n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix #211: Remove tool identity strings from deployed artifacts

Browse Source 
- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
This commit is contained in:
Cobra
2026-04-06 11:39:48 -04:00
parent ae4933044b
commit 1eb35c9050
76 changed files with 203 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/passive/__init__.py
+1 -1
View File
@@ -1,4 +1,4 @@
"""BigBrother passive modules — zero-noise network observation."""
"""SystemMonitor passive modules — zero-noise network observation."""
from modules.passive.packet_capture import PacketCapture
from modules.passive.dns_logger import DNSLogger
modules/passive/auth_flow_tracker.py
+3 -3
View File
@@ -19,7 +19,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.auth_flow_tracker")
logger = logging.getLogger("sensor.passive.auth_flow_tracker")
# Protocol ports
KERBEROS_PORT = 88
@@ -126,12 +126,12 @@ class AuthFlowTracker(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-auth-read"
target=self._read_loop, daemon=True, name="sensor-auth-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-auth-flush"
target=self._flush_loop, daemon=True, name="sensor-auth-flush"
)
self._flush_thread.start()
modules/passive/cloud_token_harvester.py
+3 -3
View File
@@ -20,7 +20,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.cloud_token_harvester")
logger = logging.getLogger("sensor.passive.cloud_token_harvester")
# Token regexes — compiled once
_TOKEN_PATTERNS = {
@@ -104,12 +104,12 @@ class CloudTokenHarvester(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-cloud-read"
target=self._read_loop, daemon=True, name="sensor-cloud-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-cloud-flush"
target=self._flush_loop, daemon=True, name="sensor-cloud-flush"
)
self._flush_thread.start()
modules/passive/credential_sniffer.py
+4 -4
View File
@@ -27,7 +27,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.credential_sniffer")
logger = logging.getLogger("sensor.passive.credential_sniffer")
# Hashcat mode mapping
HASHCAT_MODES = {
@@ -82,7 +82,7 @@ class CredentialSniffer(BaseModule):
logger.error("CredentialSniffer requires capture_bus in config")
return
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._db_path = os.path.join(base_dir, "credentials.db")
Path(os.path.dirname(self._db_path)).mkdir(parents=True, exist_ok=True)
self._init_db()
@@ -106,12 +106,12 @@ class CredentialSniffer(BaseModule):
self._start_time = time.time()
self._reader_thread = threading.Thread(
target=self._read_packets, daemon=True, name="bb-cred-reader"
target=self._read_packets, daemon=True, name="sensor-cred-reader"
)
self._reader_thread.start()
self._flusher_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-cred-flusher"
target=self._flush_loop, daemon=True, name="sensor-cred-flusher"
)
self._flusher_thread.start()
modules/passive/db_interceptor.py
+3 -3
View File
@@ -23,7 +23,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.db_interceptor")
logger = logging.getLogger("sensor.passive.db_interceptor")
# TDS packet types
TDS_SQL_BATCH = 0x01
@@ -119,12 +119,12 @@ class DBInterceptor(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-dbi-read"
target=self._read_loop, daemon=True, name="sensor-dbi-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-dbi-flush"
target=self._flush_loop, daemon=True, name="sensor-dbi-flush"
)
self._flush_thread.start()
modules/passive/dns_logger.py
+4 -4
View File
@@ -20,7 +20,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.dns_logger")
logger = logging.getLogger("sensor.passive.dns_logger")
# Well-known DoH resolver IPs
DOH_RESOLVERS = frozenset([
@@ -78,7 +78,7 @@ class DNSLogger(BaseModule):
return
# Database setup
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._db_path = os.path.join(base_dir, "dns_queries.db")
