n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
56 Commits 1 Branch 0 Tags
1b93378f023f8dcf7ffdab056ccb429af6dbd962
Commit Graph

5 Commits

Author SHA1 Message Date
Cobra 50deaf0cfb Fix #212: Remove autossh reverse tunnel module 
- Delete modules/connectivity/reverse_tunnel.py (contradicts design)
- BigBrother design specifies WireGuard-only operator access
- Reverse SSH tunnel introduces unnecessary complexity and OPSEC risk
- Operator access is now exclusively through WireGuard VPN per spec
 2026-04-06 11:39:56 -04:00
Cobra 1eb35c9050 Fix #211: Remove tool identity strings from deployed artifacts 
- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
 2026-04-06 11:39:48 -04:00
Cobra ae4933044b Fix #209: Prevent SSH MITM in data_exfil.py exfiltration 
- Replace StrictHostKeyChecking=no with accept-new (verify on first connect)
- Require ssh_known_hosts_file config key pointing to operator's known_hosts
- Validate known_hosts file exists before attempting transfer
- Fail explicitly if known_hosts not configured (prevents silent MITM vulnerability)
- Uses -o UserKnownHostsFile=path to use pinned host keys
 2026-04-06 11:39:11 -04:00
n0mad1k 56cca8ac3d Phase 5: Final integration — fix imports, full module discovery, interactive menu 
- Fix pyserial import error in cellular_backup.py (lazy import with fallback)
- Replace stealth-only module discovery with discover_all_modules() across all
  5 categories (stealth, passive, active, intel, connectivity)
- Wire up interactive menu options 5-8:
  - View Credentials: query credential_db SQLite, Rich table with stats
  - View Intelligence: host count, cred stats, security posture summary
  - Network Topology: host table from topology_mapper state data
  - Timeline: recent entries from operator_audit HMAC-chained log
- Update start command to discover+register all enabled modules (not just stealth)
- Update modules/activate/selftest commands to use full module discovery
- Add is_module_enabled() config-aware helper for per-category defaults
- Fix modules.yaml module count headers (16->17 passive, 8->9 active/intel)
- Set bettercap_mgr enabled=false (all active modules disabled by default)
- Add tests/test_all_modules.py: 179 parametrized tests covering import,
  BaseModule subclass, attributes, and instantiation for all 55 modules
  across passive, active, intel, and connectivity categories
- All 256 tests passing
 2026-03-18 13:59:27 -04:00
n0mad1k 955ebfc8db Add Phase 3 connectivity modules — 8 modules + bridge scripts 
WireGuard (primary C2, PersistentKeepalive=0 for zero idle traffic),
Tailscale (fallback mesh VPN), Bridge (transparent inline L2 bridge with
802.1X bypass and ebtables protocol suppression), WiFiClient (WPA2-PSK
and WPA2-Enterprise via wpa_supplicant), ReverseTunnel (autossh over
stunnel/websocket — never raw SSH on 443), CellularBackup (LTE modem
via AT commands/mmcli, OPi Zero 3+ only), BLEEmergency (GATT server
with PSK auth for local last-resort access), DataExfil (priority-based
exfil with IMMEDIATE/NIGHTLY/ON_DEMAND tiers through connectivity chain).

Bridge scripts: setup_bridge.sh (create br0, disable STP, suppress
CDP/LLDP/BPDU via ebtables) and teardown_bridge.sh (safe cleanup).
 2026-03-18 13:43:04 -04:00