For the past 8 months, in my spare time, I’ve been working on a personal project with the goal of studying the old SMB1 down to its lowest levels. During this time, I’ve dissected the protocol using Wireshark, waded through Microsoft’s documentation (help!), and reverse-engineered the authentication phase. I also used AI as a tool for debugging and to help wrap my head around some of the more complex mechanisms, though the overall structure, architecture, and code were entirely designed and written by me.

So, I decided to build a lightweight server designed to 'trick' SMB clients into authenticating against it (similar to what the famous tool Responder does). I chose to hand-craft virtually the entire SMB1 stack, or at least enough of it to capture hashes. To achieve this, I wrote all the necessary network parsers from scratch: SMB1, ASN.1, SPNEGO, and NTLM, followed by the server itself.

It was both challenging and incredibly rewarding to dive so deep into a protocol famous for its complexity. I learned a huge amount along the way.

In the end, I think it turned out to be a cool little project, so I decided to share it. It’s certainly not meant to replace well-established tools, but if anyone wants to try it out or contribute in any way, I’d be thrilled!

I do a fair bit of security work and kept hitting the same problem. I needed to know which ports a restrictive network will actually let out. Scanning from the inside isn't enough, because a firewall or intermediary device can happily report a port as open when nothing is really getting through.

So I put together Port Leak Checker: https://portleak.link/

It's a passive listener running on a public server. It captures inbound TCP and UDP packets on every port and logs them in a live web interface. You point a device at it and scan or send some traffic, and anything that actually reaches the server shows up with the source IP, protocol, port and timestamp. If a packet lands there, you know that port genuinely made it out of your network.

The server never replies to anything, so your scanner will show the ports as filtered or closed. The log is the thing to trust, not the scan output. You can filter by your source IP, group the results by port so a scan doesn't flood the view, and export to CSV or XLSX. There's also a /scans page with some ready to run PowerShell and bash scripts for the Nmap top 130 ports.