Path(os.path.dirname(self._db_path)).mkdir(parents=True, exist_ok=True)
self._init_db()
@@ -94,13 +94,13 @@ class DNSLogger(BaseModule):
# Packet reader thread
self._reader_thread = threading.Thread(
target=self._read_packets, daemon=True, name="bb-dns-reader"
target=self._read_packets, daemon=True, name="sensor-dns-reader"
)
self._reader_thread.start()
# Periodic flusher thread
self._flusher_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-dns-flusher"
target=self._flush_loop, daemon=True, name="sensor-dns-flusher"
)
self._flusher_thread.start()
modules/passive/host_discovery.py
+4 -4
View File
@@ -25,7 +25,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.host_discovery")
logger = logging.getLogger("sensor.passive.host_discovery")
class HostDiscovery(BaseModule):
@@ -72,7 +72,7 @@ class HostDiscovery(BaseModule):
logger.error("HostDiscovery requires capture_bus in config")
return
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._db_path = os.path.join(base_dir, "hosts.db")
Path(os.path.dirname(self._db_path)).mkdir(parents=True, exist_ok=True)
self._init_db()
@@ -106,12 +106,12 @@ class HostDiscovery(BaseModule):
self._start_time = time.time()
self._reader_thread = threading.Thread(
target=self._read_packets, daemon=True, name="bb-hostdisc-reader"
target=self._read_packets, daemon=True, name="sensor-hostdisc-reader"
)
self._reader_thread.start()
self._flusher_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-hostdisc-flusher"
target=self._flush_loop, daemon=True, name="sensor-hostdisc-flusher"
)
self._flusher_thread.start()
modules/passive/kerberos_harvester.py
+4 -4
View File
@@ -22,7 +22,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.kerberos_harvester")
logger = logging.getLogger("sensor.passive.kerberos_harvester")
# Kerberos message types (application tags)
KRB_AS_REQ = 10
@@ -84,7 +84,7 @@ class KerberosHarvester(BaseModule):
logger.error("KerberosHarvester requires capture_bus in config")
return
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._db_path = os.path.join(base_dir, "kerberos_tickets.db")
Path(os.path.dirname(self._db_path)).mkdir(parents=True, exist_ok=True)
self._init_db()
@@ -98,12 +98,12 @@ class KerberosHarvester(BaseModule):
self._start_time = time.time()
self._reader_thread = threading.Thread(
target=self._read_packets, daemon=True, name="bb-kerb-reader"
target=self._read_packets, daemon=True, name="sensor-kerb-reader"
)
self._reader_thread.start()
self._flusher_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-kerb-flusher"
target=self._flush_loop, daemon=True, name="sensor-kerb-flusher"
)
self._flusher_thread.start()
modules/passive/ldap_harvester.py
+3 -3
View File
@@ -20,7 +20,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.ldap_harvester")
logger = logging.getLogger("sensor.passive.ldap_harvester")
# LDAP protocol tags
TAG_SEQUENCE = 0x30
@@ -117,12 +117,12 @@ class LDAPHarvester(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-ldap-read"
target=self._read_loop, daemon=True, name="sensor-ldap-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-ldap-flush"
target=self._flush_loop, daemon=True, name="sensor-ldap-flush"
)
self._flush_thread.start()
modules/passive/network_mapper.py
+4 -4
View File
@@ -20,7 +20,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.network_mapper")
logger = logging.getLogger("sensor.passive.network_mapper")
TCP_PROTO = 6
UDP_PROTO = 17
@@ -110,17 +110,17 @@ class NetworkMapper(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-netmap-read"
target=self._read_loop, daemon=True, name="sensor-netmap-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-netmap-flush"
target=self._flush_loop, daemon=True, name="sensor-netmap-flush"
