# BigBrother: Total Network Surveillance Platform + Operator Jump Box > **Version**: 3.2 > **Date**: 2026-03-17 > **Status**: Implementation Blueprint (Security Review Integrated) --- ## Table of Contents 1. [Overview](#1-overview) 2. [File Tree](#2-file-tree) 3. [Surveillance Modules](#3-surveillance-modules) 4. [Connectivity](#4-connectivity) 5. [Stealth](#5-stealth) 6. [Pre-installed Tools](#6-pre-installed-tools) 7. [Core Framework](#7-core-framework) 8. [Setup & Bootstrap](#8-setup--bootstrap) 9. [Configuration](#9-configuration) 10. [Hardware Tiers](#10-hardware-tiers) 11. [Implementation Phases](#11-implementation-phases) 12. [OPSEC Notes](#12-opsec-notes) --- ## 1. Overview BigBrother is a total network surveillance platform and operator jump box designed for authorized red team engagements. It deploys on Raspberry Pi (Zero 2W through Pi 4) or full Debian hosts, operating as an inline transparent bridge or passive tap. Once deployed, its passive surveillance runs 24/7 with zero operator interaction — capturing every packet, logging every DNS query, extracting every credential that crosses the wire, and mapping every relationship on the network. The platform has two operational modes. **Passive surveillance** runs unsupervised from the moment of deployment, collecting full packet captures, DNS query logs, TLS SNI data, cleartext credentials, Kerberos tickets, host information, traffic patterns, and protocol metadata. **Active surveillance** is operator-enabled when deeper collection is needed — ARP spoofing to become the man-in-the-middle, DNS poisoning, DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once the operator enables an active module and configures its targets, it runs unattended. **Reality check**: Modern corporate networks are 85-95% encrypted. Passive value is primarily metadata — DNS, TLS SNI, Kerberos wire capture, flow analysis. Cleartext credential sniffer and email sniffer yield near-zero on modern networks. Kerberos from wire is the single highest-value passive capability. Active MITM is required for anything beyond metadata. BigBrother is not an autonomous attack framework. There is no decision engine, no state machine, no automated attack chaining. The operator makes all decisions. When the operator needs to run offensive tools, they SSH into the box and use the pre-installed toolkit directly: nmap, Certipy, Impacket, BloodHound, CrackMapExec, Chisel, Ligolo-ng. These tools are installed by `setup.sh`, not wrapped in Python. The operator runs them, interprets the results, and decides what to do next. Scope is the operator's responsibility. An optional `scope.yaml` can be loaded to validate active module targets against in-scope ranges, but this is not mandatory — there is no hard scope enforcement or OT lockout mechanism forced on the operator. --- ## 2. File Tree ``` ~/tools/bigbrother/ ├── bigbrother.py # Main CLI + interactive menu (Click + Rich) ├── setup.sh # Idempotent Debian bootstrap (packages + tools) ├── requirements.txt # Python dependencies ├── .gitignore │ ├── config/ │ ├── bigbrother.yaml # Non-sensitive defaults only (plaintext FS) │ ├── modules.yaml # Per-module enable/disable + params │ ├── stealth.yaml # OPSEC/stealth profile config │ ├── hardware_tiers.yaml # Pi Zero 2W vs Pi 4 vs Debian host limits │ ├── scope.yaml # Optional scope enforcement (IP ranges, domains) │ └── templates/ │ ├── engagement_default.yaml # Template for new engagements │ ├── engagement_minimal.yaml # Minimal config for Pi Zero 2W │ └── engagement_full.yaml # Full config for Pi 4 / Debian host │ ├── core/ │ ├── __init__.py │ ├── engine.py # Module lifecycle manager (load, start, stop, status) │ ├── capture_bus.py # Single AF_PACKET capture, demux to per-module queues │ ├── scheduler.py # Task scheduler (cron-like, jitter-aware) │ ├── bus.py # Internal event bus (pub/sub between modules) │ ├── state.py # Persistent state manager (SQLite) │ ├── resource_monitor.py # RAM/CPU/disk/thermal watchdog, throttle enforcement │ └── kill_switch.py # Manual wipe orchestrator │ ├── modules/ │ ├── __init__.py │ ├── base.py # Abstract base class for all modules │ │ │ ├── passive/ # 24/7 unsupervised collection │ │ ├── __init__.py │ │ ├── packet_capture.py # Full PCAP rotation, BPF filters, promiscuous mode │ │ ├── dns_logger.py # Per-host DNS query log, every domain resolved │ │ ├── tls_sni_extractor.py # HTTPS destinations from ClientHello SNI field │ │ ├── credential_sniffer.py # Cleartext FTP/HTTP/SMTP/POP3/IMAP/Telnet/SNMP + NTLM │ │ ├── kerberos_harvester.py # AS-REQ/AS-REP/TGS-REQ/TGS-REP from traffic │ │ ├── host_discovery.py # ARP table, DHCP sniffing, mDNS, NetBIOS │ │ ├── os_fingerprint.py # Passive OS fingerprinting (p0f-style) │ │ ├── traffic_analyzer.py # Protocol distribution, flows, bandwidth, beacons, comm graphs │ │ ├── vlan_discovery.py # 802.1Q tags, DTP frames, 802.1X detection │ │ ├── network_mapper.py # Who talks to whom, protocol, volume — visual graph │ │ ├── auth_flow_tracker.py # Map user-to-service authentication, build timelines │ │ ├── smb_monitor.py # File share access patterns (users, shares, files) │ │ ├── voip_capture.py # SIP metadata, call records, RTP audio (if unencrypted) │ │ ├── print_interceptor.py # PCL/PostScript print spool from network print traffic │ │ ├── wireless_intel.py # Probe requests, BLE scanning, WPA handshakes, WIDS │ │ ├── protocol_analyzer.py # Zeek-style protocol dissection, service ID, cert analysis │ │ ├── cloud_token_harvester.py # Passive AWS keys, Azure tokens, JWT, OAuth, SAML │ │ ├── email_sniffer.py # Capture email content + attachments from cleartext SMTP/IMAP/POP3 │ │ ├── ldap_harvester.py # LDAP search query/response parsing, AD object inventory │ │ ├── rdp_monitor.py # RDP NLA/CredSSP header parsing, session tracking │ │ ├── quic_analyzer.py # QUIC Initial packet SNI extraction (UDP/443) │ │ └── db_interceptor.py # MSSQL/MySQL/PostgreSQL/Redis/MongoDB protocol parsing │ │ │ ├── active/ # Operator-enabled, then runs unattended │ │ ├── __init__.py │ │ ├── arp_spoof.py # ARP cache poisoning, become MITM gateway │ │ ├── dns_poison.py # DNS response injection, redirect queries │ │ ├── dhcp_spoof.py # Rogue DHCP to set implant as gateway/DNS │ │ ├── evil_twin.py # Rogue AP with captive portal │ │ ├── ipv6_slaac.py # IPv6 SLAAC spoofing, become IPv6 gateway │ │ ├── responder_mgr.py # Manage Responder process (LLMNR/NBT-NS/mDNS poisoning) │ │ ├── ssl_downgrade.py # sslstrip for legacy apps (opt-in, HSTS warning) │ │ ├── http_logger.py # Log every URL, header, POST body, cookie (requires MITM) │ │ ├── file_extractor.py # Carve files from HTTP/SMB/FTP traffic in real-time │ │ ├── session_hijacker.py # Capture cookies, session tokens, JWT from intercepted traffic │ │ ├── js_injector.py # Inject keyloggers or BeEF hooks into HTTP responses │ │ ├── mitmproxy_mgr.py # Full HTTPS interception with generated certs │ │ ├── ntlm_relay.py # ntlmrelayx integration, coordinated with Responder │ │ └── cloud_token_active.py # Extract tokens from MITM'd HTTPS traffic │ │ │ ├── connectivity/ │ │ ├── __init__.py │ │ ├── tailscale.py # Tailscale lifecycle, auth, health │ │ ├── wireguard.py # WireGuard tunnel management │ │ ├── bridge.py # Transparent inline bridge (USB eth + onboard) │ │ ├── wifi_client.py # WiFi client mode, network selection │ │ ├── reverse_tunnel.py # SSH reverse tunnel fallback │ │ ├── cellular_backup.py # LTE modem HAT for out-of-band access (optional) │ │ ├── ble_emergency.py # BLE emergency access channel (optional) │ │ └── data_exfil.py # Automated data exfiltration pipeline │ │ │ ├── stealth/ │ │ ├── __init__.py │ │ ├── mac_manager.py # MAC randomization / cloning │ │ ├── process_disguise.py # Process name/cmdline spoofing │ │ ├── log_suppression.py # Syslog filtering, audit rule injection │ │ ├── encrypted_storage.py # LUKS container management │ │ ├── tmpfs_manager.py # tmpfs mounts for sensitive ops │ │ ├── watchdog.py # Health monitoring, auto-restart services │ │ ├── anti_forensics.py # Timestomp, secure deletion │ │ ├── traffic_mimicry.py # 48h baseline + behavioral blending │ │ ├── ja3_spoofer.py # JA3/JA3S TLS fingerprint matching │ │ ├── ids_tester.py # Test actions against known IDS rulesets │ │ ├── lkm_rootkit.py # Optional LKM for process/file/net hiding (compromised host only) │ │ └── overlayfs_manager.py # SD card wear protection via overlayfs │ │ │ └── intel/ │ ├── __init__.py │ ├── credential_db.py # SQLite credential store (all captured creds organized) │ ├── topology_mapper.py # Network graph construction, Graphviz export │ ├── report_generator.py # Engagement summary, timeline, findings │ ├── net_intel.py # Beacon detection, communication graphing │ ├── user_timeline.py # Per-user activity timeline (DNS + auth + traffic) │ ├── supply_chain_detect.py # Passive detection of internal repos, WSUS, CI/CD, registries │ ├── change_detector.py # Continuous network state diffing, burn detection │ ├── security_posture.py # Map target defenses (EDR, SIEM, honeypots) │ └── operator_audit.py # Encrypted operator session/command audit trail │ ├── services/ │ ├── bigbrother-core.service # Main daemon (disguised name in production) │ ├── bigbrother-watchdog.service # Watchdog / auto-recovery │ ├── bigbrother-capture.service # Packet capture (passive) │ ├── bigbrother-passive.service # All passive surveillance modules │ ├── bigbrother-bridge.service # Transparent bridge │ └── bigbrother-tailscale.timer # Tailscale health check