Projects

TOOR.sh is a cloud and VM hosting service operated by ToorCon, a 501c3 non-profit organization that provides free hosting resources for security research and public benefit projects. The service includes dedicated servers for VMs, storage, and databases, along with their own ISP infrastructure (AS22296). The platform offers various free tools including IP address lookup services, network speed tests, and internet infrastructure services such as RIPE Atlas probes, BGP feeds, Tor nodes, and Signal TLS proxies. TOOR.sh operates on a volunteer basis with a “best effort SLA” and accepts donations of hardware, network resources, or funds to support their mission.

WebSerial Bruteforce automatically determines the correct baud rate for UART serial devices by testing common communication speeds and analyzing the returned data. The web application uses the WebSerial API to connect directly to serial devices from the browser without requiring additional software. The tool iterates through standard baud rates and measures the amount of ASCII data returned at each setting, selecting the configuration that produces the most readable output. This is useful for reverse engineering or troubleshooting unknown serial devices where the communication parameters are not documented.

USB Meter is a web application that connects to Atorch power meters via WebBluetooth to log and display electrical measurements. The application reads real-time data including voltage, current, power, energy, capacity, resistance, and temperature from compatible Atorch USB power meters. The web interface provides data logging capabilities with the ability to reset, pause, and save measurement sessions. Using WebBluetooth API, the application eliminates the need for additional software installations, operating directly in compatible web browsers with Bluetooth support.

An opkg repository that builds Tailscale combined packages for OpenWrt devices, specifically providing a backport of Tailscale for OpenWrt 19.07. The project addresses the lack of official Tailscale packages for older OpenWrt versions by providing a flexible build system that generates installable packages across multiple hardware architectures. The repository includes automated build scripts that create opkg feed and package files, allowing users to easily install and configure Tailscale on their OpenWrt 19.07 devices. This enables secure mesh networking capabilities on legacy router firmware, making it simple to connect older OpenWrt devices to a Tailscale network for remote access and site-to-site connectivity.

Mag Encode is a web-based magnetic stripe card encoder that generates audio signals for encoding data onto magnetic stripe cards. The application runs entirely in the browser, processing encoding operations client-side without transmitting data to external servers. The tool supports configurable encoding parameters including frequency settings, reverse swipe options, and various advanced configuration options for different magnetic stripe formats. It converts digital data into the appropriate audio waveforms that can be played through audio output devices to magnetically encode stripe cards.

Broken DNS performs lame delegation checking at scale to identify DNS nameserver configuration issues. The tool validates DNS delegation by checking if nameservers properly respond to queries for zones they are supposed to be authoritative for. The Go implementation can process large numbers of domains and nameservers to detect misconfigurations where nameservers are listed in delegation records but do not actually serve the zone data. This helps identify broken DNS setups that can cause resolution failures.

Minimalin Reborn is a minimalistic watchface for Pebble smartwatches, featuring a clean design with customizable colors and optional information displays. The watchface uses a custom font called Nupe and provides configurable elements including weather data and step tracking integration. This project is a fork and modernization of the original minimalin watchface, updated to work with current Pebble development tools and the Rebble ecosystem. The watchface supports both color and monochrome Pebble devices with adaptive styling and user-configurable display options.

Homeplate is an ESP32-based e-ink dashboard that displays data from Trmnl and Home Assistant on an Inkplate 10 device. The firmware fetches and renders various dashboard widgets including sensor readings, WiFi QR codes, and system status information. The implementation uses FreeRTOS on ESP32 to manage display updates, network connectivity, and power management for the e-ink display. It supports multiple data sources and configurable display layouts for home automation monitoring.

ESPHome Components is a collection of custom components that extend ESPHome functionality for ESP8266 and ESP32 microcontrollers. The repository contains C++ implementations of additional sensors, displays, and device integrations not available in the core ESPHome distribution. The components follow ESPHome’s standard architecture and configuration patterns, allowing them to be easily integrated into existing ESPHome projects through external component references. Each component includes the necessary C++ code and Python configuration validation.

DNS2mDNS bridges traditional DNS queries with multicast DNS (mDNS) resolution for .local hostnames. The service allows devices that don’t natively support mDNS, such as many Android devices and Windows systems, to resolve local network hostnames through standard DNS queries. The Go implementation acts as a DNS server that intercepts queries for .local domains and forwards them to the mDNS system, then returns the results via standard DNS responses. This enables seamless local hostname resolution across mixed network environments with Docker deployment support.

Luxer One is a Python API client for the Luxer One Residential package management system. The library provides programmatic access to check package delivery status, retrieve pending packages, and interact with smart locker systems commonly found in apartment complexes and residential buildings. The client handles authentication with the Luxer One API and includes example code demonstrating basic operations such as logging in and querying package information. This enables automated monitoring and management of package deliveries through the Luxer One platform.

Extsort is a Go library that implements external sorting algorithms for datasets larger than available memory. The library manages temporary files and memory buffers to sort data that cannot fit entirely in RAM. The implementation uses merge sort with configurable buffer sizes and temporary file management. It provides a standard Go interface for sorting operations while automatically handling the complexity of disk-based intermediate storage and merging phases.

Allxfr performs DNS zone transfers (AXFR) against nameservers to retrieve complete zone files. The tool systematically attempts zone transfers against root zone servers and other configured nameservers to discover available zone data. The program supports both IPv4 and IPv6 connections and includes options for parallel transfers, dry-run operations, and zone file storage. It implements the DNS AXFR protocol to request complete zone transfers from authoritative nameservers that permit such operations.

Minimalin Watch Face is a minimalistic Wear OS watch face featuring clean typography and Material Design aesthetics. The watch face displays time with customizable complications and supports ambient mode for always-on displays with reduced power consumption. Inspired by the original Pebble Minimalin watch face, this Wear OS implementation includes configurable color themes, center complications for additional information display, and optimized rendering for various screen sizes and densities across different smartwatch models.

M365 Toolbox demonstrates a security vulnerability in the Xiaomi M365 electric scooter’s communication protocol. The Java application exploits weaknesses in the scooter’s Bluetooth Low Energy (BLE) authentication mechanism to bypass security controls and execute unauthorized commands. The proof-of-concept tool reveals how the scooter’s authentication can be circumvented through protocol manipulation, allowing remote control access without proper authorization. This research highlighted critical security flaws in IoT device communication protocols commonly found in consumer transportation devices.