bigbrother/BIGBROTHER_DESIGN.md

BigBrother: Total Network Surveillance Platform + Operator Jump Box

Version: 3.2 Date: 2026-03-17 Status: Implementation Blueprint (Security Review Integrated)

---

Table of Contents

1. Overview
2. File Tree
3. Surveillance Modules
4. Connectivity
5. Stealth
6. Pre-installed Tools
7. Core Framework
8. Setup & Bootstrap
9. Configuration
10. Hardware Tiers
11. Implementation Phases
12. OPSEC Notes

---

1. Overview

BigBrother is a total network surveillance platform and operator jump box designed for authorized red team engagements. It deploys on Raspberry Pi (Zero 2W through Pi 4) or full Debian hosts, operating as an inline transparent bridge or passive tap. Once deployed, its passive surveillance runs 24/7 with zero operator interaction — capturing every packet, logging every DNS query, extracting every credential that crosses the wire, and mapping every relationship on the network.

The platform has two operational modes. Passive surveillance runs unsupervised from the moment of deployment, collecting full packet captures, DNS query logs, TLS SNI data, cleartext credentials, Kerberos tickets, host information, traffic patterns, and protocol metadata. Active surveillance is operator-enabled when deeper collection is needed — ARP spoofing to become the man-in-the-middle, DNS poisoning, DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once the operator enables an active module and configures its targets, it runs unattended.

Reality check: Modern corporate networks are 85-95% encrypted. Passive value is primarily metadata — DNS, TLS SNI, Kerberos wire capture, flow analysis. Cleartext credential sniffer and email sniffer yield near-zero on modern networks. Kerberos from wire is the single highest-value passive capability. Active MITM is required for anything beyond metadata.

BigBrother is not an autonomous attack framework. There is no decision engine, no state machine, no automated attack chaining. The operator makes all decisions. When the operator needs to run offensive tools, they SSH into the box and use the pre-installed toolkit directly: nmap, Certipy, Impacket, BloodHound, CrackMapExec, Chisel, Ligolo-ng. These tools are installed by setup.sh, not wrapped in Python. The operator runs them, interprets the results, and decides what to do next.

Scope is the operator's responsibility. An optional scope.yaml can be loaded to validate active module targets against in-scope ranges, but this is not mandatory — there is no hard scope enforcement or OT lockout mechanism forced on the operator.

