Projects Blog

Raspberry Pi Tablet with Touchscreen Capabilities

I completed this some years ago. I originally put it on Google Pages or Google+, but this is now defunct. This was a compact tablet for my son, with basic games on the Raspberry Pi, with a 5" screen, and stylus. He enjoyed drawing on it the most as a toddler, but also enjoyed some of the more educational games it had to offer. Unfortunately, I lost that e-mail login and am unable to uncover the photos from that blog.

I had used an earlier distribution of Ubuntu to cross compile the kernel, to be able to provide touchscreen driver support. Otherwise, it was just a screen. This helped me dive more deep into Linux and its capabilities.

I utilized the CNC machine to encase the LCD and the rest of the device in acrylic, using DesignCAD 3D MAX to create models.

Python Plugins

Aside from this website, I do enjoy learning more and more about programming. Check out my Github for work I published there.

I created a python script called "triplegeo.py", which is a plugin for a raspberry pi device that determines the geolocation of devices. It attempts to get coordinates via GPS (gpsd), then it will fall back to Google's geolocation API, and then it falls back to WiGLE's geolocation API. Then it does the data logged to a .jsonl file, creating content to send via webhook to a messaging platform. This also optionally uploads scan data to WiGLE. This is useful for wardriving, mapping, and archiving discoveries with context. This is a great tool for WiFi analysis. The entire messaging output includes SSID, BSSID, Client, Vendor, Signal, SNR, Channel, Frequency, Band, Encryption, Latitude, Longitude, Altitude(and from what source) Supported Rates, VendorTags, Timestamp, Vendor by OUI lookup, Device fingerprint and the associated .pcap file name to Discord.

The script also outputs a clean .gps.json file, which is compatible with other features and plugins built for the device.

"pcapmerger.py" I created this because I simply was not sure if .pcap files were being merged. This automatically merges validated .pcap files, upon discovering there is an internet connection. Either over OTG, or Bluetooth tethering.

This is a simple one:ble_wardrive.py. This simply scans on an interval, on its own loop. Meaning, it does not require an event to start scanning, just the device being turned on and the plugin enabled in config.toml. This is another one that will send messages to Discord via webhook if there is internet available. All it does, is scan what devices are around, reports Address, Vendor, RSSI, Type, whether or not it is a Mesh Network, Vulnerabilities, Anomalies, Rogue broadcast or not, Latitude, Longitude, Altitude, and from what location source it determines location, whether from GPS or Geo location API. Using Manufacturer Data, parsing a few bytes of transmitted information to help determine what the device is. It also utilizes IEEE OUI to attempt to determine also what vendor the bluetooth address is from.

In short, ble_wardrive.py continuously scans for devices, it extracts signal, service and manufacturer payloads, resolving MAC OUIs and BLE Company IDs using a local database, enriches this data with GPS coordinates, determines vulnerabilities, anomalies, and rogue behavior. Formatting all of this in a neat, clean message it sends over the internet for observation.

The hardware I added, pictured above with the RSSI scale, is a M10Q-5883 GPS. This has GPS/GLONASS/BeiDou support, providing a quick and accurate satellite lock. It includes a magnetometer for real-time heading, i2c interface, UART/SPI for NMEA output with its own onboard RTC.

I had some folks reach out to me about some help. They wanted me to help them fix their plugin, so I accepted. The SATpwn plugin, short for Smart Auto-Tune is a one-of-a-kind plugin that replaces the existing decision making process with a more intelligent, adaptive algorithmic process. This focuses on efficient channel hopping and client selection. It features multiple modes to adapt to different environments. This features also to have the "Controls mode" function, write to a .json file periodically, and include logic where upon plugin ready, it reads the .json file and selects what mode you left off of for a more seamless experience. On the image below, on the left hand side, is a working example of the SATpwn script.

The image above, on the right hand side, is a quick, yet secure web application I made for my server and the other developers on the SATpwn project. This helps enumerate long logs, allows for secure uploads for debugging purposes and for helping understand the plugin further. This is all behind a secure login page written in JavaScript.

Python Scripts for PC

This is a Python script meant to be used with Windows OS, over Command Prompt. "HASHAUTO.py" This I created because I am trained in Cybersecurity, which I gained at my time subcontracting with NASA and providing technical support to various individuals and businesses. To help provide individuals or businesses with better internet and local security. This script in particular, streamlines the process of cracking WiFi networks. It optionally transfers handshake files from a Raspberry Pi to Windows via SCP. It then iterates through all the .2200 and .hc2200 files in a specified directory, from within the script. It tracks progress, but also prints out real-time feedback.

