n0mad1k
62a1010ab4
9 files in utils/ providing the shared infrastructure layer: - crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management - networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation - logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth - stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable - resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring - permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement - config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload - bettercap_api: REST client with per-session random credentials, session/events/command methods
29 lines
710 B
YAML
29 lines
710 B
YAML
# BigBrother Scope Enforcement
|
|
# Optional. When enabled, all passive/active modules respect these boundaries.
|
|
# Prevents accidental out-of-scope activity during engagements.
|
|
|
|
enabled: false
|
|
|
|
# In-scope target networks (CIDR notation)
|
|
networks: []
|
|
# - 10.10.0.0/16
|
|
# - 10.0.0.0/24
|
|
|
|
# In-scope individual hosts (IP or FQDN)
|
|
hosts: []
|
|
# - dc01.corp.local
|
|
# - 10.10.1.50
|
|
|
|
# In-scope domains (wildcard matching)
|
|
domains: []
|
|
# - corp.local
|
|
# - internal.example.com
|
|
|
|
# Excluded networks — always out of scope (overrides networks/hosts above)
|
|
exclude_networks: []
|
|
# - 10.10.99.0/24 # OT segment
|
|
|
|
# Excluded hosts — always out of scope
|
|
exclude_hosts: []
|
|
# - 10.10.1.1 # Production gateway
|