---

2. File Tree

~/tools/bigbrother/
├── bigbrother.py                    # Main CLI + interactive menu (Click + Rich)
├── setup.sh                         # Idempotent Debian bootstrap (packages + tools)
├── requirements.txt                 # Python dependencies
├── .gitignore
│
├── config/
│   ├── bigbrother.yaml              # Non-sensitive defaults only (plaintext FS)
│   ├── modules.yaml                 # Per-module enable/disable + params
│   ├── stealth.yaml                 # OPSEC/stealth profile config
│   ├── hardware_tiers.yaml          # Pi Zero 2W vs Pi 4 vs Debian host limits
│   ├── scope.yaml                   # Optional scope enforcement (IP ranges, domains)
│   └── templates/
│       ├── engagement_default.yaml  # Template for new engagements
│       ├── engagement_minimal.yaml  # Minimal config for Pi Zero 2W
│       └── engagement_full.yaml     # Full config for Pi 4 / Debian host
│
├── core/
│   ├── __init__.py
│   ├── engine.py                    # Module lifecycle manager (load, start, stop, status)
│   ├── capture_bus.py               # Single AF_PACKET capture, demux to per-module queues
│   ├── scheduler.py                 # Task scheduler (cron-like, jitter-aware)
│   ├── bus.py                       # Internal event bus (pub/sub between modules)
│   ├── state.py                     # Persistent state manager (SQLite)
│   ├── resource_monitor.py          # RAM/CPU/disk/thermal watchdog, throttle enforcement
│   └── kill_switch.py               # Manual wipe orchestrator
│
├── modules/
│   ├── __init__.py
│   ├── base.py                      # Abstract base class for all modules
│   │
│   ├── passive/                     # 24/7 unsupervised collection
│   │   ├── __init__.py
│   │   ├── packet_capture.py        # Full PCAP rotation, BPF filters, promiscuous mode
│   │   ├── dns_logger.py            # Per-host DNS query log, every domain resolved
│   │   ├── tls_sni_extractor.py     # HTTPS destinations from ClientHello SNI field
│   │   ├── credential_sniffer.py    # Cleartext FTP/HTTP/SMTP/POP3/IMAP/Telnet/SNMP + NTLM
│   │   ├── kerberos_harvester.py    # AS-REQ/AS-REP/TGS-REQ/TGS-REP from traffic
│   │   ├── host_discovery.py        # ARP table, DHCP sniffing, mDNS, NetBIOS
│   │   ├── os_fingerprint.py        # Passive OS fingerprinting (p0f-style)
│   │   ├── traffic_analyzer.py      # Protocol distribution, flows, bandwidth, beacons, comm graphs
│   │   ├── vlan_discovery.py        # 802.1Q tags, DTP frames, 802.1X detection
│   │   ├── network_mapper.py        # Who talks to whom, protocol, volume — visual graph
│   │   ├── auth_flow_tracker.py     # Map user-to-service authentication, build timelines
│   │   ├── smb_monitor.py           # File share access patterns (users, shares, files)
│   │   ├── voip_capture.py          # SIP metadata, call records, RTP audio (if unencrypted)
│   │   ├── print_interceptor.py     # PCL/PostScript print spool from network print traffic
│   │   ├── wireless_intel.py        # Probe requests, BLE scanning, WPA handshakes, WIDS
│   │   ├── protocol_analyzer.py     # Zeek-style protocol dissection, service ID, cert analysis
│   │   ├── cloud_token_harvester.py # Passive AWS keys, Azure tokens, JWT, OAuth, SAML
│   │   ├── email_sniffer.py         # Capture email content + attachments from cleartext SMTP/IMAP/POP3
│   │   ├── ldap_harvester.py        # LDAP search query/response parsing, AD object inventory
│   │   ├── rdp_monitor.py           # RDP NLA/CredSSP header parsing, session tracking
│   │   ├── quic_analyzer.py         # QUIC Initial packet SNI extraction (UDP/443)
│   │   └── db_interceptor.py        # MSSQL/MySQL/PostgreSQL/Redis/MongoDB protocol parsing
│   │
│   ├── active/                      # Operator-enabled, then runs unattended
│   │   ├── __init__.py
│   │   ├── arp_spoof.py             # ARP cache poisoning, become MITM gateway
│   │   ├── dns_poison.py            # DNS response injection, redirect queries
│   │   ├── dhcp_spoof.py            # Rogue DHCP to set implant as gateway/DNS
│   │   ├── evil_twin.py             # Rogue AP with captive portal
│   │   ├── ipv6_slaac.py            # IPv6 SLAAC spoofing, become IPv6 gateway
│   │   ├── responder_mgr.py         # Manage Responder process (LLMNR/NBT-NS/mDNS poisoning)
│   │   ├── ssl_downgrade.py         # sslstrip for legacy apps (opt-in, HSTS warning)
│   │   ├── http_logger.py           # Log every URL, header, POST body, cookie (requires MITM)
│   │   ├── file_extractor.py        # Carve files from HTTP/SMB/FTP traffic in real-time
│   │   ├── session_hijacker.py      # Capture cookies, session tokens, JWT from intercepted traffic
│   │   ├── js_injector.py           # Inject keyloggers or BeEF hooks into HTTP responses
│   │   ├── mitmproxy_mgr.py         # Full HTTPS interception with generated certs
│   │   ├── ntlm_relay.py            # ntlmrelayx integration, coordinated with Responder
│   │   └── cloud_token_active.py    # Extract tokens from MITM'd HTTPS traffic
│   │
│   ├── connectivity/
│   │   ├── __init__.py
│   │   ├── tailscale.py             # Tailscale lifecycle, auth, health
│   │   ├── wireguard.py             # WireGuard tunnel management
│   │   ├── bridge.py                # Transparent inline bridge (USB eth + onboard)
│   │   ├── wifi_client.py           # WiFi client mode, network selection
│   │   ├── reverse_tunnel.py        # SSH reverse tunnel fallback
│   │   ├── cellular_backup.py       # LTE modem HAT for out-of-band access (optional)
│   │   ├── ble_emergency.py         # BLE emergency access channel (optional)
│   │   └── data_exfil.py            # Automated data exfiltration pipeline
│   │
│   ├── stealth/
│   │   ├── __init__.py
│   │   ├── mac_manager.py           # MAC randomization / cloning
│   │   ├── process_disguise.py      # Process name/cmdline spoofing
│   │   ├── log_suppression.py       # Syslog filtering, audit rule injection
│   │   ├── encrypted_storage.py     # LUKS container management
│   │   ├── tmpfs_manager.py         # tmpfs mounts for sensitive ops
│   │   ├── watchdog.py              # Health monitoring, auto-restart services
│   │   ├── anti_forensics.py        # Timestomp, secure deletion
│   │   ├── traffic_mimicry.py       # 48h baseline + behavioral blending
│   │   ├── ja3_spoofer.py           # JA3/JA3S TLS fingerprint matching
│   │   ├── ids_tester.py            # Test actions against known IDS rulesets
│   │   ├── lkm_rootkit.py           # Optional LKM for process/file/net hiding (compromised host only)
│   │   └── overlayfs_manager.py     # SD card wear protection via overlayfs
│   │
│   └── intel/
│       ├── __init__.py
│       ├── credential_db.py         # SQLite credential store (all captured creds organized)
│       ├── topology_mapper.py       # Network graph construction, Graphviz export
│       ├── report_generator.py      # Engagement summary, timeline, findings
│       ├── net_intel.py             # Beacon detection, communication graphing
│       ├── user_timeline.py         # Per-user activity timeline (DNS + auth + traffic)
│       ├── supply_chain_detect.py   # Passive detection of internal repos, WSUS, CI/CD, registries
│       ├── change_detector.py       # Continuous network state diffing, burn detection
│       ├── security_posture.py      # Map target defenses (EDR, SIEM, honeypots)
│       └── operator_audit.py        # Encrypted operator session/command audit trail
│
├── services/
│   ├── bigbrother-core.service      # Main daemon (disguised name in production)
│   ├── bigbrother-watchdog.service  # Watchdog / auto-recovery
│   ├── bigbrother-capture.service   # Packet capture (passive)
│   ├── bigbrother-passive.service   # All passive surveillance modules
│   ├── bigbrother-bridge.service    # Transparent bridge
│   └── bigbrother-tailscale.timer   # Tailscale health check timer
│
├── templates/
│   ├── captive_portals/
│   │   ├── corporate_login.html     # Corporate WiFi login mimic
│   │   ├── guest_wifi.html          # Guest WiFi terms page
│   │   ├── outlook_login.html       # O365 login clone
│   │   └── vpn_portal.html          # VPN portal clone
│   ├── dns_zones/
│   │   ├── redirect_all.zone        # Wildcard DNS redirect
│   │   └── selective.zone.j2        # Jinja2 template for targeted DNS
│   ├── hostapd/
│   │   ├── open.conf.j2             # Open AP config
│   │   └── wpa2.conf.j2             # WPA2 AP config
│   ├── responder/
│   │   └── Responder.conf.j2        # Responder config template
│   ├── beef/
│   │   └── hook.js.j2               # BeEF hook injection template
│   └── lkm/
│       ├── bb_hide.c                # Kernel module source
│       └── Makefile                 # Build for target kernel version
│
├── utils/
│   ├── __init__.py
│   ├── crypto.py                    # AES-256-GCM encryption, key derivation, wipe
│   ├── networking.py                # Interface enumeration, IP helpers, raw sockets
│   ├── logging.py                   # Encrypted rotating log, memory-only option
│   ├── stealth.py                   # OPSEC helpers (timing jitter, traffic shaping)
│   ├── resource.py                  # Memory/CPU profiling, Pi Zero limits
│   ├── permissions.py               # Capability checks, privilege escalation
│   └── config_loader.py             # YAML config parser with validation + defaults
│
├── data/
│   ├── oui.db                       # MAC OUI database (SQLite, compressed)
│   ├── os_sigs.db                   # Passive OS fingerprint signatures
│   ├── dhcp_fingerprints.db         # DHCP option 55 fingerprints (Fingerbank dataset)
│   ├── ids_rules/                   # Snort/Suricata rule snapshots for self-testing
│   │   ├── emerging-threats.rules
│   │   └── snort-community.rules
│   ├── ja3_fingerprints.db          # Known JA3 hashes for common browsers
│   ├── wordlists/                   # Pre-bundled for on-device cracking
│   │   ├── rockyou.txt.gz           # Classic password list
│   │   ├── top-1m-passwords.txt     # SecLists top-1M
│   │   └── rules/                   # Hashcat rules
│   │       ├── OneRuleToRuleThemAll.rule
│   │       └── dive.rule
│   └── bpf_filters/
│       ├── credentials.bpf          # BPF for credential protocols
│       ├── dns.bpf                  # BPF for DNS traffic
│       ├── discovery.bpf            # BPF for discovery traffic
│       └── full_capture.bpf         # BPF for full capture (minus noise)
│
├── tests/
│   ├── __init__.py
│   ├── test_engine.py               # Module lifecycle tests
│   ├── test_bus.py                   # Event bus tests
│   ├── test_crypto.py               # Encryption/wipe tests
│   ├── test_modules.py              # Module interface compliance tests
│   ├── test_resource.py             # Resource constraint tests
│   └── conftest.py                  # Pytest fixtures
│
├── scripts/
│   ├── setup_bridge.sh              # Bridge interface setup
│   ├── teardown_bridge.sh           # Bridge interface teardown
│   └── build_lkm.sh                # Compile rootkit LKM for target kernel
│
└── storage/                         # Runtime data (gitignored, LUKS-encrypted)
    ├── config/                      # Sensitive config (keys, auth, engagement details)
    ├── pcaps/                       # Rotated packet captures (zstd compressed)
    ├── creds/                       # Extracted credentials
    ├── dns_logs/                    # DNS query logs per host
    ├── sni_logs/                    # TLS SNI destination logs
    ├── emails/                      # Captured email content + attachments
    ├── files/                       # Carved files from traffic
    ├── voip/                        # SIP metadata + RTP audio captures
    ├── print_jobs/                  # Intercepted print spool data
    ├── intel/                       # Analysis outputs, topology graphs
    ├── baseline/                    # Traffic baseline data (48h capture)
    ├── audit/                       # Operator session/command audit trail
    └── logs/                        # Encrypted operation logs

---

3. Surveillance Modules

3.1 Passive Surveillance (24/7, zero noise, unsupervised)

22 passive modules. These start at deployment and run continuously without generating any network traffic. All receive packets via the capture bus (one AF_PACKET socket, demuxed to per-module queues).

