Green Shoe Garage est. 2012
FI Field Instruments · Security Toolkit
Instruments for security work and tradecraft: reference, provenance signing, payload tooling, engagement records, network forensics, and physical-security assessment. All offline and defender-framed. Source on GitHub under GPL-3.0.
01
A field reference across nine hacker disciplines, hardware, RF spectrum, telephony, networking, physical security, forensics, cryptography, subculture, and tradecraft, with working bench tools built in: a hex inspector, CIDR calculator, DTMF and hash workbenches, an Enigma simulator, and a one-time-pad generator. Field Instrument 041.
02
A provenance certificate generator that signs documents with ECDSA so their authenticity can be independently verified against a public key.
03
A DuckyScript workbench: write, lint, and narrate payloads, then compile to a classic inject.bin, a Flipper BadUSB script, or plain DuckyScript, and read an existing inject.bin back to source. For authorized testing and security education.
04
A sealed casefile for security engagements: capture scope, rules of engagement, and a timestamped findings log, then sign the whole record with ECDSA so it cannot be altered after sealing.
05
A self-contained field kit for network forensics and vulnerability triage: MAC parsing and OUI lookup, CVSS 3.1 and 4.0 scoring with shareable vectors, and encode, decode, and hash tools.
06
A modular field kit for authorized physical security assessments. Eleven instruments share one chassis, from lock and credential references to walking surveys and RF exposure rating to a client report compiler, all weighted toward documentation and remediation.
07
A wireless security audit watch console for the browser. Picket stands watch over the WiFi and BLE emissions of a place and calls out what an audit cares about: open and weak networks, evil-twin candidates, hidden SSIDs, and trackable or self-identifying Bluetooth devices.
08
A plain-language website security survey for small business owners. Enter your web address and Observatory explains, in words a non-technical owner understands, what an outsider can see, why each finding matters to the business, and who fixes it.
09
An offline packet capture reader. Drop a .pcap or .pcapng on the page and get conversations, a protocol breakdown, a timing ladder, and a plain-language account of what the traffic was doing. Nothing is uploaded, nothing is installed, one HTML file. Dragnet is the wired counterpart to Picket: Picket watches the air live and renders verdicts on what it hears, Dragnet reads a file after the fact and reconstructs the story.
10
A local-first API and webhook testing instrument. Build requests, inspect responses, receive webhook events, replay traffic, validate behavior, and produce test evidence. Built to feel like an engineering test bench rather than a generic developer console.
11
A local-first industrial-network inspection and documentation instrument for Modbus, BACnet, and LonWorks evidence. An authorized user can capture or import traffic, decode protocol records, reconstruct conversations, map observed relationships, compare a current condition against baselines and design documentation, preserve investigation evidence, and assemble repeatable commissioning or troubleshooting reports.
12
A remote-session diagnostic for when someone cannot reliably hold a connection and every party they ask blames a different party: the local link, the ISP, the VPN, the gateway or broker, the far end, or their own machine going to sleep. You declare the shape of your remote access path; Sounding works out which parts a browser can actually touch, probes them continuously, and produces an evidence package that names candidate causes alongside the observations supporting each one and the observations that would have contradicted each one. It is scrupulous about the difference between what it measured and what it inferred, and the evidence package is built to be the strongest thing in the room when you hand it to IT or your ISP. It is not an RDP tool; RDP is one profile in a table of thirteen.
13
A benchtop embedded and IoT security assessment conductor. One researcher, one connected device, authorization through coordinated disclosure. Touchstone is the test plan you work through, the bench it tells you to set up, the lab notebook you keep while working, the findings it collects, and the disclosure package it hands the vendor.
14
Roundsman records an assessment. It performs nothing, it certifies nothing, and it carries no payloads, no exploits, and no wordlists. Every verdict in it is a human observation that you typed in. It exists because the dentist, the machine shop, and the water district all have the same problem: the person who can pick the back door and the person who can read the firewall rules are two different people, and nobody writes down the hallway between them.
15
A browser bench for the Proxmark3 that speaks the device USB wire protocol directly over Web Serial. One self-contained HTML file, no install, no build step, no server. It runs offline from disk and ships with a demo device, so the whole thing works with nothing plugged in.
16
A browser-first reverse-engineering instrument for inspecting binaries locally, featuring Code Atlas, a signature whole-program landscape view.
17
A local-first browser threat-modeling instrument for engineering teams. It connects architecture, data flows, trust boundaries, assets, interfaces, threats, mitigations, requirements, verification, evidence, review, baselines, and approvals into one traceable engineering model.
18
A local-first browser instrument for inspecting what USB devices claim to be: it preserves descriptor fingerprints, compares devices against known-good baselines, validates fleets or manufacturing lots, and carries evidence forward into downstream verification workflows.
19
A local-first browser firewall and ACL analyzer.
20
A browser-based serial evidence recorder and engineering evidence system, consolidating capture, investigation, comparison, qualification, device automation, endurance, reporting, and evidence-package capabilities.
21
A local-first security architecture review instrument, hardened for production use.
22
A local-first browser instrument for inspecting software and firmware component inventories, dependency relationships, revision history, provenance, licensing, maintenance evidence, vulnerability intelligence, release assurance, and engineering review evidence.
23
A local-first browser application for examining saved RFC 5322 and .eml email evidence. It reconstructs identity, Received chains, recorded authentication evidence, MIME structure, URLs, attachments, timestamps, domains, IP addresses, potential tracking constructs, and deterministic forensic findings without contacting anything referenced by the message.
24
A local-first browser instrument for importing, normalizing, analyzing, comparing, reviewing, certifying, and documenting identity and access-control exports. It reconstructs effective access from explicit relationships and preserves the evidence needed to explain how each result was derived.
25
A local-first browser security timeline workbench for importing, normalizing, correlating, annotating, investigating, and exporting chronological security evidence.
26
A local-first certificate and PKI bench for static analysis of certificates, CSRs, chains, CRLs, CMS/PKCS#7, and RFC 3161 timestamps. It works only on artifacts in hand and contacts no OCSP, CRL, AIA, DNS, or CT services.
27
A local-first configuration baseline and drift analyzer. It imports configuration snapshots, normalizes and compares them, and turns raw differences into structured, reviewable findings and evidence, without scanning networks or contacting referenced systems.
28
A local-first service-exposure review instrument. It analyzes previously collected scan evidence (Nmap, Masscan, Nessus, or generic CSV), compares observed services against expected exposure baselines, and tracks remediation, without scanning networks or contacting targets.
29
A browser FTP client in the shape of FileZilla: message log, local and remote panes, and a transfer queue in one HTML file with no build step. It handles FTP and explicit or implicit FTPS, and because a browser cannot open a raw TCP socket it pairs with a small self-hosted Cloudflare Worker relay, one you deploy yourself, since the relay logs in as you and sees your password.
Nothing matches that. Try a shorter word.
Ready when you are
Concept to delivered product. Mechanical, electronics, and software, built under one roof. Quickly and within budget.
Schedule a consultation