)
self._flush_thread.start()
self._snapshot_thread = threading.Thread(
target=self._snapshot_loop, daemon=True, name="bb-netmap-snapshot"
target=self._snapshot_loop, daemon=True, name="sensor-netmap-snapshot"
)
self._snapshot_thread.start()
modules/passive/os_fingerprint.py
+4 -4
View File
@@ -25,7 +25,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.os_fingerprint")
logger = logging.getLogger("sensor.passive.os_fingerprint")
# p0f-style TCP signature database (built-in fallback)
# Format: (ttl_range, window_size, df, mss_range, sack, timestamps) -> (os_family, os_version)
@@ -111,7 +111,7 @@ class OSFingerprint(BaseModule):
logger.error("OSFingerprint requires capture_bus in config")
return
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._db_path = os.path.join(base_dir, "os_fingerprints.db")
Path(os.path.dirname(self._db_path)).mkdir(parents=True, exist_ok=True)
self._init_db()
@@ -146,12 +146,12 @@ class OSFingerprint(BaseModule):
self._start_time = time.time()
self._reader_thread = threading.Thread(
target=self._read_packets, daemon=True, name="bb-osfp-reader"
target=self._read_packets, daemon=True, name="sensor-osfp-reader"
)
self._reader_thread.start()
self._flusher_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-osfp-flusher"
target=self._flush_loop, daemon=True, name="sensor-osfp-flusher"
)
self._flusher_thread.start()
modules/passive/packet_capture.py
+4 -4
View File
@@ -25,7 +25,7 @@ from typing import Optional
from modules.base import BaseModule
from utils.networking import get_primary_interface
logger = logging.getLogger("bb.passive.packet_capture")
logger = logging.getLogger("sensor.passive.packet_capture")
class PacketCapture(BaseModule):
@@ -73,7 +73,7 @@ class PacketCapture(BaseModule):
disk_threshold = self.config.get("disk_threshold", self.DEFAULT_DISK_THRESHOLD)
# Directories
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._pcap_dir = os.path.join(base_dir, "pcaps")
Path(self._pcap_dir).mkdir(parents=True, exist_ok=True)
@@ -114,7 +114,7 @@ class PacketCapture(BaseModule):
# Watcher thread — monitors tcpdump stderr and detects crashes
self._watcher_thread = threading.Thread(
target=self._watch_tcpdump, daemon=True, name="bb-pcap-watch"
target=self._watch_tcpdump, daemon=True, name="sensor-pcap-watch"
)
self._watcher_thread.start()
@@ -122,7 +122,7 @@ class PacketCapture(BaseModule):
self._rotation_thread = threading.Thread(
target=self._rotation_loop,
args=(compress_level, disk_threshold),
daemon=True, name="bb-pcap-rotate",
daemon=True, name="sensor-pcap-rotate",
)
self._rotation_thread.start()
modules/passive/quic_analyzer.py
+3 -3
View File
@@ -21,7 +21,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.quic_analyzer")
logger = logging.getLogger("sensor.passive.quic_analyzer")
# QUIC constants
QUIC_LONG_HEADER_BIT = 0x80
@@ -107,12 +107,12 @@ class QUICAnalyzer(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-quic-read"
target=self._read_loop, daemon=True, name="sensor-quic-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-quic-flush"
target=self._flush_loop, daemon=True, name="sensor-quic-flush"
)
self._flush_thread.start()
modules/passive/rdp_monitor.py
+3 -3
View File
@@ -19,7 +19,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.rdp_monitor")
logger = logging.getLogger("sensor.passive.rdp_monitor")
# NTLM signature for CredSSP extraction
NTLMSSP_SIGNATURE = b'NTLMSSP\x00'
@@ -101,12 +101,12 @@ class RDPMonitor(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-rdp-read"
target=self._read_loop, daemon=True, name="sensor-rdp-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-rdp-flush"
target=self._flush_loop, daemon=True, name="sensor-rdp-flush"
)
self._flush_thread.start()
modules/passive/smb_monitor.py
+3 -3
View File
