Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

I did it. JavaScript vacuum is alive Wrote the code to control it in the browser via Web Serial API, or on the server with serialport

103,719 Aufrufe • vor 1 Jahr •via X (Twitter)

11 Kommentare

Profilbild von Ben Holmes
Ben Holmesvor 1 Jahr

Ohh so THATS what they meant by “clean code”

Profilbild von glueckkanja
glueckkanjavor 4 Jahren

Are you searching for a simple way to deploy device certificates with #Intune? Check out SCEPman at

Profilbild von defyus
defyusvor 1 Jahr

damn, i'm going to build a irobot army. so sick.

Profilbild von Wes Bos
Wes Bosvor 1 Jahr

we should fight them

Profilbild von monika 🐢
monika 🐢vor 1 Jahr

you can attach the blutooth module in vaccum then move using bluetooth from browser

Profilbild von Wes Bos
Wes Bosvor 1 Jahr

thats what I'm looking at right now - I have an ESP32 which I think I can load some sort of serial bridge onto. Wifi would be even better

Profilbild von Sahazel
Sahazelvor 1 Jahr

bro will do ANYTHING but touch C😭 impressive tho

Profilbild von Jared Folkins 🇺🇸
Jared Folkins 🇺🇸vor 1 Jahr

JavaScript literally sucks

Profilbild von psk
pskvor 1 Jahr

This is very cool Bos. Looking forward for learn more about this.

Profilbild von Al Mac
Al Macvor 1 Jahr

This seems to be the most epic side project I’ve seen so far in 2025. Consider: If you add a flamethrower on it you can add “built killer robot” to your CV.

Profilbild von Chris Smith
Chris Smithvor 1 Jahr

Sweet. Has me thinking 🤔

Ähnliche Videos

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

216,817 Aufrufe • vor 5 Monaten