Updates to the Server

While I don't run enterprise-grade hardware at home, I operate my equipment following homelab best practices. Its primary use is a file server and web server. My current setup costs approximately $22 annually - including domain registration and electricity - compared to $120-$250 monthly for a Dell PowerEdge 7xx series server.

The server (pictured above) is a Raspberry Pi 5 with 8GB RAM, 1TB NVMe drive via PCIe HAT, and a PD Power HAT for automatic power recovery. Operating temperatures stay between 70-85°F while running multiple services. This replaced an older Raspberry Pi 3B and provides significantly better performance. Future upgrades include expanding network capacity from 1 Gbps to 2.5 Gbps, and utilizing Python to identify malware via Pi-hole Queries through alerts and automation more quickly.

I've implemented automated service health monitoring for a web server, fail2ban, Pi-hole, ntopng, and Flask applications with crontab. The system sends webhook notifications for service status changes, fail2ban IP bans with jail information, and daily system statistics including CPU, RAM, disk usage, and temperature. Each day these reports are created, and logs are uploaded for security auditing.

The screenshot above shows a daily report notification. Recent bans were botnet scanners probing for vulnerabilities, which prompted additional security hardening. Running DietPi (Debian-based) provides extensive configuration options and familiarity with standard Linux tools. Python scripts are calling in cron, keeping it running.

Log Parser

Below is a condensed example of the Flask parser API, it is not functioning, if you were thinking of copying this. ATTACK_PATTERNS is only based upon what I had seen in my own logs, botnet scanners and vulnerability probes that were hitting my server. This script below is very incomplete, and may evolve over time if and when new patterns emerge, especially the one I actually use. Thus far, PHP/WordPress scanning, config file enumeration, path traversal, XSS attempts, SQL injection, and Cisco VPN exploits.

from flask import Flask, request, jsonify
import jwt
import bcrypt
import os
from datetime import datetime, timedelta
import json
import csv
from werkzeug.utils import secure_filename
import re
from collections import Counter

app = Flask(__name__)
app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY', 'change-in-production')
app.config['UPLOAD_FOLDER'] = './uploads'
app.config['MAX_CONTENT_LENGTH'] = 24 * 1024 * 1024

ALLOWED_EXTENSIONS = {'log', 'txt', 'json', 'csv', 'zip', 'pcap', 'cap'}

# Attack pattern detection
ATTACK_PATTERNS = [
    r'\.php[^/]*$',
    r'wp-admin|wp-content',
    r'\.env|\.git',
    r'\.\./|\.\.\\',
    r'<script|javascript:',
    r'union.*select',
]

LEGITIMATE_PATTERNS = [
    r'^/$',
    r'^/favicon\.ico',
    r'\.(css|js|png|jpg)$',
]

def authenticate_token(token):
    try:
        return jwt.decode(token, app.config['SECRET_KEY'], algorithms=['HS256'])
    except:
        return None

def require_auth(f):
    def decorated(*args, **kwargs):
        auth_header = request.headers.get('Authorization')
        if not auth_header:
            return jsonify({'error': 'Token required'}), 401
        token = auth_header.split(' ')[1]
        payload = authenticate_token(token)
        if not payload:
            return jsonify({'error': 'Invalid token'}), 401
        request.current_user = payload
        return f(*args, **kwargs)
    decorated.__name__ = f.__name__
    return decorated

def is_attack_request(path, user_agent):
    for pattern in LEGITIMATE_PATTERNS:
        if re.search(pattern, path, re.IGNORECASE):
            return False
    for pattern in ATTACK_PATTERNS:
        if re.search(pattern, path, re.IGNORECASE):
            return True
    return False

def parse_apache_log_enhanced(filepath):
    pattern = r'^(\S+)\s+\S+\s+-\s+\[([^\]]+)\]\s+"([^"]+)"\s+(\d+)\s+(\d+)'
    stats = {
        'total_requests': 0,
        'attack_requests': 0,
        'unique_ips': 0,
        'attacker_ips': [],
        'status_codes': {},
        'top_paths': [],
    }
    
    ip_counter = Counter()
    attacker_ips = Counter()
    path_counter = Counter()
    
    with open(filepath, 'r', errors='ignore') as f:
        for line in f:
            match = re.match(pattern, line)
            if not match:
                continue
            
            source_ip, timestamp, request, status, size = match.groups()
            req_parts = request.split()
            path = req_parts[1] if len(req_parts) > 1 else ''
            user_agent = line.split('"')[-2] if '"' in line else ''
            