---

modules/passive/packet_capture.py — Full Packet Capture

Purpose: Capture all network traffic to encrypted rotating PCAPs for offline analysis.

• Promiscuous mode on bridge or tap interface
• BPF filters: full capture, credentials-only, DNS-only, or custom
• PCAP rotation: size-based (100MB uncompressed default) or time-based (1h default)
• Max compression pipeline on rotation: zstd level 19 (max) → AES-256-GCM encrypt → .pcap.zst.enc
  • zstd -19 achieves 10-15x compression on typical network PCAPs (100MB → 7-10MB)
  • On 128GB SD: ~1.2TB effective PCAP storage (days of full capture on busy networks)
  • Compressed files dramatically faster to exfil when operator pulls data over Tailscale/WG
  • Decompression on operator's workstation: zstd -d then open in Wireshark
  • CPU cost: zstd -19 on Pi 4 compresses at ~5-10MB/s (runs as background task after rotation, not inline)
  • Pi Zero: use zstd -3 (fast mode, still 5-8x compression, minimal CPU)
• Snap length configurable: 96 bytes (headers only) for Pi Zero, 65535 (full) for Pi 4+
• Tiered retention: Headers-only (snap=96) as default on all tiers for bulk traffic. Separate credential-protocol full-capture ring buffer (NTLM, Kerberos, HTTP auth ports only). Full PCAP is operator-opt-in for targeted sessions. A 100Mbps link generates ~45GB/hour at full snap — without tiering, 32GB fills in hours and auto-purge destroys historical data.
• Disk usage monitoring — auto-purge oldest PCAPs when threshold hit (bulk first, credential ring preserved)
• PcapNG format support for metadata embedding (interface info, comments, timestamps)

Resources: RAM 30-80MB (snap length dependent), CPU 5-15% capture + compression spikes on rotation, disk varies Dependencies: libpcap, scapy, zstandard (Python binding)

---

modules/passive/dns_logger.py — DNS Query Logger

Purpose: Build per-host browsing history from DNS queries. Every domain every host resolves, timestamped.

• Capture DNS queries and responses (UDP/53, TCP/53)
• Per-source-IP log: timestamp, queried domain, response IPs, query type
• Aggregate into browsing profiles per host
• Detect internal DNS servers, split-horizon configurations
• Flag interesting domains: cloud services, security tools, update servers, webmail
• Flag hosts connecting to known DoH resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9) — indicates DNS blind spot for that host
• When in MITM position: option to block DoH resolver IPs and strip HTTPS DNS records (type 65) to force plaintext DNS
• Batch inserts: buffer 1000 records, flush every 60s (reduces SQLite write contention)

Resources: RAM 15MB, CPU 2%, disk 5MB/day typical Dependencies: scapy or dpkt

---

modules/passive/tls_sni_extractor.py — TLS SNI Extractor

Purpose: Log every HTTPS destination without decryption, from the ClientHello SNI field.

• Parse TLS ClientHello from TCP/443 (and other TLS ports)
• Extract Server Name Indication field — reveals destination even when encrypted
• Correlate with DNS logs for complete web activity picture
• Detect certificate pinning, TLS 1.3 encrypted SNI (ESNI/ECH) gaps
• ECH limitation: Encrypted Client Hello (Cloudflare, Google, Firefox) returns CDN dummy SNI — no passive mitigation. ECH requires full TLS interception to defeat.
• DoH blind spot: DNS-over-HTTPS to hardcoded resolvers (1.1.1.1, 8.8.8.8) bypasses dns_logger entirely — 30-70% of endpoint DNS may be encrypted. Internal AD DNS to domain controllers remains visible on UDP/53. When in MITM position, block DoH resolver IPs and strip HTTPS DNS records (type 65) to force plaintext fallback.
• TLS 1.3: Server certificates encrypted during handshake — passive cert extraction impossible. Rely on SNI (while available) and CT logs.
• Log: timestamp, source IP, destination IP:port, SNI hostname, TLS version
• QUIC/HTTP3 SNI handled by separate quic_analyzer.py module

Resources: RAM 10MB, CPU 2%, disk 3MB/day typical Dependencies: scapy or dpkt

---

modules/passive/credential_sniffer.py — Credential Sniffer

Purpose: Extract credentials from cleartext protocols and NTLM/Kerberos authentication.

• Cleartext: FTP (USER/PASS), HTTP Basic/Digest, HTTP form POST, SMTP AUTH, POP3 USER/PASS, IMAP LOGIN, Telnet, SNMP community strings, LDAP simple bind
• NTLM: Extract NTLMv1/v2 challenge-response from SMB, HTTP NTLM, LDAP NTLM, MSSQL NTLM
• Kerberos: Extract encrypted timestamps from AS-REQ (password spray targets)
• Realistic yield: On modern networks (85-95% encrypted), cleartext protocols yield near-zero in passive mode. SMTP is universally STARTTLS. Primary passive value is NTLM/Kerberos from wire. Cleartext sniffer becomes high-value only with active MITM position.
• Output: hashcat-compatible format, stored in credential_db
• Publishes CREDENTIAL_FOUND events on bus
• Auto-queue captured hashes for CPU-mode john/hashcat in low-priority cgroup; push hashes immediately to operator's cracking rig via data_exfil for GPU cracking

Resources: RAM 20MB, CPU 3%, disk 5MB Dependencies: scapy, impacket (for NTLM/Kerberos parsing)

---

modules/passive/kerberos_harvester.py — Kerberos Ticket Harvester

Purpose: Extract Kerberos tickets from network traffic for offline cracking.

• AS-REQ: Extract encrypted timestamps (hashcat mode 7500)
• AS-REP: Extract hashes for accounts without pre-auth (hashcat mode 18200) — AS-REP roasting from the wire
• TGS-REQ: Log SPN requests — reveals what services users access
• TGS-REP: Extract service ticket hashes (hashcat mode 13100) — Kerberoasting from the wire
• Identify domain controllers, realm names, user principal names
• Feed all hashes into credential_db

Resources: RAM 15MB, CPU 3%, disk 10MB Dependencies: scapy, impacket

---

modules/passive/host_discovery.py — Host Discovery

Purpose: Build complete host inventory from passive network observation.

• ARP table monitoring (new MACs)
• DHCP request/ACK sniffing (hostname, vendor class, requested IP)
• DHCP option 55 (Parameter Request List) parsing for device fingerprinting via data/dhcp_fingerprints.db (Fingerbank dataset)
• mDNS/Bonjour service announcements
• NetBIOS name queries and responses
• SSDP/UPnP discovery traffic
• NBNS and LLMNR queries (hostname resolution attempts)
• Correlate: IP + MAC + hostname + vendor (OUI) + OS guess + DHCP fingerprint

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: scapy, data/oui.db, data/dhcp_fingerprints.db

---

modules/passive/os_fingerprint.py — Passive OS Fingerprinting

Purpose: Identify operating systems without sending any probes. p0f-style.

• TCP SYN/SYN-ACK analysis: window size, TTL, DF flag, MSS, window scaling, SACK, timestamps
• HTTP User-Agent header extraction
• DHCP vendor class identifier
• SMB dialect negotiation
• SSH version strings
• Confidence scoring per host, multiple evidence sources

Resources: RAM 10MB, CPU 2%, disk 2MB Dependencies: scapy, data/os_sigs.db

---

modules/passive/traffic_analyzer.py — Traffic Analyzer

Purpose: Protocol distribution, flow analysis, bandwidth monitoring, beacon detection.

