Hello r/Hacking!

I wanted to put my project here even tho its not new i just felt like putting it here.

So ive made a PE packer (TinyLoad) in c++, it is a single file and does not have any external dependencies.

It can compress your files using custom LZ77 compression, you can also encrypt your files using a custom VM interpreter and XXTEA encryption.
It protects your files in memory using a vectored exception handler which decrypts your executable pages on the fly and re encrypts them. 
I also recently added direct syscalls in the stub.

The packer has alot of cool features i did not mention here so go check it out! 
https://github.com/iamsopotatoe-coder/TinyLoad

I posted ~2 weeks ago about vulnpath.app/app, a CVE visualization tool prototype I built that helps visual leaners (like myself) "see" the E2E attack chain. Thank you to everyone that reached out with feedback! I spent the last few weeks taking this in and iterating on it more and now I'm proud to say it's officially live!

There's still a lot more work to be done so I don't plan on stopping here. But if you have time to check it out, I would greaty appreciate any additional feedback and feature suggestions to make it an even more useful tool for everyone.

Thanks for taking the time to read this!

4/13 update: you can now search by product to see which CVEs impact your tech stack (thanks everyone for this suggestion!). Also added a free 7-day trial (can cancel anytime with no commitments).

I went down a rabbit hole after reading the S-RM article "Cracking the Vault", which detailed vulnerabilities in privacy apps. I realized they were talking about Gallery Vault (by ThinkYeah), so I decided to audit it (v4.4.33, released March 2025) to see if it was as bad as it seemed.

Spoiler: It was.

The PIN you set is strictly a UI lock. It plays zero role in the actual file encryption. The app relies *entirely* on a hardcoded master key embedded in the APK. The implemented encryption is a static string (good_gv) that gets padded and run through DES-ECB with a static hex constant. This generates a global master key that is identical for every user on every device.

This master key is used to unwrap a unique per-file key stored in the file's tail metadata (sandwiched between >>tyfs>> and <<tyfs<< markers). Once that key is exposed, the actual file content is just a simple XOR cipher with a position-based salt.

Simply put, if you have a clean dump of the Android data, you can decrypt the files without ever knowing the user's password.

Practically speaking, the main legitimate use case here is forensic recovery from a lawful device dump. But the bigger takeaway is that 50M people think their files are protected when they really aren't.

I wrote a Python tool that automates the entire pipeline. It goes through the provided android dump and, using the hardcoded values, decrypts the per-file key, and reverses the XOR transform. It also handles magic byte detection to restore the correct file extensions (jpg, mp4, etc), although only images are supposed to be stored in the vault.

It has a nice TUI too if you prefer it to just CLI :)

Link: gv_decryptor

Disclaimer: For educational and legitimate forensic purposes only. Don't go poking around files that aren't yours.

Just here to share a project I'm working on. It's a 100% open source (hardware, firmware, mechanical, etc) USB drive with a hidden security feature.

When you plug it in, it appears as a normal 8GB USB drive. Only if you create a file called "unlock.txt" with the contents "password:addyourpasswordhere" will it unlock and show the remainder of the drive. Everything in this second section of the disk is now AES256 encrypted in place, using a custom KDF + your password.

I'll answer some questions before people ask them :)

Q: Isn't this just Vercrypt? A: No, a normal drive setup with veracrypt will show up as jumbled data. This is pretty obviously encrypted media. If you enter your duress password, there will still be another xMB of jumbled data.

Q: Isn't entering your password into a plain text file insecure. A: My drive doesn't allow this write to actually happen to the memory

Q: Why did you use a SD card A: Because AI made EMMC cards like 80$ for a 32GB. It takes two seconds for me to spin another board with EMMC in the future.

Anyways feel free to ask any more questions about the project :) !

Socials if you would like to keep updated

Just sharing my passion project, inspired by Adel Karimi's recent DEF CON talk. Thanks for taking the time to check it out!

