Code at http://samy.pl/keysweeper
KeySweeper is a stealthy Arduino-based device, camouflaged as a functioning USB wall charger, that wirelessly and passively sniffs, decrypts, logs and reports back (over GSM) all keystrokes from any Microsoft wireless keyboard in the vicinity. All keystrokes are logged online and locally. SMS alerts are sent upon trigger words, usernames or URLs, exposing passwords. If unplugged, KeySweeper continues to operate using its internal battery and auto-recharges upon repowering. A web based tool allows live keystroke monitoring.

Code at http://samy.pl/usbdriveby
USBdriveby is a device you stylishly wear around your neck which can quickly and covertly install a backdoor and override DNS settings on an unlocked machine via USB in a matter of seconds. It does this by emulating a keyboard and mouse, blindly typing controlled commands, flailing the mouse pointer around and weaponizing mouse clicks, while evading certain security checks.

Code at http://samy.pl/skyjack
SkyJack is a drone using Raspberry Pi engineered to autonomously seek out, hack, and wirelessly take control over other drones within wireless distance, creating an army of zombie drones under your control.

Code at http://samy.pl/pwnat
pwnat allows full client-server tunneling and proxying even when both server and client are behind separate NATs with no port forwarding and no DMZ setup on their routers to directly communicate with each other. There is no middle man, no proxy, no 3rd party, and the server side requires no information on the client.

Code at http://samy.pl/evercookie
evercookie is a Javascript API that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they've removed standard cookies, Flash cookies (LSOs), and others. It currently stores cookies in over a dozen browser mechanisms, including standard HTTP cookies, Local Shared Objects (Flash Cookies), storing in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out, storing in web history, HTML5 Session Storage, HTML5 Local Storage, HTML5 Global Storage, and HTML5 Database Storage via SQLite.

Code at http://namb.la/popular
I developed the MySpace worm, the first XSS worm based on AJAX which proliferated through the MySpace network. Learn how I made over one million friends in less than 24 hours.

Code at http://samy.pl/androidmap
I discovered that the Apple iPhone, Google Android and Microsoft Windows phones constantly send geolocation/GPS and wifi router information back up to Apple, Google and Microsoft. The iPhone and Windows phones do this even when the user has chosen to turn GPS/Location Services off. Since my release of this research, Apple and Google have both testified in front of Congress and all three are now involved in various lawsuits due to potential invasion of privacy. Besides the companies tracking the locations of all of these phones, I've created a tool that exposes not only the GPS data, but the wifi data Google and Microsoft have been collecting from virtually all Android and Windows devices and Google street view cars, using them essentially as global wardriving machines. When the phone detects any wireless network, encrypted or not, it sends the BSSID (MAC address) of the router along with signal strength, and most importantly, GPS coordinates up to the mothership. My tool allows you to ping those databases and find exactly where any wifi router in the world is located. You can enter any router BSSID/MAC address to locate the exact physical location of the router. Try my Google tool here and my Microsoft tool here.

Code at http://github.com/Proxmark/proxmark3
I'm one of the primary developers of the proxmark3, a penetration testing tool for low and high-frequency RFID tags and readers, developed on an ARM7 microprocessor and Xilinx Spartan II FPGA. The device is capable of doing such things as read tags, simulate tags (such as HID badges), eavesdrop on transactions between another reader and tag, analyze a tag or signal passively, and more.

Code at http://samy.pl/quickjack
Quickjack is an intuitive, point-and-click tool for performing advanced and covert clickjacking and frame slicing attacks. The clickjacking frame follows the user no matter where they click on a page, automatically removes itself from the page once the click has been captured, and allows features such as referral scrubbing and frame breakout prevention.

Code at http://samy.pl/phpwn
Studying PHP's LCG (linear congruential generator, a pseudorandom number generator), I discovered that there are weaknesses that reduce the complexity of determining the sequence of pseudorandom numbers. What this means is that PHP is severely deficient in producing random session IDs or random numbers, leading to the possibility of stealing sessions or other sensitive information. The initial seed can be reduced from 64-bits to 35-bits, and with PHP code execution, can be reduced further down to just under 20-bits, which takes only seconds to recreate the initial seed.

