Phase 4: Active modules, templates, and operator scripts

Active modules (9 files in modules/active/):
- bettercap_mgr: Central bettercap orchestrator with REST API health
  monitoring, event stream parsing, crash recovery with corrective
  gratuitous ARPs, caplet management, and process disguise
- arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings
- dns_poison: DNS poisoning with zone template loading support
- dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection
- evil_twin: hostapd-based rogue AP with captive portal and dnsmasq,
  iptables redirect, credential capture via HTTP POST handler
- ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse
- responder_mgr: Responder subprocess manager with hash file monitoring,
  NTLMv1/v2 parsing, session log scanning, relay target coordination
- mitmproxy_mgr: Transparent proxy with addon scripts, tier checking
  (OPi Zero 3+ only), iptables setup, credential/token extraction
- ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP,
  LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS

Templates (9 files):
- 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN
  (self-contained HTML with inline CSS, realistic login forms)
- 2 DNS zones: redirect-all and selective Jinja2 template
- 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates
- 1 Responder.conf Jinja2 template with protocol toggles

Operator scripts (6 files in scripts/operator/):
- pull_data.sh: rsync structured data over WireGuard/Tailscale
- extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction
- extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert
- extract_emails.sh: SMTP email extraction with attachment detection
- crack_hashes.sh: Export creds to hashcat format, optional auto-crack
- generate_report.py: SQLite-to-Markdown/HTML engagement report generator

templates/hostapd/wpa2.conf.j2

@@ -0,0 +1,45 @@
+# BigBrother hostapd configuration — WPA2-PSK AP
+#
+# Used by evil_twin.py for WPA2 evil twin attacks.
+# Requires knowing or guessing the target PSK.
+# Jinja2 variables:
+#   interface: Wireless interface (e.g., "wlan0")
+#   ssid: Target SSID to clone
+#   channel: WiFi channel (1-11 for 2.4GHz)
+#   wpa_passphrase: WPA2 pre-shared key
+#   driver: Wireless driver (default: nl80211)
+#   hw_mode: Hardware mode (default: g for 2.4GHz)
+#   country_code: Regulatory domain (default: US)
+#   beacon_int: Beacon interval in ms (default: 100)
+
+interface={{ interface | default('wlan0') }}
+driver={{ driver | default('nl80211') }}
+ssid={{ ssid }}
+hw_mode={{ hw_mode | default('g') }}
+channel={{ channel | default(6) }}
+country_code={{ country_code | default('US') }}
+ieee80211d=1
+
+# WPA2-PSK configuration
+auth_algs=1
+wpa=2
+wpa_passphrase={{ wpa_passphrase }}
+wpa_key_mgmt=WPA-PSK
+wpa_pairwise=CCMP
+rsn_pairwise=CCMP
+
+# Beacon and capabilities
+beacon_int={{ beacon_int | default(100) }}
+wmm_enabled=1
+macaddr_acl=0
+ignore_broadcast_ssid=0
+
+# 802.11n support
+ieee80211n=1
+ht_capab=[HT40+][SHORT-GI-20][SHORT-GI-40]
+
+# Logging
+logger_syslog=-1
+logger_syslog_level=2
+logger_stdout=-1
+logger_stdout_level=2