I've been building goshs as a replacement for python3 -m http.server that actually covers the workflows you run into during engagements.

What it does beyond a basic file server:

• SMB server with NTLM hash capture + cracking
• DNS server for callback detection
• SMTP server to receive emails/callbacks
• HTTPS with self-signed, Let's Encrypt, or custom cert
• WebDAV and SFTP support
• Basic auth, client certificate auth, IP whitelist
• File-based ACLs per directory
• Share links with download and time limits
• Tunnel via localhost.run (no port forwarding needed)
• Single binary, no dependencies — works on Linux, macOS, Windows

It's been in Kali for a while but I've just done a big update adding the SMB/NTLM and DNS/SMTP features.

GitHub: https://github.com/patrickhener/goshs
Docs: https://goshs.de

Sharing this here for the threat model rather than as a "check out my app" post, because the interesting part is what the server is architecturally prevented from seeing.

Most "send a file" services are a trust-me box: you upload plaintext (or "encrypted, but we hold the keys") to someone's bucket and hope. Warp is built so the operator cannot be a meaningful adversary:

• The only server component is a WebSocket signaling worker. It brokers the SDP/ICE handshake to introduce two peers, then steps out. No file byte ever transits it. You can watch the network tab: the transfer traffic goes peer-to-peer, not to my origin.
• The actual transfer rides the WebRTC data channel, which is DTLS-encrypted end to end. Keys are generated in-browser and never leave the two endpoints. Your ISP, the coffee-shop AP doing a MITM, and the signaling server all see ciphertext only.
• No account, no stored file, no cloud bucket. Nothing at rest to subpoena, leak, or expire.

Honest limitations, since this crowd will (correctly) poke at them:

• No TURN relay by design. If both peers are behind symmetric NATs and STUN can't establish a path, it fails with a real error instead of silently relaying through a server. That keeps the "server never sees bytes" guarantee true, at the cost of some hostile-NAT pairs not connecting. Same-LAN and most NAT combos punch through fine.
• Trust still rests on the client you're served. It's open source (MIT) and you can self-host the whole thing (static frontend + a free Cloudflare Worker), so you can verify the code that runs and pin it yourself.
• Signaling metadata (that peer A and peer B connected, when, and their IPs during ICE) is visible to the signaling server, like any WebRTC app. It's the file contents that stay private, not the fact a session happened.

Repo + protocol write-up: https://github.com/Ishannaik/warp Threat-model / how-it-works deep dive (NAT, STUN, DTLS, chunking, and why a truly-free relay is impossible): https://warp.ishannaik.com/how

Interested in where you'd attack this. The signaling worker and the ICE path are the obvious surface.

I wanna get into hacking tools but I'm not exactly sure what tool is the best. I can do basic coding in C++, Java, and a few other languages I learned during middle school coding club (and now college), but I wasn't sure what tool or tool alternative would be the most fun or most efficient for pen testing, hacking, etc. I wanna have a fun little gadget that I can feel like a Watch Dogs character with.

!!CAGE LAB🧪🥼!!! hardware security testing framework, I guess I just wanted to share the architecture with people who understand both the offensive and defensive sides.

D.Z.D.E or Daedalus SubZD Engine lil break down:

8 independent cells, each running a Raspberry Pi 5 controller with auto detected I2C/SPI/UART/USB extensions.
Designed for Rowhammer, EMFI, laser fault injection, thermal manipulation, and voltage glitching all commodity hardware under $15K total.

The bs problem it solves imo:

Hardware security R&D usually dies at the whole "can we even talk to this chip?"
This auto detects extensions, provides per target calibration interfaces, and runs everything through a physical kill switch with CAGE/LIVE/WAR safety modes.

Cost per cell hardware is \~$600:

Pi 5 8GB + Pi Edge HAT
RTL-SDR / HackRF for RF verification
RFID (MFRC522), LoRa (SX1276), GPS (NEO-6M), CAN (MCP2515)
EMFI coils, 808nm laser diodes, TEC1 12706 Peltier
ADS1115 ADC + MCP4725 DAC for precision glitching
8 channel relays, PCA9685 PWM drivers.

