⭐ What’s New

• 🔓 Handshake Checker — Scan all files or file-by-file, with optional 🧹 auto-delete of invalid captures. Flags valid / incomplete / invalid quickly.
  
• 📌 Sticky Startup — Save your current SSID + portal and auto-restore them on reboot.
  
• 📹 CCTV Toolkit — LAN/WAN IP-camera recon → ports → brand fingerprint + CVE hints → login finder → default-creds test → stream discovery → SD report, plus MJPEG viewer & Spycam detector.
  

🎥 CCTV Toolkit — Highlights

Modes - Scan Local (LAN)
- Scan Unique IP (WAN/LAN)
- Scan from FILE (batch)
- MJPEG Live Viewer
- Spycam Detector (Wi-Fi)

Workflow Port Scan → Heuristics → Brand Fingerprint → CVE Hints → Login Pages → Default-Creds Test → Streams → SD Report

Protocols/Ports - HTTP/HTTPS: 80, 443, 8080–8099, 8443
- RTSP: 554, 8554, 10554…
- RTMP: 1935–1939
- ONVIF: 3702

Files & Outputs /evil/CCTV/CCTV_IP.txt # targets (one IP per line) /evil/CCTV/CCTV_credentials.txt # default creds (user:pass) /evil/CCTV/CCTV_live.txt # MJPEG viewer list (auto-filled) /evil/CCTV/CCTV_scan.txt # cumulative reports

Viewer Controls - , or / = prev/next
- r = resolution toggle
- ; or . = compression ±
- Backspace = exit

Extras - Abort long ops with Backspace
- GeoIP shown for public IPs
- Anti false-positive RTSP check

🛠 Handshake Checker

• Modes: Scan All • Per-file • Auto-delete bad.
  
• Keeps loot clean and highlights usable captures.
  

⚙️ Sticky Startup

• Persists SSID + portal from Settings.
  
• Reboot straight into your setup.
  

📥 Download

• GitHub: Evil-M5Project
  
• ⚠️ Update your SD files (project now under /evil/).
  

📚 Documentation

- GitHub: Evil-M5Project Wiki

⚠️ Use responsibly — only on gear you own or with written permission.

🎉 Enjoy! 🥳🔥

Demo : https://youtube.com/shorts/-pBtSKjXAqc?si=LMv3RCB3hcRisaCD

Github: https://github.com/clickswave/mach

Would be a shame to toss some good hardware. Is there a way like through a uart or something to access the firmware? I'd love to be able to repurpose the unit.

I've tried researching this, but can't find anything when it comes to hacking these.

Please note, this would NOT be used as a life safety device.

Not to detect smoke if that's what your wondering. Want to use it with modified firmware to use as a wifi speaker for Chromecast or even run an LLM on a stripped down linux distro, seeing as it has a speaker, Mic, and wifi.

Many network-exploitable vulnerabilities, such as CVE-2025-47188, remains delayed, poorly documented and lack meaningful enrichment. Despite being actively exploited since May 2025, this vulnerability is still not enriched by NVD, EPSS or proprietary vulnerability databases.

VEDAS can be used for Mining Exploit Intelligence linked to vulnerability identifiers like CVE, EUVD, CNNVD, and BDU and can be helpful in developing custom Nuclei templates and extending its coverage, supporting the growing community of security teams, researchers, and ASM providers.

Greetings. Many walkthroughs of THM and HTB show the path through the system, bypassing any potential rabbitholes and ignoring failed attempts. This (in a way) is ideal as it keeps things short and to the point.

It can be said however that seeing the attempts and the mindset of someone working blindly through a box can be beneficial as we can see what happens when they get stuck, how do they overcome the current issue? How do they discern what is worth working on and what to ignore?

I therefore introduce as a senior pentester of 13 years (BSc, OSCP, OSCE, OSWP, VHL+, currently working on CRTO) , my YT channel sabretoothAtNethemba (link in my profile) where I do just that covering THM boxes every Tuesday and HTB every Friday with no previous experience of said boxes.

Some people set me challenges (e.g complete the box in 30 mins, or no privesc scripts, or no reverse shells etc) and I am generally working through HTB in release order whereas THM I am choosing boxes based on suggestions and what takes my interest.

Hopefully it will help some of our community who are just starting out to see the thought process of a pentester in the field. Thanks everyone. Keep on hacking.

