ffd384f64b
Strip OPSEC tool identity fingerprints
...
Replace all sensor.* logger namespaces with __name__ (generic module
identifiers instead of discoverable 'sensor.*' prefixes).
Change hardcoded 'bb' API user to 'admin' in config and code defaults.
Change hardcoded relay_user 'bb' to 'operator' — prevents network
profiling from exposing tool identity via SSH config.
Fixes #457 , #458 , #459
2026-04-08 22:18:35 -04:00
78738622eb
Securely wipe state.db on exit ( #216 )
...
- Add secure_wipe_file() to utils/crypto.py for file overwrites + deletion
- Add secure_wipe parameter to StateManager.stop() method
- Wipes all SQLite WAL files (.db, .db-wal, .db-shm) with 3 passes
- Normal exit now calls state.stop(secure_wipe=True) to clear state database
- Falls back to regular delete if secure wipe fails
- Prevents state.db from persisting on disk after shutdown
2026-04-06 11:44:44 -04:00
1eb35c9050
Fix #211 : Remove tool identity strings from deployed artifacts
...
- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
2026-04-06 11:39:48 -04:00
04eae3a43e
Add requires_capture_bus attribute to BaseModule and passive modules
...
- BaseModule now has requires_capture_bus = False default
- All 17 passive modules set requires_capture_bus = True
- bigbrother.py imports CaptureBus from core.capture_bus
- Ready for Engine to instantiate and inject CaptureBus
2026-04-06 11:36:24 -04:00
56cca8ac3d
Phase 5: Final integration — fix imports, full module discovery, interactive menu
...
- Fix pyserial import error in cellular_backup.py (lazy import with fallback)
- Replace stealth-only module discovery with discover_all_modules() across all
5 categories (stealth, passive, active, intel, connectivity)
- Wire up interactive menu options 5-8:
- View Credentials: query credential_db SQLite, Rich table with stats
- View Intelligence: host count, cred stats, security posture summary
- Network Topology: host table from topology_mapper state data
- Timeline: recent entries from operator_audit HMAC-chained log
- Update start command to discover+register all enabled modules (not just stealth)
- Update modules/activate/selftest commands to use full module discovery
- Add is_module_enabled() config-aware helper for per-category defaults
- Fix modules.yaml module count headers (16->17 passive, 8->9 active/intel)
- Set bettercap_mgr enabled=false (all active modules disabled by default)
- Add tests/test_all_modules.py: 179 parametrized tests covering import,
BaseModule subclass, attributes, and instantiation for all 55 modules
across passive, active, intel, and connectivity categories
- All 256 tests passing
2026-03-18 13:59:27 -04:00
3394c72814
Add main CLI entry point and full test suite
...
- bigbrother.py: Click CLI with start/stop/status/activate/deactivate/
kill/config/selftest/modules commands plus Rich interactive menu.
Module discovery scans modules/stealth/ for BaseModule subclasses.
Supports --daemon mode with PID file and --passive-only flag.
- tests/conftest.py: Shared fixtures (tmp_dir, mock_config, mock_bus,
mock_state, hardware_tier_override, project_root)
- tests/test_bus.py: 6 tests for EventBus pub/sub, filtering, wildcards
- tests/test_engine.py: 5 tests for Engine lifecycle, deps, tier, phase
- tests/test_crypto.py: 5 tests for AES-256-GCM, file encryption, KDF
- tests/test_resource.py: 7 tests for hardware detection, memory, disk
- tests/test_tool_manager.py: 6 tests for subprocess management
- tests/test_stealth_modules.py: 4 parametrized test classes covering
all 12 stealth modules (import, inheritance, attributes, instantiation)
2026-03-18 09:48:23 -04:00
Cobra