timer │ ├── templates/ │ ├── captive_portals/ │ │ ├── corporate_login.html # Corporate WiFi login mimic │ │ ├── guest_wifi.html # Guest WiFi terms page │ │ ├── outlook_login.html # O365 login clone │ │ └── vpn_portal.html # VPN portal clone │ ├── dns_zones/ │ │ ├── redirect_all.zone # Wildcard DNS redirect │ │ └── selective.zone.j2 # Jinja2 template for targeted DNS │ ├── hostapd/ │ │ ├── open.conf.j2 # Open AP config │ │ └── wpa2.conf.j2 # WPA2 AP config │ ├── responder/ │ │ └── Responder.conf.j2 # Responder config template │ ├── beef/ │ │ └── hook.js.j2 # BeEF hook injection template │ └── lkm/ │ ├── bb_hide.c # Kernel module source │ └── Makefile # Build for target kernel version │ ├── utils/ │ ├── __init__.py │ ├── crypto.py # AES-256-GCM encryption, key derivation, wipe │ ├── networking.py # Interface enumeration, IP helpers, raw sockets │ ├── logging.py # Encrypted rotating log, memory-only option │ ├── stealth.py # OPSEC helpers (timing jitter, traffic shaping) │ ├── resource.py # Memory/CPU profiling, Pi Zero limits │ ├── permissions.py # Capability checks, privilege escalation │ └── config_loader.py # YAML config parser with validation + defaults │ ├── data/ │ ├── oui.db # MAC OUI database (SQLite, compressed) │ ├── os_sigs.db # Passive OS fingerprint signatures │ ├── dhcp_fingerprints.db # DHCP option 55 fingerprints (Fingerbank dataset) │ ├── ids_rules/ # Snort/Suricata rule snapshots for self-testing │ │ ├── emerging-threats.rules │ │ └── snort-community.rules │ ├── ja3_fingerprints.db # Known JA3 hashes for common browsers │ ├── wordlists/ # Pre-bundled for on-device cracking │ │ ├── rockyou.txt.gz # Classic password list │ │ ├── top-1m-passwords.txt # SecLists top-1M │ │ └── rules/ # Hashcat rules │ │ ├── OneRuleToRuleThemAll.rule │ │ └── dive.rule │ └── bpf_filters/ │ ├── credentials.bpf # BPF for credential protocols │ ├── dns.bpf # BPF for DNS traffic │ ├── discovery.bpf # BPF for discovery traffic │ └── full_capture.bpf # BPF for full capture (minus noise) │ ├── tests/ │ ├── __init__.py │ ├── test_engine.py # Module lifecycle tests │ ├── test_bus.py # Event bus tests │ ├── test_crypto.py # Encryption/wipe tests │ ├── test_modules.py # Module interface compliance tests │ ├── test_resource.py # Resource constraint tests │ └── conftest.py # Pytest fixtures │ ├── scripts/ │ ├── setup_bridge.sh # Bridge interface setup │ ├── teardown_bridge.sh # Bridge interface teardown │ └── build_lkm.sh # Compile rootkit LKM for target kernel │ └── storage/ # Runtime data (gitignored, LUKS-encrypted) ├── config/ # Sensitive config (keys, auth, engagement details) ├── pcaps/ # Rotated packet captures (zstd compressed) ├── creds/ # Extracted credentials ├── dns_logs/ # DNS query logs per host ├── sni_logs/ # TLS SNI destination logs ├── emails/ # Captured email content + attachments ├── files/ # Carved files from traffic ├── voip/ # SIP metadata + RTP audio captures ├── print_jobs/ # Intercepted print spool data ├── intel/ # Analysis outputs, topology graphs ├── baseline/ # Traffic baseline data (48h capture) ├── audit/ # Operator session/command audit trail └── logs/ # Encrypted operation logs ``` --- ## 3. Surveillance Modules ### 3.1 Passive Surveillance (24/7, zero noise, unsupervised) 22 passive modules. These start at deployment and run continuously without generating any network traffic. All receive packets via the capture bus (one AF_PACKET socket, demuxed to per-module queues). --- #### `modules/passive/packet_capture.py` — Full Packet Capture **Purpose**: Capture all network traffic to encrypted rotating PCAPs for offline analysis. - Promiscuous mode on bridge or tap interface - BPF filters: full capture, credentials-only, DNS-only, or custom - PCAP rotation: size-based (100MB uncompressed default) or time-based (1h default) - **Max compression pipeline on rotation**: zstd level 19 (max) → AES-256-GCM encrypt → .pcap.zst.enc - zstd -19 achieves 10-15x compression on typical network PCAPs (100MB → 7-10MB) - On 128GB SD: ~1.2TB effective PCAP storage (days of full capture on busy networks) - Compressed files dramatically faster to exfil when operator pulls data over Tailscale/WG - Decompression on operator's workstation: `zstd -d` then open in Wireshark - CPU cost: zstd -19 on Pi 4 compresses at ~5-10MB/s (runs as background task after rotation, not inline) - Pi Zero: use zstd -3 (fast mode, still 5-8x compression, minimal CPU) - **Full packet capture (snap_length=65535) on all tiers.