• Protocol breakdown: percentage by packet count and bytes
• Flow tracking: 5-tuple flows, duration, bytes transferred
• Top talkers: hosts by volume, connections, protocol diversity
• Beacon detection: regular-interval communications that suggest C2, heartbeats, or update checks
• Bandwidth profiling: hourly/daily patterns, anomaly detection
• Communication graphs: source-destination pairs with protocol and volume edges

Resources: RAM 25-60MB (flow table size), CPU 5%, disk 10MB Dependencies: scapy

---

modules/passive/vlan_discovery.py — VLAN Discovery

Purpose: Map VLAN topology from passive observation.

• 802.1Q tag detection — identify VLANs in use
• DTP frame capture — detect trunk negotiation
• 802.1X/EAPOL frame detection — identify NAC-protected ports
• CDP/LLDP frame parsing — switch names, port IDs, VLAN assignments
• STP BPDU parsing — switch topology, root bridge identification

Resources: RAM 10MB, CPU 1%, disk 2MB Dependencies: scapy

---

modules/passive/network_mapper.py — Network Relationship Mapper

Purpose: Build a comprehensive map of who talks to whom, how much, and over what protocols. Visual graph output.

• Track all communication pairs with protocol and volume metadata
• Identify servers (many inbound connections) vs clients (many outbound)
• Detect admin workstations (SSH/RDP to many hosts)
• Map printer relationships, file server access patterns
• Graphviz DOT output for topology visualization
• Periodic snapshots for change detection

Resources: RAM 20MB, CPU 3%, disk 5MB Dependencies: scapy, graphviz (for rendering)

---

modules/passive/auth_flow_tracker.py — Authentication Flow Tracker

Purpose: Map who authenticates to what services and when, building per-user activity timelines.

• Track Kerberos TGT requests (AS-REQ) — user login events
• Track Kerberos service ticket requests (TGS-REQ) — service access
• Track NTLM authentication across protocols (SMB, HTTP, LDAP, MSSQL)
• Track SSH connection establishment
• Track LDAP binds
• Build per-user timeline: login time, services accessed, duration patterns
• Identify service accounts (authenticate to many hosts, regular intervals)

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: scapy, impacket

---

modules/passive/smb_monitor.py — SMB File Access Monitor

Purpose: Track file share access patterns — which users access which shares and files.

• Parse SMB2/3 tree connect requests — which shares are accessed
• Parse SMB2/3 create requests — which files are opened
• Track read/write operations per user per share
• Identify sensitive shares (SYSVOL, NETLOGON, C$, ADMIN$, custom shares)
• Log: timestamp, user, source IP, share name, file path, operation
• Detect GPP/Group Policy access patterns
• SMB3 limitation: Windows Server 2022 and Windows 11 default to SMB 3.1.1 with AES encryption. Negotiate/session setup (capabilities, NTLM) is visible but encrypted payload is opaque. File access monitoring requires active MITM with SMB downgrade.

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: scapy, impacket

---

modules/passive/voip_capture.py — VoIP/SIP Metadata Capture

Purpose: Capture call records, participants, duration. Optionally capture RTP audio if unencrypted.

• Parse SIP INVITE/BYE/CANCEL — call setup and teardown
• Extract: caller, callee, call-ID, codec, duration
• Track RTP streams associated with SIP sessions
• If RTP is unencrypted: capture audio to WAV files
• If SRTP: log metadata only (cannot decrypt)
• Detect VoIP infrastructure (PBX, SBC, trunks)

Resources: RAM 20MB + audio storage, CPU 3%, disk varies (audio intensive) Dependencies: scapy, wave (stdlib)

---

modules/passive/print_interceptor.py — Print Job Interceptor

Purpose: Capture print spool data from network print traffic.

• Capture RAW print data (TCP/9100 — JetDirect/AppSocket)
• Capture LPD print data (TCP/515)
• Capture IPP print data (TCP/631)
• Extract PCL and PostScript content
• Convert to PDF where possible (Ghostscript)
• Log: timestamp, source IP, printer IP, job size, content preview

Resources: RAM 15MB, CPU 2%, disk varies (print job size) Dependencies: scapy, ghostscript (optional, for PDF conversion)

---

modules/passive/wireless_intel.py — Wireless Intelligence

Purpose: Probe request collection, BLE scanning, WPA handshake capture, WIDS detection.

• Monitor mode on WiFi interface (requires capable adapter)
• Probe request collection — reveals client preferred network history
• BLE scanning — identify phones, badges, IoT devices
• WPA 4-way handshake passive capture from legitimate connections
• WIDS detection — identify wireless IDS by monitoring for correlation patterns (run 2-hour observation before allowing evil_twin)
• Publishes HANDSHAKE_CAPTURED events
• Interface conflict: Monitor mode on wlan0 and wifi_client managed mode are mutually exclusive on same interface. Requires explicit second USB WiFi adapter for concurrent monitor+client. engine.py detects and prevents conflicting modes.

Resources: RAM 20MB, CPU 3%, disk 10MB Dependencies: scapy, aircrack-ng (for monitor mode), bluez (for BLE)

---

modules/passive/protocol_analyzer.py — Protocol Deep Analyzer

Purpose: Zeek-style protocol dissection, service identification, certificate analysis.

• Protocol identification beyond port numbers (payload heuristics)
• Service banner extraction: version strings, server headers
• TLS certificate analysis: SANs, issuers, expiry, chain validation
• OT protocol detection: Modbus (502), DNP3 (20000), OPC UA (4840), S7comm, BACnet, EtherNet/IP
• HTTP/2 and QUIC identification
• Anomaly flagging: unusual protocols, new services, version changes

Resources: RAM 40MB, CPU 5%, disk 20MB Dependencies: scapy, dpkt

---

modules/passive/cloud_token_harvester.py — Cloud Token Harvester (Passive)

Purpose: Passively extract cloud credentials and tokens from observed traffic.

• AWS: Access keys (AKIA*), secret keys, session tokens in HTTP headers/bodies
• Azure: Bearer tokens, refresh tokens in HTTP Authorization headers
• GCP: OAuth tokens, service account key patterns
• Generic: JWT tokens (decode header + claims), SAML assertions, OAuth authorization codes
• Only from cleartext protocols or already-decrypted MITM traffic
• Feed into credential_db with cloud provider context

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: scapy, pyjwt (for JWT decoding)

---

modules/passive/email_sniffer.py — Email Sniffer

Purpose: Capture email content and attachments from unencrypted SMTP/IMAP/POP3.

• Parse SMTP (TCP/25, 587) conversations — extract sender, recipients, subject, body, attachments
• Parse IMAP (TCP/143) FETCH responses — extract email content
• Parse POP3 (TCP/110) RETR responses — extract email content
• Decode MIME multipart, Base64 attachments, quoted-printable
• Store: per-email directory with headers, body text, and attachment files
• Only captures cleartext — encrypted (STARTTLS, SSL) requires MITM position
• Realistic yield: SMTP is universally STARTTLS in 2026. Expect near-zero cleartext email capture on modern networks without active MITM.

Resources: RAM 20MB, CPU 3%, disk varies (attachment size) Dependencies: scapy, email (stdlib)

---

modules/passive/ldap_harvester.py — LDAP Query Harvester

Purpose: Parse LDAP search queries and responses to build a passive AD object inventory.