Code at http://samy.pl/dingdong
Digital Ding Dong Ditch is a device I created to hack into and ring my best friend's wireless doorbell whenever I send a text message to the device. The best part of the device is that it causes my friend, without fail, to come outside, find no one, and go back in. In this project, we'll learn not only how to create this device, but how to reverse engineer radio frequencies we know nothing about using RTL-SDR (a ~$14 software defined radio), as well as creating hardware and software using Arduino, the Adafruit FONA (GSM/SMS/2G board), an RF (radio frequency) transmitter to transmit custom signals, and even how to reverse engineer a proprietary radio signal we know nothing about!

Code at http://samy.pl/natpin
My NAT Pinning technique is a method that forces a user's router or firewall, unbeknownst to them, to port forward any port number back to the user's machine, simply by the user visiting a web page. If the user had FTP/ssh/etc open but blocked from the router, it can now be forwarded for anyone to access (read: attack) from the outside world. No XSS or CSRF required.

Code at http://samy.pl/peepmail/
Peepmail is a tool that allows you to discover business email addresses for users, even if their email address may not be publicly available or shared.

Code at http://samy.pl/jiagra
jiagra is a stand-alone javascript API for automatic website performance enhancement. It currently features cross-browser pre-rendering/pre-fetching (allowing pages on your site to load in the background before the user has clicked on them), advanced setTimeout and setInterval control (detecting which timers/intervals are still running, have been cleared, or fired) which can allow for greater understanding of when *all* requests of a page have completed, and improved script tag support, allowing you to enter Javascript code in a single script tag that calls out to a remote URL, where the inline Javascript gets executed after the remote JS is executed, e.g.
< script src="path/to/script.js" >
this_is_called_after_script_is_loaded();
< /script >

Code at http://samy.pl/chownat
chownat allows two peers behind two separate NATs with no port forwarding and no DMZ setup on their routers to directly communicate with each other. There is no middle man, no proxy, no 3rd party, and the application runs as an unprivileged user on both ends.

Code at http://samy.pl/mapxss
By using XSS exploitation of a user's router, I've created a proof of concept which acquires the MAC address of the router of a web surfer, then uses the Google Service API to acquire geographic coordinates of the user (determined by the Google van driving around and seeing MAC address while tying it to coordinates.) This emulates Firefox's Location-Aware Browsing without requiring any permission from the user or requiring Firefox.

Code at http://samy.pl/packet
Packet is a suite of portable Perl modules for encoding, decoding, injecting and sniffing low-level network packets. Packet also provides functionality for other low-level network tasks such as retrieving network device information and working directly with ARP cache tables..

Code at http://samy.pl/airsamy.pl
airsamy provides a simple interface to quickly and automatically crack a WEP network in minutes. It displays a list of available WEP networks and once selected, it automatically places your driver in monitor mode, tests packet injection, fake authenticates with the AP, captures IVs for cracking, captures ARP packets and replays them to introduce more IVs into the network, and cracks using the PTW attack.

Code at http://samy.pl/oryx-attack.pl
I've implemented the ORYX stream cipher and a cryptanalytic attack able to recover the 96-bit internal key state in less than 2^20 ORYX operations. The ORYX stream cipher is used to encrypt data transmissions for the North American Cellular system.

Code at http://samy.pl/anti-mitma.pdf
I've described a simple method for authentication based protocols (e.g., ssh) to prevent man in the middle attacks. Rather than establishing a potentially MITMA'd connection, then authenticating, you can authenticate the initial key exchange. More details in the pdf.

Code at http://samy.pl/weap
I've implemented a version of Shamir's attack on WEP, easily recovering a WEP key from encrypted wireless traffic due to weak keys and poor IV mixing into the RC4 key.

Code at http://samy.pl/ains/
AI::NaturalSelection provides a series of Perl modules using Genetic Algorithms to allow breeding and mutation to arise and emulate natural selection. Resultant honing can minimize the work required to solve certain fitness-testable problems.

Code at http://samy.pl/sql++/
sql++ is an easily configurable, feature-rich, portable command-line SQL tool. It can be used with many different databases and in place of other command line tools such as MySQL's mysql-client, Microsoft SQL, PostgreSQL's psql, and Oracle's sqlplus. It has features such as multiple connections, multi-database interfacing, subselects for all databases, regardless of whether the database has native subselects or not, and much more.

Code at http://samy.pl/diss.zip
DISS (Download iTunes Shared Songs) automatically hooks into iTunes' memory (winsock) on Windows and downloads any shared music you play into the DISS playlist. No user intervention is required for this to happen, it's entirely automatic and typically only takes a second or two per song. Full C++ source and Windows binary included.

Code at http://samy.pl/code/?x=old
Older code, much of which is still relevant today.