** With 128GB+ SD and zstd -19 compression (10-15x), effective storage is ~1.2TB. Full payloads are required for file carving, email reconstruction, print job extraction, database query capture, and credential extraction from protocol payloads. Headers-only would blind most surveillance modules. - Pi Zero 2W: full capture still applies but with fewer concurrent modules to stay within memory budget. Compression downgraded to zstd -3 to reduce CPU load. - Disk usage monitoring — auto-purge oldest PCAPs when threshold hit (bulk first, credential ring preserved) - PcapNG format support for metadata embedding (interface info, comments, timestamps) **Resources**: RAM 30-80MB (snap length dependent), CPU 5-15% capture + compression spikes on rotation, disk varies **Dependencies**: libpcap, scapy, zstandard (Python binding) --- #### `modules/passive/dns_logger.py` — DNS Query Logger **Purpose**: Build per-host browsing history from DNS queries. Every domain every host resolves, timestamped. - Capture DNS queries and responses (UDP/53, TCP/53) - Per-source-IP log: timestamp, queried domain, response IPs, query type - Aggregate into browsing profiles per host - Detect internal DNS servers, split-horizon configurations - Flag interesting domains: cloud services, security tools, update servers, webmail - Flag hosts connecting to known DoH resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9) — indicates DNS blind spot for that host - When in MITM position: option to block DoH resolver IPs and strip HTTPS DNS records (type 65) to force plaintext DNS - Batch inserts: buffer 1000 records, flush every 60s (reduces SQLite write contention) **Resources**: RAM 15MB, CPU 2%, disk 5MB/day typical **Dependencies**: scapy or dpkt --- #### `modules/passive/tls_sni_extractor.py` — TLS SNI Extractor **Purpose**: Log every HTTPS destination without decryption, from the ClientHello SNI field. - Parse TLS ClientHello from TCP/443 (and other TLS ports) - Extract Server Name Indication field — reveals destination even when encrypted - Correlate with DNS logs for complete web activity picture - Detect certificate pinning, TLS 1.3 encrypted SNI (ESNI/ECH) gaps - **ECH limitation**: Encrypted Client Hello (Cloudflare, Google, Firefox) returns CDN dummy SNI — no passive mitigation. ECH requires full TLS interception to defeat. - **DoH blind spot**: DNS-over-HTTPS to hardcoded resolvers (1.1.1.1, 8.8.8.8) bypasses dns_logger entirely — 30-70% of endpoint DNS may be encrypted. Internal AD DNS to domain controllers remains visible on UDP/53. When in MITM position, block DoH resolver IPs and strip HTTPS DNS records (type 65) to force plaintext fallback. - **TLS 1.3**: Server certificates encrypted during handshake — passive cert extraction impossible. Rely on SNI (while available) and CT logs. - Log: timestamp, source IP, destination IP:port, SNI hostname, TLS version - QUIC/HTTP3 SNI handled by separate `quic_analyzer.py` module **Resources**: RAM 10MB, CPU 2%, disk 3MB/day typical **Dependencies**: scapy or dpkt --- #### `modules/passive/credential_sniffer.py` — Credential Sniffer **Purpose**: Extract credentials from cleartext protocols and NTLM/Kerberos authentication. - **Cleartext**: FTP (USER/PASS), HTTP Basic/Digest, HTTP form POST, SMTP AUTH, POP3 USER/PASS, IMAP LOGIN, Telnet, SNMP community strings, LDAP simple bind - **NTLM**: Extract NTLMv1/v2 challenge-response from SMB, HTTP NTLM, LDAP NTLM, MSSQL NTLM - **Kerberos**: Extract encrypted timestamps from AS-REQ (password spray targets) - **Realistic yield**: On modern networks (85-95% encrypted), cleartext protocols yield near-zero in passive mode. SMTP is universally STARTTLS. Primary passive value is NTLM/Kerberos from wire. Cleartext sniffer becomes high-value only with active MITM position. - Output: hashcat-compatible format, stored in credential_db - Publishes CREDENTIAL_FOUND events on bus - Auto-queue captured hashes for CPU-mode john/hashcat in low-priority cgroup; push hashes immediately to operator's cracking rig via data_exfil for GPU cracking **Resources**: RAM 20MB, CPU 3%, disk 5MB **Dependencies**: scapy, impacket (for NTLM/Kerberos parsing) --- #### `modules/passive/kerberos_harvester.py` — Kerberos Ticket Harvester **Purpose**: Extract Kerberos tickets from network traffic for offline cracking. - **AS-REQ**: Extract encrypted timestamps (hashcat mode 7500) - **AS-REP**: Extract hashes for accounts without pre-auth (hashcat mode 18200) — AS-REP roasting from the wire - **TGS-REQ**: Log SPN requests — reveals what services users access - **TGS-REP**: Extract service ticket hashes (hashcat mode 13100) — Kerberoasting from the wire - Identify domain controllers, realm names, user principal names - Feed all hashes into credential_db **Resources**: RAM 15MB, CPU 3%, disk 10MB **Dependencies**: scapy, impacket --- #### `modules/passive/host_discovery.py` — Host Discovery **Purpose**: Build complete host inventory from passive network observation. - ARP table monitoring (new MACs) - DHCP