• Parse LDAP SearchRequest/SearchResponse on ports 389 (LDAP) and 3268 (Global Catalog)
• Extract: base DN, search filter, requested attributes, result entries
• Build inventory: users, groups, computers, GPOs, SPNs, delegation attributes
• Detect LAPS password reads (ms-Mcs-AdmPwd attribute requests)
• Identify enumeration patterns that reveal admin tools (BloodHound, ADFind, PowerView queries)
• Feed extracted objects into topology_mapper and credential_db (service account descriptions often contain passwords)

Resources: RAM 20MB, CPU 3%, disk 10MB Dependencies: scapy, impacket (for LDAP parsing)

---

modules/passive/rdp_monitor.py — RDP Session Monitor

Purpose: Extract intelligence from RDP connection negotiation without decryption.

• Parse RDP NLA (Network Level Authentication) negotiation headers on TCP/3389
• Extract: username, domain, client hostname, keyboard layout, client build number
• Parse CredSSP to capture NTLM/Kerberos auth (feed to kerberos_harvester and credential_sniffer)
• Track admin-to-server session patterns: who RDPs where and when
• Identify jump boxes (hosts receiving many RDP sessions) and admin workstations (hosts initiating many)

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: scapy, impacket

---

modules/passive/quic_analyzer.py — QUIC/HTTP3 SNI Extractor

Purpose: Extract TLS SNI from QUIC Initial packets on UDP/443, covering the 30-40% of web traffic invisible to TCP-based TLS extraction.

• Parse QUIC Initial packets (RFC 9000) from UDP/443 traffic
• Decrypt Initial packet payload using connection ID-derived keys (standard per RFC 9001, not secret)
• Extract CRYPTO frames containing TLS ClientHello
• Parse SNI from embedded ClientHello — same format as TCP TLS
• Feed results into tls_sni_extractor's log format for unified SNI visibility

Resources: RAM 10MB, CPU 2%, disk 3MB/day Dependencies: scapy

---

modules/passive/db_interceptor.py — Database Protocol Interceptor

Purpose: Parse database wire protocols to extract login sequences, queries, and credential-containing statements.

• MSSQL TDS (TCP/1433): login packets (username, hostname, app name), SQL batch queries
• MySQL (TCP/3306): handshake (server version, auth plugin), login, query packets
• PostgreSQL (TCP/5432): startup (user, database), simple/extended query protocol
• Redis (TCP/6379): AUTH commands, key operations (detect credential storage patterns)
• MongoDB (TCP/27017): OP_MSG/OP_QUERY for auth, find, and aggregate operations
• Flag credential-containing queries (INSERT INTO users, SET password, connection strings)
• Extract result metadata (row counts, column names) without storing full result sets

Resources: RAM 25MB, CPU 3%, disk 10MB Dependencies: scapy, impacket

---

3.2 Active Surveillance (operator-enabled, then runs unattended)

These modules require explicit operator activation. Once configured and started, they run without further interaction.

---

modules/active/arp_spoof.py — ARP Spoofing

Purpose: Become the man-in-the-middle by poisoning ARP caches. All target traffic flows through the implant.

OPSEC WARNING: ARP spoofing is the most-detected active technique. DAI on managed switches silently prevents it. EDR agents (CrowdStrike, SentinelOne, Defender ATP) alert on ARP cache anomalies within minutes. ARPwatch and Wazuh agents generate immediate alerts. Even with rate-limiting and jitter, ARP spoof against EDR-protected endpoints is detected. Prefer Responder + ipv6_slaac as primary credential capture. Reserve ARP spoof for confirmed legacy segments with no DAI/EDR. Run ids_tester DAI probe before activation.

• Gratuitous ARP replies to targets, impersonating gateway
• Gratuitous ARP replies to gateway, impersonating targets
• IP forwarding enabled to maintain connectivity
• Target list: specific hosts (not full subnet — less noise)
• Rate-limited ARP replies with jitter
• Restore original ARP entries on stop
• Crash recovery: Kernel-level ARP restoration — cron job every 30s checks arp_spoof PID, sends gratuitous ARP corrections if process is dead. Prevents spoofed targets from losing gateway connectivity (1-5 min ARP timeout) on crash.

Resources: RAM 10MB, CPU 2% Dependencies: scapy, iptables

---

modules/active/dns_poison.py — DNS Poisoning

Purpose: Redirect DNS queries to capture credentials or redirect users to cloned sites.

• DNS response injection — race legitimate DNS server
• Selective targeting: specific domains only, forward everything else
• Redirect to captive portal (credential capture)
• Redirect to cloned services (phishing)
• Wildcard mode (redirect all) or targeted mode (redirect specific domains)
• Jinja2 zone templates for flexible configuration

Resources: RAM 10MB, CPU 2% Dependencies: scapy, dnslib

---

modules/active/dhcp_spoof.py — DHCP Spoofing

Purpose: Rogue DHCP server to set implant as gateway and/or DNS server for new clients.

• Respond to DHCP DISCOVER before legitimate server (race condition)
• Set implant IP as default gateway — all traffic routes through implant
• Set implant IP as DNS server — all DNS queries visible
• Configurable lease time, subnet mask, DNS settings
• Target specific MACs or respond to all (when scope.yaml loaded, only responds to in-scope MACs)

Resources: RAM 10MB, CPU 1% Dependencies: scapy

---

modules/active/evil_twin.py — Evil Twin AP

Purpose: Rogue access point with captive portal for credential harvesting.

OPSEC WARNING: Enterprise WIDS (Cisco, Aruba, Meraki) alerts immediately on any AP advertising a corporate SSID from an unknown BSSID. No evasion is possible — this is structural. Deauth floods are separately detected. 802.11w (protected management frames) prevents deauth entirely. Only viable in environments confirmed to have no WIDS. Run wireless_intel WIDS detection check (2-hour observation) before allowing evil_twin activation.

• hostapd-based AP matching target SSID
• Open or WPA2 mode
• Captive portal serving credential harvesting pages (corporate login, O365, guest WiFi)
• Optional deauth of target AP to force client migration
• Captured credentials fed to credential_db
• Channel selection to minimize interference

Resources: RAM 30MB, CPU 5% Dependencies: hostapd, dnsmasq, iptables, USB WiFi adapter

---

modules/active/ipv6_slaac.py — IPv6 SLAAC Spoofing

Purpose: Become IPv6 default gateway via Router Advertisements. Bypasses IPv4-only defenses like DAI.

• Send Router Advertisement messages with implant as default gateway
• Targets automatically configure IPv6 address and route through implant
• DNS via Router Advertisement — set implant as IPv6 DNS
• Most networks have no IPv6 RA Guard deployed
• Combine with DNS poisoning for credential capture
• Works alongside mitm6 (pre-installed tool)

Resources: RAM 10MB, CPU 2% Dependencies: scapy

---

modules/active/responder_mgr.py — Responder Manager

Purpose: Manage the Responder process for LLMNR/NBT-NS/mDNS poisoning and NTLMv2 hash capture.

OPSEC WARNING: Responder poisoning has mature detection coverage. Microsoft Defender for Identity has dedicated LLMNR/NBT-NS poisoning alerts. Suricata ET POLICY rules match poisoning responses. CrowdStrike/SentinelOne alert on NTLM auth to unexpected destinations. Advanced SOCs deploy honeypot LLMNR names. Implement selective targeting: only respond to hostnames never seen in legitimate DNS. Avoid responses during known SOC shift changes.

• Start/stop/monitor Responder subprocess
• Configure via Responder.conf.j2 template (enable/disable protocols)
• Parse Responder output for captured hashes
• Feed hashes into credential_db automatically
• Coordinate with ntlm_relay for relay attacks
• This manages Responder — operator can also run Responder directly

Resources: RAM 30MB (Responder process), CPU 3% Dependencies: Responder (installed by setup.sh)

---

modules/active/ssl_downgrade.py — SSL Downgrade

Purpose: sslstrip for legacy applications. Opt-in only.

