We can't find the internet
Attempting to reconnect
Something went wrong!
Attempting to reconnect
Technical deep dives on physical red team hardware, attack techniques, and OPSEC.
SD card corruption, flaky USB dongles, SSH tunnels to VPS boxes, and zero OPSEC controls. We built the Phantom and Scout because Raspberry Pis were never designed for offensive operations.
A deep look at the Phantom -- NAC bypass, credential harvesting, evil twin WiFi, Bluetooth attacks, and passive recon in a single fanless device that phones home over 4G.
The Scout is a pocket-sized recon stick that enumerates every WiFi network, Bluetooth device, and probe request in range. Plug it in, walk away, and monitor from the dashboard.
How we built a WebSocket relay that forwards AES-256-GCM encrypted blobs between devices and operators without being able to decrypt, modify, or log any of it.
How Tap mode creates a transparent Layer-2 bridge to bypass 802.1X and MAB authentication, inherit VLAN assignments, and perform DTP negotiation and 802.1Q double-tagging.
Venom mode runs Responder, LLMNR/NBT-NS poisoning, NTLM relay, IPv6 WPAD/DNS takeover via mitm6, ARP cache poisoning, and rogue DHCP -- all unattended and exfiltrating over 4G.
How Siren mode clones SSIDs, deploys captive portals, captures WPA/WPA2 handshakes and PMKID hashes, and runs deauthentication attacks -- all from one built-in WiFi 6 radio.
BLE relay/MITM, device spoofring, GATT service fuzzing, legacy pairing exploitation, and advertisement injection -- Fang mode turns the Phantom's Bluetooth 5.2 radio into an attack platform.
Full PCAP recording, network asset discovery via traffic analysis, WiFi and Bluetooth enumeration -- all without transmitting. Scope mode maps the target environment silently.
Why your drop box needs a remote kill switch, cryptographic self-destruct, and a stealth mode that guarantees zero packets on the target network.
Define a sequence -- run Scope for 30 minutes, auto-enable Venom, exfiltrate every hour, switch to Siren after business hours. The Phantom executes it unattended.
A practical checklist for physical red team engagements -- from pre-engagement recon with Scouts to Phantom deployment, mode selection, playbook configuration, and extraction.