request/ACK sniffing (hostname, vendor class, requested IP) - DHCP option 55 (Parameter Request List) parsing for device fingerprinting via `data/dhcp_fingerprints.db` (Fingerbank dataset) - mDNS/Bonjour service announcements - NetBIOS name queries and responses - SSDP/UPnP discovery traffic - NBNS and LLMNR queries (hostname resolution attempts) - Correlate: IP + MAC + hostname + vendor (OUI) + OS guess + DHCP fingerprint **Resources**: RAM 15MB, CPU 2%, disk 5MB **Dependencies**: scapy, data/oui.db, data/dhcp_fingerprints.db --- #### `modules/passive/os_fingerprint.py` — Passive OS Fingerprinting **Purpose**: Identify operating systems without sending any probes. p0f-style. - TCP SYN/SYN-ACK analysis: window size, TTL, DF flag, MSS, window scaling, SACK, timestamps - HTTP User-Agent header extraction - DHCP vendor class identifier - SMB dialect negotiation - SSH version strings - Confidence scoring per host, multiple evidence sources **Resources**: RAM 10MB, CPU 2%, disk 2MB **Dependencies**: scapy, data/os_sigs.db --- #### `modules/passive/traffic_analyzer.py` — Traffic Analyzer **Purpose**: Protocol distribution, flow analysis, bandwidth monitoring, beacon detection. - Protocol breakdown: percentage by packet count and bytes - Flow tracking: 5-tuple flows, duration, bytes transferred - Top talkers: hosts by volume, connections, protocol diversity - Beacon detection: regular-interval communications that suggest C2, heartbeats, or update checks - Bandwidth profiling: hourly/daily patterns, anomaly detection - Communication graphs: source-destination pairs with protocol and volume edges **Resources**: RAM 25-60MB (flow table size), CPU 5%, disk 10MB **Dependencies**: scapy --- #### `modules/passive/vlan_discovery.py` — VLAN Discovery **Purpose**: Map VLAN topology from passive observation. - 802.1Q tag detection — identify VLANs in use - DTP frame capture — detect trunk negotiation - 802.1X/EAPOL frame detection — identify NAC-protected ports - CDP/LLDP frame parsing — switch names, port IDs, VLAN assignments - STP BPDU parsing — switch topology, root bridge identification **Resources**: RAM 10MB, CPU 1%, disk 2MB **Dependencies**: scapy --- #### `modules/passive/network_mapper.py` — Network Relationship Mapper **Purpose**: Build a comprehensive map of who talks to whom, how much, and over what protocols. Visual graph output. - Track all communication pairs with protocol and volume metadata - Identify servers (many inbound connections) vs clients (many outbound) - Detect admin workstations (SSH/RDP to many hosts) - Map printer relationships, file server access patterns - Graphviz DOT output for topology visualization - Periodic snapshots for change detection **Resources**: RAM 20MB, CPU 3%, disk 5MB **Dependencies**: scapy, graphviz (for rendering) --- #### `modules/passive/auth_flow_tracker.py` — Authentication Flow Tracker **Purpose**: Map who authenticates to what services and when, building per-user activity timelines. - Track Kerberos TGT requests (AS-REQ) — user login events - Track Kerberos service ticket requests (TGS-REQ) — service access - Track NTLM authentication across protocols (SMB, HTTP, LDAP, MSSQL) - Track SSH connection establishment - Track LDAP binds - Build per-user timeline: login time, services accessed, duration patterns - Identify service accounts (authenticate to many hosts, regular intervals) **Resources**: RAM 15MB, CPU 2%, disk 5MB **Dependencies**: scapy, impacket --- #### `modules/passive/smb_monitor.py` — SMB File Access Monitor **Purpose**: Track file share access patterns — which users access which shares and files. - Parse SMB2/3 tree connect requests — which shares are accessed - Parse SMB2/3 create requests — which files are opened - Track read/write operations per user per share - Identify sensitive shares (SYSVOL, NETLOGON, C$, ADMIN$, custom shares) - Log: timestamp, user, source IP, share name, file path, operation - Detect GPP/Group Policy access patterns - **SMB3 limitation**: Windows Server 2022 and Windows 11 default to SMB 3.1.1 with AES encryption. Negotiate/session setup (capabilities, NTLM) is visible but encrypted payload is opaque. File access monitoring requires active MITM with SMB downgrade. **Resources**: RAM 15MB, CPU 2%, disk 5MB **Dependencies**: scapy, impacket --- #### `modules/passive/voip_capture.py` — VoIP/SIP Metadata Capture **Purpose**: Capture call records, participants, duration. Optionally capture RTP audio if unencrypted. - Parse SIP INVITE/BYE/CANCEL — call setup and teardown - Extract: caller, callee, call-ID, codec, duration - Track RTP streams associated with SIP sessions - If RTP is unencrypted: capture audio to WAV files - If SRTP: log metadata only (cannot decrypt) - Detect