Converting a Garmin Vivoactive 4 to QuickFit

For the 5 other people in the world that may want to do this mod, I figured I'd write this quick blog to save you about 30 minutes of Googling/scouring Aliexpress. It should also work for other Garmin watches that aren't QuickFit compatible. Background I…

Serving Web Services Behind CGNAT with Cloudflare Tunnel

With all the issues I was having with my old ISP, I decided to make the leap and move onto Optus 5G Home Internet. My experience so far has been pretty stellar and I'm currently paying the same amount as I was with my previous provider for quicker…

Path Traversal in slowscript.httpfileserver

The Android application HTTP File Server [https://play.google.com/store/apps/details?id=slowscript.httpfileserver] (Version 1.4.1) by 'slowscript' is affected by a Path Traversal vulnerability which permits arbitrary directory listing, file read, and file write. Versions below 1.4.1 are also probably impacted…

Analysing an Invasive App Used by ISPs

UPDATE: I contacted my ISP about this app. They noted that during the install process there's a 'BEGIN' button with text under it that says 'By tapping "begin" you accept our EULA [https://routethis.com/RouteThisEULA.pdf]. I don't think it…

A Tour of My Homelab

Homelab [hom-læb](n): a laboratory of (usually slightly outdated) awesome in the domicile. - r/homelab Homelabbing is how I learn things I don't otherwise get to learn at work. In this post I share some of the hardware I settled on to build my lab. It all…

Exporting Nessus Results into a Database

Nessus Pro is a great vulnerability scanner but analysing results quickly becomes unwieldy once you have more than a couple of scheduled scans or a large scan space. So I wrote a tool to export Nessus results using the API into a relational database. https://github.com/eddiez9/nessus-database-export EER…

Spotify on My Xiaomi Vacuum Cleaner

This is one of those projects where I never stopped to ask why. But just in case you also want a vacuum cleaner that can double as a Spotify Connect speaker, I can help point you in the right direction. First, the end result: This requires very little technical ability…

Transferring Files into a Restrictive Vdi Environment

In a recent penetration test I came across a novel technique to transfer files into restrictive VDI environments where all conventional ways of transferring files had been disabled. It's not rocket science but I thought it was interesting enough to warrant a brief write-up. TLDR; Base64 encode the…