n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
204 Commits 1 Branch 0 Tags
main
Commit Graph

15 Commits

Author SHA1 Message Date
Cobra 06c84e1800 Deploy presence daemon to OPi Zero 3 test implant 
sensor.service running at 10.0.0.0. ARP + DHCP sensors active.
Probe sniffer degraded (no wlan1). BLE degraded (BlueZ too old for or_patterns).
Untracked audit files committed for reference.
 2026-04-10 15:49:03 -04:00
n0mad1k c04ec0b9ea Add comprehensive test suites for 7 bigbrother modules 
Cover packet_capture (rotation/zstd/AES), credential_db (dedup/hashcat/bulk),
ja3_spoofer (profiles/cipher mapping/randomization), responder_mgr (hash
capture/dedup/conf gen), ntlm_relay (protocol inference/command building/
coordination), ids_tester (risk assessment/preflight/caplet), and bridge
(setup/teardown/ebtables/watchdog). 187 tests total, all passing.
 2026-04-10 07:38:28 -04:00
n0mad1k 0b5c7f3907 Add responder_mgr NTLM hash capture validation tests 2026-04-10 07:37:22 -04:00
n0mad1k 7a3b8e40d9 Add ntlm_relay wrapper and ADCS relay validation tests 2026-04-10 07:36:16 -04:00
n0mad1k edfa067f68 Add ids_tester IDS evasion self-test validation tests 2026-04-10 07:34:49 -04:00
n0mad1k 4ca9d3cdf1 Add validation tests for packet_capture, credential_db, and ja3_spoofer 
Tests cover:
- packet_capture: zstd compression, AES-256-GCM encryption, rotation
  pipeline, disk purge, file locking (15 tests)
- credential_db: ingestion, deduplication at scale (1000+), hashcat
  export filtering, crack status management, bulk update, CSV/JSON
  export, query helpers (25 tests)
- ja3_spoofer: builtin profile validation, cipher ID mapping, external
  DB loading, auto-selection, SSL context config, randomization
  validation (28 tests)

Addresses DevTrack items #424, #425, #437.
 2026-04-10 07:29:08 -04:00
Cobra 4d2e46e478 Update module count assertions to reflect reverse_tunnel removal 2026-04-08 22:26:06 -04:00
Cobra ffd384f64b Strip OPSEC tool identity fingerprints 
Replace all sensor.* logger namespaces with __name__ (generic module
identifiers instead of discoverable 'sensor.*' prefixes).

Change hardcoded 'bb' API user to 'admin' in config and code defaults.

Change hardcoded relay_user 'bb' to 'operator' — prevents network
profiling from exposing tool identity via SSH config.

Fixes #457, #458, #459
 2026-04-08 22:18:35 -04:00
Cobra 3153b7e8a3 Robust interface detection — retry fallback chain for headless boot (#206) 
Fixes interface auto-detection failures on Pi Zero 2W where wlan0 doesn't exist
at boot. Implementation:

- Added detect_interface_with_retry() function with 3x retry fallback chain
- Config-supplied interface preferred, then /proc/net/route, then UP interface
- Exponential backoff: 5s, 10s, 20s delays between retries
- Filters excluded prefixes: lo, tailscale*, wg*, tun*, docker*, veth*, br-*
- Used in Engine.__init__(), PacketCapture.start(), MacManager.start()
- Full test coverage: 10 tests for detection, backoff, filtering

Addresses issue where network stack initializes after boot and interfaces
become available after 5-10 second delay.
 2026-04-08 20:58:43 -04:00
Cobra 1f43d97f03 Add test to verify Engine instantiates and injects CaptureBus into passive modules (#204) 2026-04-08 20:57:10 -04:00
Cobra e114d6067a Remove autossh reverse tunnel references — module deleted, causing ImportError on startup 2026-04-08 14:07:52 -04:00
Cobra 1eb35c9050 Fix #211: Remove tool identity strings from deployed artifacts 
- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
 2026-04-06 11:39:48 -04:00
n0mad1k 56cca8ac3d Phase 5: Final integration — fix imports, full module discovery, interactive menu 
- Fix pyserial import error in cellular_backup.py (lazy import with fallback)
- Replace stealth-only module discovery with discover_all_modules() across all
  5 categories (stealth, passive, active, intel, connectivity)
- Wire up interactive menu options 5-8:
  - View Credentials: query credential_db SQLite, Rich table with stats
  - View Intelligence: host count, cred stats, security posture summary
  - Network Topology: host table from topology_mapper state data
  - Timeline: recent entries from operator_audit HMAC-chained log
- Update start command to discover+register all enabled modules (not just stealth)
- Update modules/activate/selftest commands to use full module discovery
- Add is_module_enabled() config-aware helper for per-category defaults
- Fix modules.yaml module count headers (16->17 passive, 8->9 active/intel)
- Set bettercap_mgr enabled=false (all active modules disabled by default)
- Add tests/test_all_modules.py: 179 parametrized tests covering import,
  BaseModule subclass, attributes, and instantiation for all 55 modules
  across passive, active, intel, and connectivity categories
- All 256 tests passing
 2026-03-18 13:59:27 -04:00
n0mad1k 3394c72814 Add main CLI entry point and full test suite 
- bigbrother.py: Click CLI with start/stop/status/activate/deactivate/
  kill/config/selftest/modules commands plus Rich interactive menu.
  Module discovery scans modules/stealth/ for BaseModule subclasses.
  Supports --daemon mode with PID file and --passive-only flag.
- tests/conftest.py: Shared fixtures (tmp_dir, mock_config, mock_bus,
  mock_state, hardware_tier_override, project_root)
- tests/test_bus.py: 6 tests for EventBus pub/sub, filtering, wildcards
- tests/test_engine.py: 5 tests for Engine lifecycle, deps, tier, phase
- tests/test_crypto.py: 5 tests for AES-256-GCM, file encryption, KDF
- tests/test_resource.py: 7 tests for hardware detection, memory, disk
- tests/test_tool_manager.py: 6 tests for subprocess management
- tests/test_stealth_modules.py: 4 parametrized test classes covering
  all 12 stealth modules (import, inheritance, attributes, instantiation)
 2026-03-18 09:48:23 -04:00
n0mad1k 62a1010ab4 Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api 
9 files in utils/ providing the shared infrastructure layer:
- crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management
- networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation
- logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth
- stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable
- resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring
- permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement
- config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload
- bettercap_api: REST client with per-session random credentials, session/events/command methods
 2026-03-18 08:11:25 -04:00