VoIP infrastructure (PBX, SBC, trunks) **Resources**: RAM 20MB + audio storage, CPU 3%, disk varies (audio intensive) **Dependencies**: scapy, wave (stdlib) --- #### `modules/passive/print_interceptor.py` — Print Job Interceptor **Purpose**: Capture print spool data from network print traffic. - Capture RAW print data (TCP/9100 — JetDirect/AppSocket) - Capture LPD print data (TCP/515) - Capture IPP print data (TCP/631) - Extract PCL and PostScript content - Convert to PDF where possible (Ghostscript) - Log: timestamp, source IP, printer IP, job size, content preview **Resources**: RAM 15MB, CPU 2%, disk varies (print job size) **Dependencies**: scapy, ghostscript (optional, for PDF conversion) --- #### `modules/passive/wireless_intel.py` — Wireless Intelligence **Purpose**: Probe request collection, BLE scanning, WPA handshake capture, WIDS detection. - Monitor mode on WiFi interface (requires capable adapter) - Probe request collection — reveals client preferred network history - BLE scanning — identify phones, badges, IoT devices - WPA 4-way handshake passive capture from legitimate connections - WIDS detection — identify wireless IDS by monitoring for correlation patterns (run 2-hour observation before allowing evil_twin) - Publishes HANDSHAKE_CAPTURED events - **Interface conflict**: Monitor mode on wlan0 and wifi_client managed mode are mutually exclusive on same interface. Requires explicit second USB WiFi adapter for concurrent monitor+client. engine.py detects and prevents conflicting modes. **Resources**: RAM 20MB, CPU 3%, disk 10MB **Dependencies**: scapy, aircrack-ng (for monitor mode), bluez (for BLE) --- #### `modules/passive/protocol_analyzer.py` — Protocol Deep Analyzer **Purpose**: Zeek-style protocol dissection, service identification, certificate analysis. - Protocol identification beyond port numbers (payload heuristics) - Service banner extraction: version strings, server headers - TLS certificate analysis: SANs, issuers, expiry, chain validation - OT protocol detection: Modbus (502), DNP3 (20000), OPC UA (4840), S7comm, BACnet, EtherNet/IP - HTTP/2 and QUIC identification - Anomaly flagging: unusual protocols, new services, version changes **Resources**: RAM 40MB, CPU 5%, disk 20MB **Dependencies**: scapy, dpkt --- #### `modules/passive/cloud_token_harvester.py` — Cloud Token Harvester (Passive) **Purpose**: Passively extract cloud credentials and tokens from observed traffic. - AWS: Access keys (AKIA*), secret keys, session tokens in HTTP headers/bodies - Azure: Bearer tokens, refresh tokens in HTTP Authorization headers - GCP: OAuth tokens, service account key patterns - Generic: JWT tokens (decode header + claims), SAML assertions, OAuth authorization codes - Only from cleartext protocols or already-decrypted MITM traffic - Feed into credential_db with cloud provider context **Resources**: RAM 15MB, CPU 2%, disk 5MB **Dependencies**: scapy, pyjwt (for JWT decoding) --- #### `modules/passive/email_sniffer.py` — Email Sniffer **Purpose**: Capture email content and attachments from unencrypted SMTP/IMAP/POP3. - Parse SMTP (TCP/25, 587) conversations — extract sender, recipients, subject, body, attachments - Parse IMAP (TCP/143) FETCH responses — extract email content - Parse POP3 (TCP/110) RETR responses — extract email content - Decode MIME multipart, Base64 attachments, quoted-printable - Store: per-email directory with headers, body text, and attachment files - Only captures cleartext — encrypted (STARTTLS, SSL) requires MITM position - **Realistic yield**: SMTP is universally STARTTLS in 2026. Expect near-zero cleartext email capture on modern networks without active MITM. **Resources**: RAM 20MB, CPU 3%, disk varies (attachment size) **Dependencies**: scapy, email (stdlib) --- #### `modules/passive/ldap_harvester.py` — LDAP Query Harvester **Purpose**: Parse LDAP search queries and responses to build a passive AD object inventory. - Parse LDAP SearchRequest/SearchResponse on ports 389 (LDAP) and 3268 (Global Catalog) - Extract: base DN, search filter, requested attributes, result entries - Build inventory: users, groups, computers, GPOs, SPNs, delegation attributes - Detect LAPS password reads (ms-Mcs-AdmPwd attribute requests) - Identify enumeration patterns that reveal admin tools (BloodHound, ADFind, PowerView queries) - Feed extracted objects into topology_mapper and credential_db (service account descriptions often contain passwords) **Resources**: RAM 20MB, CPU 3%, disk 10MB **Dependencies**: scapy, impacket (for LDAP parsing) --- #### `modules/passive/rdp_monitor.py` — RDP Session Monitor **Purpose**: Extract intelligence from RDP connection negotiation without decryption. - Parse RDP NLA (Network Level Authentication) negotiation