Android support

Transparent proxy can be enabled on Android devices (arm64) with root access. You can install Termux and run GoHPTS as a CLI tool there:

```shell

you need to root your device first

pkg install tsu iproute2

Android support added in v1.10.2

GOHPTS_RELEASE=v1.10.2; wget -v https://github.com/shadowy-pycoder/go-http-proxy-to-socks/releases/download/$GOHPTS_RELEASE/gohpts-$GOHPTS_RELEASE-android-arm64.tar.gz -O gohpts && tar xvzf gohpts && mv -f gohpts-$GOHPTS_RELEASE-android-arm64 gohpts && ./gohpts -h

use your phone as router for LAN devices redirecting their traffic to remote socks5 server

sudo ./gohpts -s remote -t 8888 -Tu :8989 -M tproxy -sniff -body -auto -mark 100 -d -arpspoof "fullduplex true;debug false" ```

GoHPTS Github Page

Runs on an alpine emulator available in the app store called iSH Shell, reworked a few existing tools to be compatible and added s few of my own. It may not be the most practical thing but I’ve never seen anything like it before and i love how comical the idea is of “hacking from an iPhone” 🤣

Try to guess what it does.

If anyone is scanning for headers for cache poisoning or anything else AND using Param-Miner, you can speed it up exponentially. It took less than a minute for it to find the header.

Lap 1 :

Thread Pool size - 8 Require Consistent Evidence - Yes Quantitative Confirmations - 50 Skip Uncacheable - No

Lap 3 :

Thread Pool size - 16 Require Consistent Evidence - No Quantitative Confirmations - 1 Skip Uncacheable - Yes

Lap 4 :

Thread Pool size - 24 Require Consistent Evidence - No Quantitative Confirmations - 1 Skip Uncacheable - Yes

people like Manning https://en.wikipedia.org/wiki/Chelsea_Manning who exposed iraq atrocities by US got sentenced 35 years in jail(reduced by obama to 7)

she has go fund me and raised abt 66k+ for living expense

but there are hackers that didnt raise a lot after jail like jeremy Hammond and didnt get much funds raised

so should there be an incentive to create a funding corporation for these types of hackers?

to create a legal reward system?

I’m aware that most modern ISP routers and current hardware don’t use outdated Wi-Fi security protocols anymore (WEP, WPA TKIP, etc.), but I’m curious about something.

For people who still scan Wi-Fi networks for fun or as part of research — have you ever considered warning the users if you happen to find a vulnerable access point?

I’m not talking about hacking or connecting, just passive scanning (seeing what’s already broadcast in public space) and identifying weak configurations. Then, maybe reaching out to the owner to propose a service to help them secure their network.

Some countries have responsible disclosure frameworks to protect researchers who report issues in good faith, so this could be done ethically.

That said, I’m a bit worried people might see it as intrusive despite the explanation, and might not be willing to cooperate or pay for such a service.

Has anyone here actually reached out to a network owner, warned them, and helped them improve their security? • How did they respond? • Did it lead to any ongoing collaboration or paid work? • Any tips for making this kind of outreach more welcome?

Hi, I would like to let you know about this free and practical cybersecurity course with both red and blue teaming classes done by Czech Technical University. The registration is opened and the semester starts at the end of September. Feel free to find more information including the complete syllabus and references from more than 1500 students of last year course at the shared link! Thanks

I'll be concise. NAT on VMs adds a layer of isolation, yes. But it tends to give constant false positives when scanning ports or IPs when they're external (on the general WAN; due to how the VM's hypervisor handles traffic). So what's the standard then? You have to use Bridge if you want accuracy, right? And then you isolate through SSH or VPN to VPS, and maybe even a USB network adapter passthrough directly to the VM?

So NAT isn't really viable for real scenarios, is that it?

Hello, I feel like I am banging my head against a wall when I want to get hydra to do what I want.

I am trying a HTB room and want to perform a brute force attempt. I simply want to include a PHPSESSID header value along the HTTP requests but everytime I try, I get the same error: [ERROR] no valid optional parameter type given: F

This is what I try:
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
-P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
10.129.172.189 http-post-form \
"/:username=^USER^&password=^PASS^:F=Wrong Credentials:H=Cookie\: PHPSESSID=r412tpqqhl49qjhk4r8dl47n2q"

Or more simply
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
-P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
10.129.172.189 http-post-form \
"/:username=^USER^&password=^PASS^:F=Wrong Credentials:C=/"

Please tell me what I am doing wrong.

I've experimented with implementing backdoors into locally-hosted LLMs and the validity to then upload them back to HF (which I didn't).

I've successfully done so, in three separate ways:

1. Modify the forward and backward hooks to dissuade the model from providing 'safe' answers based on a hidden trigger (e.g. 'per our last discussion).

2. Implant a small neural network that will do the same.

3. Fine-tune the model to do the same, with an approach that is virtually impossible to find.

I've then wondered whether any malicious actors have managed to do so! I decided to test this against the first approach, which is easiest to audit since one doesn't have to download the actual model, just some wrapper code.

So, I've downloaded the wrapper code for 10k HF models, and ran a search to find custom forward and backward hooks.

Rest assured, (un)fortunately none were found!

More work needs to be done against the 2nd and 3rd approaches, but these require much more time and compute, so I'll save them for another day. In the meantime, rest assured that you can safely use HF models!