            stats['total_requests'] += 1
            ip_counter[source_ip] += 1
            path_counter[path] += 1
            
            if is_attack_request(path, user_agent):
                stats['attack_requests'] += 1
                attacker_ips[source_ip] += 1
    
    stats['unique_ips'] = len(ip_counter)
    stats['attacker_ips'] = [{'ip': ip, 'count': c} for ip, c in attacker_ips.most_common(10)]
    stats['top_paths'] = [{'path': p, 'count': c} for p, c in path_counter.most_common(20)]
    
    return stats

def parse_pihole_csv(filepath):
    stats = {'total_queries': 0, 'blocked_queries': 0, 'top_domains': []}
    top_domains = Counter()
    
    with open(filepath, 'r', errors='ignore') as f:
        reader = csv.DictReader(f)
        for row in reader:
            stats['total_queries'] += 1
            domain = row.get('domain', '').strip()
            status = row.get('status', '0').strip()
            
            if domain:
                top_domains[domain] += 1
            if status in ['1', '4', '5', '6', '7', '8']:
                stats['blocked_queries'] += 1
    
    stats['top_domains'] = [{'domain': d, 'count': c} for d, c in top_domains.most_common(20)]
    return stats

def parse_pwnagotchi_log(filepath):
    stats = {'handshakes': 0, 'unique_aps': 0, 'deauths_sent': 0}
    aps_set = set()
    
    with open(filepath, 'r', errors='ignore') as f:
        for line in f:
            if 'handshake' in line.lower():
                stats['handshakes'] += 1
                mac = re.search(r'([0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}', line)
                if mac:
                    aps_set.add(mac.group())
            if 'deauth' in line.lower():
                stats['deauths_sent'] += 1
    
    stats['unique_aps'] = len(aps_set)
    return stats

@app.route('/api/auth/login', methods=['POST'])
def login():
    data = request.get_json()
    username = data.get('username')
    password = data.get('password')
    
    # Verify credentials (bcrypt hash check)
    if verify_user(username, password):
        token = jwt.encode({
            'username': username,
            'exp': datetime.utcnow() + timedelta(hours=8)
        }, app.config['SECRET_KEY'], algorithm='HS256')
        return jsonify({'token': token})
    return jsonify({'error': 'Invalid credentials'}), 401

@app.route('/api/upload', methods=['POST'])
@require_auth
def upload():
    if 'file' not in request.files:
        return jsonify({'error': 'No file'}), 400
    
    file = request.files['file']
    filename = secure_filename(file.filename)
    filepath = os.path.join(app.config['UPLOAD_FOLDER'], filename)
    file.save(filepath)
    
    return jsonify({'success': True, 'filename': filename})

@app.route('/api/analyze', methods=['GET'])
@require_auth
def analyze():
    filename = request.args.get('file')
    filepath = os.path.join(app.config['UPLOAD_FOLDER'], filename)
    
    if filename.endswith('.csv'):
        return jsonify(parse_pihole_csv(filepath))
    elif 'pwnagotchi' in filename.lower():
        return jsonify(parse_pwnagotchi_log(filepath))
    else:
        return jsonify(parse_apache_log_enhanced(filepath))

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5001)

But wait, there's more...

There is another app running constantly that watches the logs and that is called fail2ban. This is configured with what is called custom jails that detect IoT exploit attempts, SQL injection patterns, and path traversal attacks. When activity is detected by fail2ban, it automatically creates firewall rules to block the IP address where that activity originates from. There are discord notifications whenever there is an IP address banned.

I created a bash-based system that runs cron twice daily. It has three modes, daily, monitor (for continuous checking) and test to verify webhook connectivity.

Custom Banner

I customized the login banner that displays when I SSH into the server. DietPi usually just displays live information when you login, but I've included a command cheat sheet I am able to easily reference. I included things like uptime, top processes using CPU and RAM, but also quick reference to commands of all the tools I mentioned above.

There is a Christmas tree written by the DietPi devs with their seasons greetings, with device model, temperature, and IP. I added the custom banner because while I thought the fish app for the command line was great with the memory, this gives me an immediate reminder, which saves me from having to use a post-it note.

Since I've written this, I actually had migrated away from using Discord for notifications, and installed an instance of ntfy. This tightens up security a little bit, though it was a webhook into a private space, it went through Discord's servers, into a Discord server. Ntfy has no rate limits, I can send thousands of notifications if I wanted to from my server. It is self-hosted, on my own hardware. This way all my data will stay on the local network, which is great for sensitive data. I can utilize the VPN tunnel I had setup if I need to view information remotely.