headers on TCP/3389 - Extract: username, domain, client hostname, keyboard layout, client build number - Parse CredSSP to capture NTLM/Kerberos auth (feed to kerberos_harvester and credential_sniffer) - Track admin-to-server session patterns: who RDPs where and when - Identify jump boxes (hosts receiving many RDP sessions) and admin workstations (hosts initiating many) **Resources**: RAM 15MB, CPU 2%, disk 5MB **Dependencies**: scapy, impacket --- #### `modules/passive/quic_analyzer.py` — QUIC/HTTP3 SNI Extractor **Purpose**: Extract TLS SNI from QUIC Initial packets on UDP/443, covering the 30-40% of web traffic invisible to TCP-based TLS extraction. - Parse QUIC Initial packets (RFC 9000) from UDP/443 traffic - Decrypt Initial packet payload using connection ID-derived keys (standard per RFC 9001, not secret) - Extract CRYPTO frames containing TLS ClientHello - Parse SNI from embedded ClientHello — same format as TCP TLS - Feed results into tls_sni_extractor's log format for unified SNI visibility **Resources**: RAM 10MB, CPU 2%, disk 3MB/day **Dependencies**: scapy --- #### `modules/passive/db_interceptor.py` — Database Protocol Interceptor **Purpose**: Parse database wire protocols to extract login sequences, queries, and credential-containing statements. - **MSSQL TDS** (TCP/1433): login packets (username, hostname, app name), SQL batch queries - **MySQL** (TCP/3306): handshake (server version, auth plugin), login, query packets - **PostgreSQL** (TCP/5432): startup (user, database), simple/extended query protocol - **Redis** (TCP/6379): AUTH commands, key operations (detect credential storage patterns) - **MongoDB** (TCP/27017): OP_MSG/OP_QUERY for auth, find, and aggregate operations - Flag credential-containing queries (`INSERT INTO users`, `SET password`, connection strings) - Extract result metadata (row counts, column names) without storing full result sets **Resources**: RAM 25MB, CPU 3%, disk 10MB **Dependencies**: scapy, impacket --- ### 3.2 Active Surveillance (operator-enabled, then runs unattended) These modules require explicit operator activation. Once configured and started, they run without further interaction. --- #### `modules/active/arp_spoof.py` — ARP Spoofing **Purpose**: Become the man-in-the-middle by poisoning ARP caches. All target traffic flows through the implant. > **OPSEC WARNING**: ARP spoofing is the most-detected active technique. DAI on managed switches silently prevents it. EDR agents (CrowdStrike, SentinelOne, Defender ATP) alert on ARP cache anomalies within minutes. ARPwatch and Wazuh agents generate immediate alerts. Even with rate-limiting and jitter, ARP spoof against EDR-protected endpoints is detected. **Prefer Responder + ipv6_slaac as primary credential capture.** Reserve ARP spoof for confirmed legacy segments with no DAI/EDR. Run ids_tester DAI probe before activation. - Gratuitous ARP replies to targets, impersonating gateway - Gratuitous ARP replies to gateway, impersonating targets - IP forwarding enabled to maintain connectivity - Target list: specific hosts (not full subnet — less noise) - Rate-limited ARP replies with jitter - Restore original ARP entries on stop - **Crash recovery**: Kernel-level ARP restoration — cron job every 30s checks arp_spoof PID, sends gratuitous ARP corrections if process is dead. Prevents spoofed targets from losing gateway connectivity (1-5 min ARP timeout) on crash. **Resources**: RAM 10MB, CPU 2% **Dependencies**: scapy, iptables --- #### `modules/active/dns_poison.py` — DNS Poisoning **Purpose**: Redirect DNS queries to capture credentials or redirect users to cloned sites. - DNS response injection — race legitimate DNS server - Selective targeting: specific domains only, forward everything else - Redirect to captive portal (credential capture) - Redirect to cloned services (phishing) - Wildcard mode (redirect all) or targeted mode (redirect specific domains) - Jinja2 zone templates for flexible configuration **Resources**: RAM 10MB, CPU 2% **Dependencies**: scapy, dnslib --- #### `modules/active/dhcp_spoof.py` — DHCP Spoofing **Purpose**: Rogue DHCP server to set implant as gateway and/or DNS server for new clients. - Respond to DHCP DISCOVER before legitimate server (race condition) - Set implant IP as default gateway — all traffic routes through implant - Set implant IP as DNS server — all DNS queries visible - Configurable lease time, subnet mask, DNS settings - Target specific MACs or respond to all (when scope.yaml loaded, only responds to in-scope MACs) **Resources**: RAM 10MB, CPU 1% **Dependencies**: scapy --- #### `modules/active/evil_twin.py` — Evil Twin AP **Purpose**: Rogue access point with captive portal for credential harvesting. > **OPSEC WARNING**: Enterprise WIDS (Cisco, Aruba, Meraki) alerts immediately on any AP advertising a corporate SSID from an unknown BSSID. No evasion is possible — this is structural. Deauth floods are separately detected. 