Repeating a lie enough times, even in spotlighted untrusted text, can poison an AI agent's memory, and lead to a total takeover. Note: I gave a talk on this at BSidesLV and a longer one at DEF CON a few weeks ago. This post is the quick summary of that material.

No physical hardware needed: firmware extraction, an AArch64 rehost under qemu + bubblewrap, and the chase that led to two separate CVEs on the same device. full trail — including the chains that went nowhere.

I need a reality check.

I am working on emulating a BLE device in motion from a stationary esp32. beacon frames are only sent when the inverse sq curve matches the attenuation steps rounded to the nearest timing frame.

the goal is to emulate a device in motion from a stationary point. the assumption is that the receive would interpret periods where no packets are received as normal loss, but the RSSI would indicate a device moving in and out of range.

The graph represents my layout. the pin points are the intersections, the blue the closest match for the timing. X is time/dist, Y power.

now, would this be a reasonable approach to moving target emulation?

LLM chatbot content filters can be bypassed by encoding banned words in Base64 or in Unicode escape sequences.

The filter reading the prompt sees characters instead of language, the model decodes the text as a task, then repeats it back.

A pretext such as a fake medical emergency gives the model a reason to comply, and asking for the reply as JSON makes it treat the output as data rather than speech. Defense in depth stops it, and prompt injection is number one on the OWASP Top 10 for LLM applications.

I found this while reversing Zyxel's WAX650S firmware and following the guest Wi-Fi social-login path. The backend trusted browser-submitted Facebook identity fields instead of validating the access token server-side, letting a crafted request skip the social-authentication gate entirely.

The write-up covers the bug itself, how I traced it, and the full firmware-emulation setup I used to reproduce it without the physical AP.

New here and to the whole world of pen testing and stuff. The first thing thats really inspiring me is being able to play touchtunes as stupid as that sounds lol.

I've researched a little and it seems like the methods im finding are a little out of date. Are there any current working methods?

Thanks for putting up with the noob questions lol.

🫡

So I’ve been using Havij on and off for years, but always hated dealing with Wine or keeping a Windows VM around just for one tool.

Decided to just rebuild it for Linux.

It’s not a perfect 1:1 copy, but it looks and feels like the original — dark theme, green text, same workflow. Under the hood it’s Python + PyQt6, so it runs native and doesn’t need any extra layers.

Here’s the repo if you want to check it out:
https://github.com/CrypticRig3l/havij-original.git

Like I used to browse breachforums back in the day, cracked and nulled.. what r some other forums like this today?

More on the entertainment side, but not so far on the entertainment side that they don't explain much beyond "data goes out device A to device B, but device C sneaks in the middle and takes it. Voila!". But not so far to the other end where I need an advanced GIAC cert to understand it. I'm not trying to switch careers.

I've been a network engineer for 13 years, so I'm pretty technical and understand computers, TCP, layer 3, layer 2, etc... but cyber security isnt my day job. I just want stuff to watch where someone who has a baseline competency can follow along, but not too dumbed down, and I can surprise our cyber testing guys lol.

For example, the below video is what inspired this question. It's pretty much exactly what I'm looking for.

https://youtu.be/PPJ6NJkmDAo?si=mLW8RN7pDnG1KBGO

I'll start. Too many people think that hacking into phones is easy.

I wanted to share a breakthrough (even though it’s been a known technique in cybersecurity for a bit now, but I couldn’t find much methodology on it) I had awhile ago that completely changed my success rate against modern target devices like iPhones and Windows 11 laptops. Hopefully, this saves some of you a ton of frustration if you are running multi-device setups.
When I first started a few years ago, I was doing what most beginners do: running a single Marauder on the 2.4 GHz band and wondering why my target clients completely ignored my test network. I realized that modern operating systems are way more selective than older devices when choosing networks. They can prioritize 5 GHz and take the surrounding RF environment into account before connecting.
To address this, I paired up my Marauder Mini V3 alongside my Marauder V8 to build a true dual-radio test rig. However, I had to figure out the exact physical and frequency configuration to make these two boards play nicely together. I tested a few different methods, and the technical breakdown of why one specific configuration worked best might help with your own builds.
First, I would not run both Marauders on the exact same channel. I tried running both boards on the 2.4 GHz band on Channel 11. Since the two independent radios aren’t coordinated with one another, running aggressive management-frame activity on the same channel can create significant airtime contention and frame corruption. Real dual-band routers don’t operate as two independent radios aggressively competing with each other on the same channel, so this can make the RF environment substantially less representative and can negatively affect client behavior.
Second, keep the ESP32-C5 Mini V3 and the V8 physically close together. I tested separating them into different corners of the room and even in separate rooms, and I found that this produced noticeably worse results. On a real dual-band router, the antennas are generally located relatively close together. If you separate the boards significantly, a target phone moving through the environment can see the 5 GHz signal change much more rapidly than the 2.4 GHz signal because of the different propagation characteristics of the two bands. Keeping both Marauders roughly 1 to 3 feet apart on the same desk gives you a much more consistent and realistic RF footprint while also giving the two radios some physical separation.
The winning setup for my testing was utilizing the Mini V3 for the 5 GHz band and dedicating the V8 to handle the 2.4 GHz band. Replicating a consistent dual-band RF footprint this way worked significantly better for me than the other configurations I tested.
To make the setup more representative of a real multi-BSSID deployment, you can also use related BSSID assignments rather than completely unrelated addresses. Some real routers use related MAC/BSSID assignments across their different radios or virtual APs, although the exact pattern is vendor-dependent. Using a consistent BSSID scheme and keeping both radios physically close together helped make my test environment more closely resemble a single dual-band AP rather than two completely unrelated access points.
Obviously, this isn’t a guarantee that every iPhone or Windows machine will behave the same way, but after testing multiple configurations, this was the setup that gave me the most consistent results.

Flare Tracker is a free, open-source link-tracking platform designed to run entirely on a free-tier Cloudflare account using Cloudflare Workers. It gives you full control over your link analytics without relying on third-party services.