n0mad1k
0a80f8bed8
Major rewrite of BIGBROTHER_DESIGN.md incorporating three architectural changes:
1. Orchestrator model: BigBrother wraps proven tools instead of reimplementing.
- bettercap replaces 5+ custom active modules (ARP/DNS/DHCP/HTTP/SSL)
- tcpdump replaces custom scapy packet capture
- 11 modules deleted (file_extractor, email_sniffer, print_interceptor,
voip_capture, protocol_analyzer, session_hijacker, http_logger,
ssl_downgrade, js_injector, cloud_token_active, report_generator)
- New: bettercap_mgr, tool_manager, tool_output_parser, bettercap_api
- Module count: 67 -> 60
2. Operator workstation section: offline analysis tools and pull scripts
for file carving, email/print reconstruction, GPU hash cracking, and
report generation from PCAPs and SQLite DBs.
3. Innocuous MAC database: curated consumer device profiles (Fire TV,
iPhone, Roku, etc.) with matching DHCP hostname, vendor class, TTL,
and TCP window size for complete device impersonation.
Deleted ARCHITECTURE_RETHINK.md (merged into design doc).