• Disabled by default — requires explicit enable in modules.yaml
• Warning on activation about HSTS rendering this mostly ineffective
• Strip HTTPS redirects from HTTP responses
• Only useful against legacy internal apps without HSTS
• For modern HTTPS interception, use mitmproxy_mgr instead

Resources: RAM 15MB, CPU 2% Dependencies: iptables, scapy

---

modules/active/http_logger.py — HTTP Transaction Logger

Purpose: When in MITM position, log every HTTP transaction: URL, headers, POST body, cookies.

• Requires active MITM (arp_spoof, dhcp_spoof, or ipv6_slaac running)
• Log full URL including query parameters
• Log request and response headers
• Log POST/PUT body content (form data, JSON, XML)
• Extract and log cookies (session tokens, auth cookies)
• Configurable: log all or filter by content-type/URL pattern

Resources: RAM 20MB, CPU 3%, disk varies Dependencies: scapy or mitmproxy

---

modules/active/file_extractor.py — File Extractor

Purpose: Carve files from HTTP/SMB/FTP traffic in real-time.

• Requires MITM position for HTTPS content
• HTTP: reconstruct files from chunked/gzip responses
• SMB: extract files from SMB2/3 read responses
• FTP: capture files from data connections
• Detect file type by magic bytes, store with metadata
• Filter: all files or specific types (documents, executables, archives)

Resources: RAM 40MB, CPU 5%, disk varies heavily Dependencies: scapy, python-magic

---

modules/active/session_hijacker.py — Session Hijacker

Purpose: Capture cookies, session tokens, and JWT from intercepted traffic.

• Requires MITM position
• Extract Set-Cookie and Cookie headers from HTTP
• Extract Authorization headers (Bearer tokens, Basic auth)
• Extract JWT tokens from headers, URL parameters, POST bodies
• Parse JWT claims (expiry, scope, user info)
• Store in credential_db with service context and expiry

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: scapy, pyjwt

---

modules/active/js_injector.py — JavaScript/HTML Injection

Purpose: Inject keyloggers or BeEF hooks into HTTP responses when in MITM position.

• Requires MITM position (HTTP only — HTTPS needs mitmproxy_mgr)
• Inject <script> tag into HTML responses before </body>
• Payloads: keylogger (POST keystrokes to implant), BeEF hook, custom JS
• Selective injection by target IP, domain, or URL pattern
• BeEF hook template included
• Captured keystrokes stored in credential_db

Resources: RAM 15MB, CPU 2% Dependencies: scapy or mitmproxy

---

modules/active/mitmproxy_mgr.py — mitmproxy Integration

Purpose: Full HTTPS interception with on-the-fly generated certificates. Operator activates knowing this causes certificate warnings.

• Manage mitmproxy process in transparent mode
• Generate CA cert (operator must install on targets or accept warnings)
• CA cert IOC: Override default mitmproxy CA CN (default is "mitmproxy") to match target's existing PKI naming convention. The CA cert is attributable forensic evidence that survives the engagement. Only practical against internal apps with no cert pinning where operator can pre-install CA via GPO.
• Full request/response logging for HTTPS traffic
• Script hooks for credential extraction, file carving, injection
• Provides decrypted traffic to other modules (http_logger, file_extractor, cloud_token_active)
• Not available on Pi Zero 2W (RAM constraint)

Resources: RAM 100-200MB, CPU 10-20% Dependencies: mitmproxy (installed by setup.sh), iptables

---

modules/active/ntlm_relay.py — NTLM Relay

Purpose: ntlmrelayx integration for relaying captured NTLM authentication.

• Manage ntlmrelayx process (from Impacket)
• Relay targets: SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS HTTP enrollment
• Coordinate with responder_mgr — Responder captures, ntlmrelayx relays
• Coordinate with operator running coercion tools (PetitPotam, PrinterBug) — without coercion, ntlm_relay waits passively for organic auth (slow). Coercer + PetitPotam pre-installed for this reason.
• ADCS ESC8 relay: relay to HTTP enrollment endpoint for certificate issuance
• LDAP relay: add users, modify ACLs, add replication rights for DCSync
• Output: relay results, captured credentials, obtained certificates

Resources: RAM 40MB (ntlmrelayx process), CPU 5% Dependencies: impacket (installed by setup.sh)

---

modules/active/cloud_token_active.py — Cloud Token Harvester (Active)

Purpose: Extract cloud tokens from MITM'd HTTPS traffic. Enhanced version of passive harvester.

• Requires mitmproxy_mgr running (decrypted HTTPS)
• AWS: STS AssumeRole responses, console session tokens
• Azure: MSAL/ADAL token responses, Graph API tokens
• GCP: OAuth token responses, metadata server responses
• Generic: All JWT tokens, SAML assertions in decrypted HTTPS
• Enrichment: decode tokens, extract scopes, check expiry

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: mitmproxy, pyjwt

---

3.3 Intelligence & Analysis

---

modules/intel/credential_db.py — Credential Database

Purpose: Central SQLite store for all captured credentials, organized and deduplicated.

• Schema: source_module, timestamp, source_ip, target_ip, target_service, username, domain, credential_type (cleartext/ntlmv1/ntlmv2/kerberos_tgs/kerberos_asrep/jwt/cookie/cloud_token), credential_value, hashcat_mode, cracked_value, notes
• Deduplication on (target_service, username, credential_type, credential_value)
• Export: hashcat format (by mode), CSV, JSON
• Query interface: by host, user, service, type, time range
• Statistics: credential count by type, crack rate

Resources: RAM 10MB, CPU 1%, disk varies Dependencies: sqlite3 (stdlib)

---

modules/intel/topology_mapper.py — Network Topology Mapper

Purpose: Generate network topology diagrams from collected data.

• Aggregate data from host_discovery, network_mapper, vlan_discovery
• Generate Graphviz DOT files for network diagrams
• Node types: workstation, server, printer, router, switch, AP, unknown
• Edge types: colored by protocol (SMB=blue, SSH=green, HTTP=orange, etc.)
• VLAN boundaries, subnet groupings
• Export: DOT, SVG, PNG

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: graphviz

---

modules/intel/report_generator.py — Engagement Report Generator

Purpose: Generate engagement summary with timeline, findings, and topology.

• Engagement timeline: chronological event log with timestamps
• Credential report: all captured credentials, sources, crack status
• Topology diagram: auto-generated network map
• Host inventory: all discovered hosts with OS, services, notes
• Traffic statistics: protocol distribution, top talkers, bandwidth
• Export: Markdown and HTML

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: jinja2

---

modules/intel/net_intel.py — Network Intelligence

Purpose: Beacon detection, communication graphing, existing C2/malware detection.

• Beacon detection: identify regular-interval communications (C2 beacons, heartbeats, update checks)
• Communication graphing: trust relationships, admin access patterns
• Anomaly baseline: what is normal traffic so implant can blend in
• Service dependency mapping: identify critical services
• Detect existing compromises on the network (other attackers' C2)

Resources: RAM 20MB, CPU 3%, disk 5MB Dependencies: numpy (optional, for statistical analysis)

---

modules/intel/user_timeline.py — Per-User Activity Timeline

Purpose: Build detailed per-user activity timelines from DNS, auth, traffic, and SMB data.