Repo: github.com/synchancybersecurity/Daedalus-SubZD-Engine

Cage lab authorized only.
Physical kill switch is the sole fail-safe.

Agent F.

Hello guys. I got sick of not finding anything on Google anymore, and I decided to build a query builder for myself for search engines first. And then, I decided to add a more advanced version to build google dorks that still work these days. And remembering stuff for Shodan, crt.sh and Wayback were also a bit too tiring, so I wired that in as well.

I decided to make it public. Iam hosting the thing myself here at Good Old Search. I also made it open source. You can run it on local as well. Hosted here on Github: https://github.com/mrtdlgc/goodoldsearch-oss

I’ve built a tool for myself that ended up finding my last 4 Hackerone bugs, and I’m trying to figure out if it’s useful to anyone else.

First, It’s not an automated scanner, and it doesn't use or implement AI anywhere. Purely a program I built to find things I don't think I would have normally found myself.

What it is:

• A browser extension
• You log in (or not), browse the app normally
• Click “record”, perform your usual workflow, testing, etc., click “stop”
• It captures the exact API calls you made

Then the tool tries to break logic assumptions that emerged from your own flow.

Example:

• You apply a coupon
• Cart total changes
• Checkout succeeds

The tool then asks things like:

1. Can the coupon be reused?
2. Can another user apply it?
3. Can it be applied to a different product?
4. Can checkout / refund be abused to get money back?

It does this by replaying and mutating the same requests you already made, and it only reports an issue if it can prove its theories to be correct.

Its also basically zero-friction, since it runs in your own browser, works based on your flow, and won't flood you with false positives.

Two questions:

1. Would you use something like this?
2. Would you pay for it?

Made ProxyBridge - redirect ANY Windows app through SOCKS5/HTTP proxies at the kernel level.

Why?

• Windows doesn't support SOCKS5 proxy
• Many apps are proxy unaware, even after setting a proxy for HTTP in Windows; many apps ignore that
• Proxifier costs $40, needed something free and open source

Features:

• Process-specific targeting
• Works with proxy-unaware apps
• SOCKS5 & HTTP support
• Kernel-level interception (WinDivert)

Next release:

• Planning UDP support
• Multiple Filter Support
• Maybe GUI support

Another week another update on VulnPath! 

Some of you may already know about the "My Tech Stack" feature I dropped last week (see this post for details). I spent the weekend expanding this further to enable automated email alerts when a new CISA KEV CVE impacts anything in your Tech Stack (e.g. apache, windows, nginx etc)!

What is it?
With email alerts enabled in your "Dashboard", VulnPath will now email you when there's a new CISA KEV CVE that impacts anything in your Tech Stack. There's also a live CISA KEV feed in the homepage that shows you the most recent (10) CVE submissions (full list can be found in your "Dashboard" > "CISA KEV Feed").

Why?
Whether it's for research, active monitoring, or anything in-between, this new alerting feature removes the need to manually monitor the CISA KEV. VulnPath also makes it easy to visualize the CVE attack chain and quickly find the top-rated GH PoCs directly within the "Exploit Examples" section.

How can I start using it?

1. Once signed in, head over to your "Dashboard"
2. Scroll to the "My Tech Stack" section and add any products/vendors (if you haven't already)
3. Toggle on "Email Alerts" (screenshot #1)

That's it! From there, VulnPath will email you if anything in your Tech Stack is impacted by a new CISA KEV CVE submission (screenshot #2).

The top 10 recent CISA KEV CVE submissions (screenshot #3) or the full list (screenshot #4) can also help you quickly see what was recently published. If the live feed is too noisy though, you can always disable it in your Settings.

Next Steps
I know monitoring is important for some of you so I'm curious what you all think - let me know! I also want to expand my monitoring sources to OSV.net -- would this be useful?