A combination of reused default passwords, hidden triggers, and completely unauthenticated APIs results in reliable wireless RCE, data disclosure, and device control in the field on Flock Safety's License Plate Readers.
Category: Hardware
Fly-By – Device 2: The Falcon/Sparrow – Gated Wireless RCE, Camera Feed, DoS, Information Disclosure and More
Covering the next batch of disclosures in regards to my Flock Safety security research.
Trap Shooter – Flock Safety Sniffer & Alarm
Custom firmware for the M5NanoC6 (ESP32-C6) that sniffs and then alerts you of nearby Flock Safety devices. Will be integrated into a exploit tool releasing on 09/27/25 for Flock Safety devices!
Unbricking and Flashing the Yardstick One
Bricked your Yardstick One? This step-by-step guide shows how to recover it using its cousin, the GreatFET, by erasing, flashing, and verifying full Sub 1 GHz sniffer functionality.
Using a Nexus 6P and QCSuper to Sniff LTE.
Step by step instructions on how to setup and configure a Nexus 6P to sniff portions of the LTE wireless stack.
Reverse Engineering the Little Tikes Dream Machine Projector – Part 1
Part 1 of my journey into reverse engineering the little tikes dream machine projector.
Unbricking and Reflashing the Ubertooth One Clones
Purchased a Ubertooth One Clone from Amazon or Aliexpress that doesn't seem to be working in 2025? Bricked your Ubertooth One? This step-by-step guide shows how to recover it using UART flashing, fix common issues, and verify full Bluetooth sniffer functionality.
Reverse engineering the MISIRUN Instant Print Kids Camera
My tubs of hardware to hack continues to grow and the rediscovery of Woot! (miss the OG Woot!). Although it's in the future, I decided to pick up a few of these cameras as they were on a steep sale. I figured that they weren't going to be groundbreaking but fun to hack, especially as … Continue reading Reverse engineering the MISIRUN Instant Print Kids Camera
Dumping Firmware from ESP8684
Clear instructions on how to dump firmware from an ESP8684 chipset that I couldn't find an example of anywhere outside of the docs.
Setting up and configuring LibreSDR B210/B220 AD9361 on Windows and Linux
So for a large project I've spent a month or two on I've been delving deeper into embedded device hacking/penetration testing. I've done some hardware engagements and have messed a bit for fun before, but nowhere to this extent. As apart of these escapades I plan to make a bunch of posts of tips & … Continue reading Setting up and configuring LibreSDR B210/B220 AD9361 on Windows and Linux