• Aggregate from: dns_logger, auth_flow_tracker, smb_monitor, credential_sniffer
• Per-user view: login times, services accessed, files opened, websites visited, email activity
• Identify: work hours, break patterns, admin activity windows
• Identify: service accounts (24/7 activity, many hosts)
• Export: per-user JSON timeline, summary report

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: sqlite3 (stdlib)

---

modules/intel/supply_chain_detect.py — Supply Chain Detection

Purpose: Passively detect internal infrastructure that represents supply chain attack surfaces.

• Internal package repos: PyPI mirrors, npm registries, Maven, NuGet
• WSUS servers (Windows Update)
• Internal CA servers
• Configuration management: Puppet, Chef, Ansible, SCCM endpoints
• Container registries: Docker, Harbor
• CI/CD systems: Jenkins, GitLab, TeamCity
• Output: list of supply chain targets for operator awareness
• Detection only — no exploitation, no interaction

Resources: RAM 10MB, CPU 1%, disk 2MB Dependencies: scapy

---

modules/intel/change_detector.py — Network Change Detection

Purpose: Continuously diff network state against baseline. Early warning system for IR activity and burn detection.

• After baseline period, snapshot network state hourly: hosts, services, connection patterns
• Alert on: new hosts appearing, new services on existing hosts, hosts disappearing
• Alert on: security tool traffic (connections to known EDR/SIEM update domains)
• Alert on: scan activity targeting the implant's segment (port sweeps, ARP scans)
• Alert on: unusual auth patterns (new admin accounts, bulk password changes)
• Publishes CHANGE_DETECTED events on bus with severity (INFO/WARN/CRITICAL)
• Critical changes (potential IR activity, new security tools) logged for operator triage

Resources: RAM 15MB, CPU 2%, disk 5MB Dependencies: sqlite3 (stdlib)

---

modules/intel/security_posture.py — Security Posture Mapper

Purpose: Passively map the target's defensive infrastructure. Know what you're up against before going active.

• Detect EDR update traffic: CrowdStrike (ts01-b.cloudsink.net), SentinelOne, Carbon Black, Defender ATP
• Detect SIEM log forwarding: syslog to collectors, Splunk HEC (TCP/8088), Wazuh agent traffic
• Detect vulnerability scanners: Nessus, Qualys, Rapid7 scan patterns
• Detect honeypots: Thinkst Canary traffic patterns, HoneyComb, T-Pot signatures
• Detect network taps: SPAN port indicators, packet broker traffic (Gigamon, Keysight)
• Detect NAC infrastructure: 802.1X RADIUS, Forescout, ISE traffic patterns
• Output: defense inventory with confidence scores, gates active module risk assessment

Resources: RAM 10MB, CPU 2%, disk 5MB Dependencies: scapy

---

modules/intel/operator_audit.py — Operator Audit Trail

Purpose: Log operator SSH sessions and commands to encrypted storage for engagement reporting and legal protection.

• Hook via PROMPT_COMMAND to capture shell commands when operator SSHes in
• Log: timestamp, SSH session ID, username, command, working directory
• Log BigBrother CLI invocations with arguments
• All audit data written to LUKS-encrypted storage/audit/ — never to system logs
• Tamper-evident: append-only log with HMAC chain
• Export: timeline format for engagement reports and deconfliction

Resources: RAM 5MB, CPU 0.5%, disk varies Dependencies: sqlite3 (stdlib)

---

4. Connectivity

modules/connectivity/tailscale.py — Tailscale (Primary)

Purpose: Primary operator access via Tailscale mesh VPN.

OPSEC WARNING: Tailscale connects to login.tailscale.com and known DERP relay IPs. Corporate proxy logs, Zeek, or NGFW will flag connections to Tailscale infrastructure from a device that has never used it. The IP ranges and hostnames are publicly documented. If target network has no existing Tailscale traffic (check during baseline), prefer WireGuard to a self-hosted endpoint or reverse SSH over stunnel. Traffic mimicry cannot fix a fundamentally new destination.

• Install and authenticate Tailscale on deployment
• Pre-auth key with engagement-specific ACL tags
• Hostname matches device disguise (e.g., "iot-sensor-03")
• Health monitoring: check Tailscale state, re-auth if needed
• Operator SSHes over Tailscale to use pre-installed tools
• Looks like HTTPS to Derp relay servers on the network

Resources: RAM 30MB, CPU 2% Dependencies: tailscale (installed by setup.sh)

---

modules/connectivity/wireguard.py — WireGuard (Fallback)

Purpose: Fallback VPN if Tailscale is blocked or unavailable.

• WireGuard tunnel to operator's endpoint
• Pre-configured keys, minimal handshake
• UDP-based, single port, encrypted
• Automatic keepalive for NAT traversal
• Lower overhead than Tailscale

Resources: RAM 5MB, CPU 1% Dependencies: wireguard-tools

---

modules/connectivity/bridge.py — Transparent Inline Bridge

Purpose: Insert implant inline between target host and switch. Invisible at L2/L3.

• Bridge two Ethernet interfaces (USB eth + onboard)
• No IP address on bridge interfaces — invisible on network
• 802.1X bypass (silentbridge technique): Clone victim MAC on external interface, pass all EAP frames bidirectionally, implant's own traffic uses cloned MAC. EAPOL passthrough alone is insufficient — switch may detect topology change, MAB lists may reject, re-auth timers cause delayed failure. WiFi-only fallback when wired 802.1X blocks deployment.
• All traffic passes through — available for passive capture
• Clone victim MAC for implant's own traffic
• Disable STP on bridge, suppress BPDU frame emission via ebtables
• Filter CDP/LLDP emission from bridge interfaces (receive only, never transmit)
• Failsafe: lightweight C watchdog checks bridge forwarding every 5s, direct passthrough if down >10s
• Bridge failure = network outage: Inline bridge is a single point of failure. Hardware bypass relays mitigate but don't eliminate risk. Bridge failure will be noticed; watchdog minimizes outage to <15 seconds.

Resources: RAM 10MB, CPU 2% Dependencies: bridge-utils, ebtables, scripts/setup_bridge.sh

---

modules/connectivity/wifi_client.py — WiFi Client Mode

Purpose: Connect to target WiFi network for access.

• wpa_supplicant managed connection
• Support for WPA2-PSK, WPA2-Enterprise (PEAP/EAP-TLS)
• Network selection from config
• Signal strength monitoring
• Roaming support

Resources: RAM 10MB, CPU 1% Dependencies: wpa_supplicant, wireless-tools

---

modules/connectivity/reverse_tunnel.py — Reverse SSH Tunnel

Purpose: Fallback access when VPN is blocked. SSH out to operator-controlled server.

• autossh for persistent reverse tunnel
• Operator connects: ssh -J jumphost -p tunnel_port implant
• Dynamic port forwarding (SOCKS proxy) option
• Multiple tunnel endpoints for redundancy
• SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl) — never raw SSH on 443 (DPI detects SSH banner on non-SSH ports)

Resources: RAM 15MB, CPU 1% Dependencies: autossh, openssh-client, stunnel4 or ncat

---

modules/connectivity/cellular_backup.py — Cellular Backup (Optional)

Purpose: Out-of-band access via LTE modem when target network blocks all tunneling.

• LTE modem HAT support (SIM7600, EC25)
• AT command interface, PPP connection
• Completely independent of target network
• Power-hungry (~2W continuous) — Pi 4 only
• Requires pre-provisioned SIM card

Resources: RAM 15MB, CPU 2%, power 2W Dependencies: ppp, usb-modeswitch, LTE modem HAT

---

modules/connectivity/ble_emergency.py — BLE Emergency Access (Optional)

Purpose: Local emergency access via Bluetooth Low Energy when all network access is down.