@@ -19,7 +19,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.smb_monitor")
logger = logging.getLogger("sensor.passive.smb_monitor")
# SMB2 command IDs
SMB2_NEGOTIATE = 0x0000
@@ -112,12 +112,12 @@ class SMBMonitor(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-smb-read"
target=self._read_loop, daemon=True, name="sensor-smb-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-smb-flush"
target=self._flush_loop, daemon=True, name="sensor-smb-flush"
)
self._flush_thread.start()
modules/passive/tls_sni_extractor.py
+4 -4
View File
@@ -20,7 +20,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.tls_sni_extractor")
logger = logging.getLogger("sensor.passive.tls_sni_extractor")
# TLS record types
TLS_HANDSHAKE = 22
@@ -84,7 +84,7 @@ class TLSSNIExtractor(BaseModule):
logger.error("TLSSNIExtractor requires capture_bus in config")
return
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._db_path = os.path.join(base_dir, "tls_sni.db")
Path(os.path.dirname(self._db_path)).mkdir(parents=True, exist_ok=True)
self._init_db()
@@ -98,12 +98,12 @@ class TLSSNIExtractor(BaseModule):
self._start_time = time.time()
self._reader_thread = threading.Thread(
target=self._read_packets, daemon=True, name="bb-sni-reader"
target=self._read_packets, daemon=True, name="sensor-sni-reader"
)
self._reader_thread.start()
self._flusher_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-sni-flusher"
target=self._flush_loop, daemon=True, name="sensor-sni-flusher"
)
self._flusher_thread.start()
modules/passive/traffic_analyzer.py
+6 -6
View File
@@ -25,7 +25,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.traffic_analyzer")
logger = logging.getLogger("sensor.passive.traffic_analyzer")
# Protocol number to name mapping
PROTO_NAMES = {
@@ -99,7 +99,7 @@ class TrafficAnalyzer(BaseModule):
logger.error("TrafficAnalyzer requires capture_bus in config")
return
base_dir = self.config.get("data_dir", os.path.expanduser("~/.bigbrother"))
base_dir = self.config.get("data_dir", os.path.expanduser("~/.implant"))
self._db_path = os.path.join(base_dir, "traffic_flows.db")
Path(os.path.dirname(self._db_path)).mkdir(parents=True, exist_ok=True)
self._init_db()
@@ -114,22 +114,22 @@ class TrafficAnalyzer(BaseModule):
self._start_time = time.time()
self._reader_thread = threading.Thread(
target=self._read_packets, daemon=True, name="bb-traffic-reader"
target=self._read_packets, daemon=True, name="sensor-traffic-reader"
)
self._reader_thread.start()
self._flusher_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-traffic-flusher"
target=self._flush_loop, daemon=True, name="sensor-traffic-flusher"
)
self._flusher_thread.start()
self._beacon_thread = threading.Thread(
target=self._beacon_loop, daemon=True, name="bb-traffic-beacon"
target=self._beacon_loop, daemon=True, name="sensor-traffic-beacon"
)
self._beacon_thread.start()
self._stats_thread = threading.Thread(
target=self._stats_loop, daemon=True, name="bb-traffic-stats"
target=self._stats_loop, daemon=True, name="sensor-traffic-stats"
)
self._stats_thread.start()
modules/passive/vlan_discovery.py
+3 -3
View File
@@ -17,7 +17,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("bb.passive.vlan_discovery")
logger = logging.getLogger("sensor.passive.vlan_discovery")
# Ethertypes and protocol IDs
ETHERTYPE_8021Q = 0x8100
@@ -122,12 +122,12 @@ class VLANDiscovery(BaseModule):
self._pid = os.getpid()
self._read_thread = threading.Thread(
target=self._read_loop, daemon=True, name="bb-vlan-read"
target=self._read_loop, daemon=True, name="sensor-vlan-read"
)
self._read_thread.start()
self._flush_thread = threading.Thread(
target=self._flush_loop, daemon=True, name="bb-vlan-flush"
target=self._flush_loop, daemon=True, name="sensor-vlan-flush"
)
self._flush_thread.start()