802.11w (protected management frames) prevents deauth entirely. Only viable in environments confirmed to have no WIDS. Run wireless_intel WIDS detection check (2-hour observation) before allowing evil_twin activation. - hostapd-based AP matching target SSID - Open or WPA2 mode - Captive portal serving credential harvesting pages (corporate login, O365, guest WiFi) - Optional deauth of target AP to force client migration - Captured credentials fed to credential_db - Channel selection to minimize interference **Resources**: RAM 30MB, CPU 5% **Dependencies**: hostapd, dnsmasq, iptables, USB WiFi adapter --- #### `modules/active/ipv6_slaac.py` — IPv6 SLAAC Spoofing **Purpose**: Become IPv6 default gateway via Router Advertisements. Bypasses IPv4-only defenses like DAI. - Send Router Advertisement messages with implant as default gateway - Targets automatically configure IPv6 address and route through implant - DNS via Router Advertisement — set implant as IPv6 DNS - Most networks have no IPv6 RA Guard deployed - Combine with DNS poisoning for credential capture - Works alongside mitm6 (pre-installed tool) **Resources**: RAM 10MB, CPU 2% **Dependencies**: scapy --- #### `modules/active/responder_mgr.py` — Responder Manager **Purpose**: Manage the Responder process for LLMNR/NBT-NS/mDNS poisoning and NTLMv2 hash capture. > **OPSEC WARNING**: Responder poisoning has mature detection coverage. Microsoft Defender for Identity has dedicated LLMNR/NBT-NS poisoning alerts. Suricata ET POLICY rules match poisoning responses. CrowdStrike/SentinelOne alert on NTLM auth to unexpected destinations. Advanced SOCs deploy honeypot LLMNR names. Implement selective targeting: only respond to hostnames never seen in legitimate DNS. Avoid responses during known SOC shift changes. - Start/stop/monitor Responder subprocess - Configure via Responder.conf.j2 template (enable/disable protocols) - Parse Responder output for captured hashes - Feed hashes into credential_db automatically - Coordinate with ntlm_relay for relay attacks - This manages Responder — operator can also run Responder directly **Resources**: RAM 30MB (Responder process), CPU 3% **Dependencies**: Responder (installed by setup.sh) --- #### `modules/active/ssl_downgrade.py` — SSL Downgrade **Purpose**: sslstrip for legacy applications. Opt-in only. - Disabled by default — requires explicit enable in modules.yaml - Warning on activation about HSTS rendering this mostly ineffective - Strip HTTPS redirects from HTTP responses - Only useful against legacy internal apps without HSTS - For modern HTTPS interception, use mitmproxy_mgr instead **Resources**: RAM 15MB, CPU 2% **Dependencies**: iptables, scapy --- #### `modules/active/http_logger.py` — HTTP Transaction Logger **Purpose**: When in MITM position, log every HTTP transaction: URL, headers, POST body, cookies. - Requires active MITM (arp_spoof, dhcp_spoof, or ipv6_slaac running) - Log full URL including query parameters - Log request and response headers - Log POST/PUT body content (form data, JSON, XML) - Extract and log cookies (session tokens, auth cookies) - Configurable: log all or filter by content-type/URL pattern **Resources**: RAM 20MB, CPU 3%, disk varies **Dependencies**: scapy or mitmproxy --- #### `modules/active/file_extractor.py` — File Extractor **Purpose**: Carve files from HTTP/SMB/FTP traffic in real-time. - Requires MITM position for HTTPS content - HTTP: reconstruct files from chunked/gzip responses - SMB: extract files from SMB2/3 read responses - FTP: capture files from data connections - Detect file type by magic bytes, store with metadata - Filter: all files or specific types (documents, executables, archives) **Resources**: RAM 40MB, CPU 5%, disk varies heavily **Dependencies**: scapy, python-magic --- #### `modules/active/session_hijacker.py` — Session Hijacker **Purpose**: Capture cookies, session tokens, and JWT from intercepted traffic. - Requires MITM position - Extract Set-Cookie and Cookie headers from HTTP - Extract Authorization headers (Bearer tokens, Basic auth) - Extract JWT tokens from headers, URL parameters, POST bodies - Parse JWT claims (expiry, scope, user info) - Store in credential_db with service context and expiry **Resources**: RAM 15MB, CPU 2%, disk 5MB **Dependencies**: scapy, pyjwt --- #### `modules/active/js_injector.py` — JavaScript/HTML Injection **Purpose**: Inject keyloggers or BeEF hooks into HTTP responses when in MITM position. - Requires MITM position (HTTP only — HTTPS needs mitmproxy_mgr) - Inject `