flasher for HexHound. pick your ESP32 board, plug it in, flash from Chrome or Edge. no toolchain, no driver hunt.
bulk-shrink a folder of video into a phone-sized, properly named, browsable library. built to carry DEF CON 34 home: 105 GB of talks in, under 20 GB out.
notes from taking the Skuld stealer apart.
a REST API built to be broken, carrying the OWASP top ten on purpose. practice on something that is supposed to bleed.
passive scan only. nothing transmitted, nothing stored. what your browser said about you is on your screen and nowhere else.
h4d35x0. i write the tools. you are the other contact on the scope.
metascrub
strips metadata from 71 file formats, then proves it by searching the output bytes. your PDF scrubber is probably lying to you.
hexhound
a virtual pet for ESP32 boards that grows up by doing real Wi-Fi and BLE recon. firmware for eight boards, a desktop simulator, and a browser flasher. it evolves by noticing what is around it.
hexhound-flasher
browser-based flasher for HexHound. pick your ESP32 board, plug it in, flash from Chrome or Edge. no toolchain, no driver hunt.
shrinkray
bulk-shrink a folder of video into a phone-sized, properly named, browsable library. built to carry DEF CON 34 home: 105 GB of talks in, under 20 GB out.
skuld-stealer-analysis
notes from taking the Skuld stealer apart.
VAmPI
a REST API built to be broken, carrying the OWASP top ten on purpose. practice on something that is supposed to bleed.
Fork of OWASP-CTF/VAmPI.
SOURCECHALLENGES
real files, real formats. the answer is in the file, not in this page. you are welcome to read this page anyway.
c1 your pdf was lying
the file says it was cleaned. was it?
HINT 1
the file says it was cleaned. verify that. do not trust the label.
HINT 2
one metadata surface is not the only metadata surface. think xmp, think thumbnails, think the version before this one.
HINT 3
exiftool reads the newest trailer and warns about the dictionary it ignored. an older trailer, one /Prev back, still points at the original info dictionary. its /Subject is a hex string: utf-16, big-endian, byte order mark first.
read only. nothing written to the original, nothing transmitted.
c2 find the watcher
a walk home, three stops, beacons only. one of these followed me. so did h4d35x0-phone, but that one is mine. flag: h4d35x0{<its bssid, no colons>_<the value in its vendor specific element>}, lowercase hex.
HINT 1
watchers repeat. a network at the coffee shop is scenery. a network at the coffee shop, the bus stop and your front door is company.
HINT 2
sort by bssid, not by name. a hidden ssid and a randomised mac hide who it is, not that it keeps showing up. check the channel column while you are there.
HINT 3
wireshark: wlan.fc.type_subtype == 8, then statistics > conversations or endpoints on wlan. you want the bssid present in all three time windows that is not your own phone. its vendor specific element (tag 221) carries the second half.
passive capture, beacons only. nothing transmitted, nothing joined.
c3 read only, nothing written
a badge, read once with a flipper and put back. the file is the dump. most of it opened with the key printed on every blank card. one sector did not, and it matters.
HINT 1
the file is plain text. sixty-four blocks, sixteen bytes each, four blocks to a sector.
HINT 2
the last block of every sector is not data: key a (6 bytes), access bits (4), key b (6). find the sector whose keys are not ff ff ff ff ff ff.
HINT 3
sector 4's three data blocks are the flag xored with sector 4's own key a, repeated. the key was in the dump the whole time.
read only, nothing written, nothing emulated.
c4 prove it was me
three signed notes and a keyring, found together. every one of them says it is from me, and gpg agrees with all three. only one was signed by the key on the keys page.
HINT 1
a good signature proves a key signed it. it does not prove whose key that was.
HINT 2
import found-keys.asc into a fresh keyring and verify each note. then read the fingerprint gpg printed, not the name.
HINT 3
the real fingerprint ends 05C8 7735, and the keys page tells you to check it against a second source. hex-decode the payload of the one note that matches.
verified, not trusted.
c5 in plain sight
the print line, on black, the way it sits on the shirt. the file says nothing is hidden in it. the file would say that.
HINT 1
the pixels you can see are not the only pixels. look at the bits nobody looks at.
HINT 2
one bit plane at a time, one colour channel at a time. the first thing you find is not the last thing there.
HINT 3
least significant bit of the blue channel, row by row from the top left, most significant bit of each byte first. zsteg calls it b1,b,msb,xy.
nothing hidden that a histogram could not find.