OPSEC WARNING: BLE advertisements are detectable by any device within 30m scanning on channels 37/38/39. Disable BLE by default. Enable only on-demand (dead man's switch or SMS trigger over cellular). Use random rotating BLE address and non-standard service UUIDs.

• BLE GATT server, ~10m range
• PSK-based challenge-response authentication
• Commands: status, kill, reboot
• Disabled by default — enable only when needed
• Use case: operator physically near implant, network C2 down

Resources: RAM 5MB, CPU 0.5% Dependencies: bluez

---

modules/connectivity/data_exfil.py — Automated Data Exfiltration

Purpose: Push collected data to operator infrastructure automatically. Without this, physical seizure = total loss, SD card corruption = total loss, credentials sit unused for hours/days.

• Priority push: Credentials immediately on CREDENTIAL_FOUND events via active C2 channel (Tailscale/WG)
• Nightly sync: Intel artifacts (topology, timelines, posture map) during off-hours
• On-demand pull: Bulk PCAPs transferred when operator requests
• Rolling window: Keep only recent data locally after successful exfil — reduces seizure exposure
• Respects traffic_mimicry baseline — exfil timed to match normal upload patterns
• Falls back through connectivity chain (Tailscale > WG > reverse SSH > cellular)

Resources: RAM 15MB, CPU 2% (spikes during transfer) Dependencies: rsync, active C2 channel

---

5. Stealth

modules/stealth/mac_manager.py — MAC Randomization/Cloning

• Change from Raspberry Pi OUI (B8:27:EB, DC:A6:32, E4:5F:01) to common vendor
• Clone a specific MAC observed on network
• Persist MAC across reboots
• Different MAC per interface if needed

---

modules/stealth/process_disguise.py — Process Disguise

• Rename all BigBrother processes to match legitimate system services
• Spoof /proc/self/cmdline, /proc/self/comm
• Systemd service descriptions use innocuous names
• ps aux shows nothing suspicious
• Limitation: Defeats ps aux but NOT: /proc/PID/exe (shows real Python binary), strace/ptrace by EDR, systemd-analyze, high CPU/RAM usage inspection. Primary protection must be physical inaccessibility (Pi in cable run) or LKM rootkit (compromised host), not process disguise alone.

---

modules/stealth/log_suppression.py — Log Suppression

• rsyslog filter rules to drop implant-related entries
• auditd rule exclusions for implant paths/PIDs
• journald rate-limit increase to prevent buffer overflow logging
• Clear: bash history (HISTFILE unset), utmp/wtmp/btmp entries

---

modules/stealth/encrypted_storage.py — LUKS Encrypted Storage

• LUKS container for all sensitive data (pcaps, creds, logs, sensitive config)
• Boot-unlock via network-derived key: fetch value from C2 server, combine with device CPU serial via HKDF
• If C2 unreachable on boot: collect to tmpfs until operator reconnects, then flush to LUKS
• ALL config with sensitive data (WG keys, Tailscale auth, engagement name) stored inside LUKS at storage/config/
• Only config/bigbrother.yaml with non-sensitive defaults remains on plaintext filesystem
• LUKS header destruction = instant data unrecoverability (config, creds, pcaps — everything)
• If physically seized without C2 access + device serial: encrypted data is unrecoverable

---

modules/stealth/tmpfs_manager.py — tmpfs for Sensitive Operations

• Mount tmpfs for active operation working directories
• Power loss = instant evidence destruction (RAM is volatile)
• Configurable size per mount point
• Used by active modules for temporary data

---

modules/stealth/watchdog.py — Watchdog

• Monitor all BigBrother services
• Auto-restart crashed modules (max 3 restarts before disable)
• Health check: process alive, resource usage normal, connectivity up
• OOM priority: core=-500, passive=100, active=200 (active killed first)
• systemd Restart=on-failure integration

---

modules/stealth/anti_forensics.py — Anti-Forensics

• Timestomp all created files to match OS install date
• Secure deletion (shred) for removed files
• No core dumps (ulimit -c 0)
• No swap (or encrypted swap only)
• Clear filesystem journal entries related to implant

---

modules/stealth/traffic_mimicry.py — Traffic Mimicry

• Phase 1 (48h baseline): Capture normal traffic patterns — protocols, volumes, timing, destinations. Build statistical model.
• Phase 2 (behavioral blending): Shape implant traffic to match baseline. Exfil timed to match normal upload patterns. C2 beacon intervals matched to existing periodic traffic. DNS query rate matched to normal resolution rate.

---

modules/stealth/ja3_spoofer.py — JA3 Fingerprint Spoofing

• Modify TLS ClientHello to match known browser JA3 hashes
• Database of current Chrome, Firefox, Edge JA3 fingerprints
• Applied to all outbound HTTPS (C2, data transfer)
• Prevents JA3-based detection of non-browser TLS clients

---

modules/stealth/ids_tester.py — IDS Self-Testing

• Load Snort/Suricata rule snapshots from data/ids_rules/
• Before going active, check planned actions against known signatures
• Rate detection risk per proposed action
• Rule snapshots bundled at deploy time

---

modules/stealth/lkm_rootkit.py — LKM Rootkit (Optional)

• Loadable kernel module for compromised host deployment (not Pi)
• Hides: processes from /proc, files from readdir, network connections from /proc/net/tcp|udp, module from lsmod
• Compiled for target kernel (scripts/build_lkm.sh)
• Requires matching kernel headers
• Operator explicitly loads — never auto-loaded

---

modules/stealth/overlayfs_manager.py — overlayfs SD Card Protection

• Root filesystem as overlayfs (read-only base + tmpfs overlay)
• All writes go to RAM — SD card sees zero write activity
• Forensics: writes vanish on reboot (only LUKS container persists)
• Configured at boot via initramfs hook
• All hardware tiers (Pi Zero gets smaller overlay)

---

6. Pre-installed Tools

These are installed by setup.sh. The operator runs them directly via SSH. BigBrother does not wrap them in Python.

Tool	Purpose
nmap	Port scanning, service detection, NSE scripts
masscan	High-speed port scanning
Certipy	AD Certificate Services enumeration and attacks
Impacket	secretsdump, ntlmrelayx, smbexec, wmiexec, psexec, GetUserSPNs, GetNPUsers, smbclient, mssqlclient, dcomexec, atexec, getTGT, getST, etc.
BloodHound.py	AD data collection (Python ingestor)
Responder	LLMNR/NBT-NS/mDNS poisoning (also managed by BB for unattended mode)
CrackMapExec / NetExec	Network authentication testing, enumeration, command execution
Coercer	All coercion methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce)
PetitPotam.py	Standalone MS-EFSRPC coercion (backup for Coercer)
Chisel	TCP/UDP tunneling over HTTP, SOCKS proxy
Ligolo-ng	Tunneling/pivoting (agent on target, proxy on implant)
proxychains-ng	Proxy chain routing for tool traffic
socat	Multipurpose relay (TCP/UDP/Unix sockets)
sshuttle	Transparent SSH-based VPN/pivot
mitm6	IPv6 MITM with WPAD abuse
Bettercap	Network attack and monitoring (ARP, DNS, WiFi, BLE)
tcpdump	Packet capture CLI
tshark	Wireshark CLI — protocol analysis, PCAP processing
mitmproxy	HTTPS interception proxy (also managed by BB module)
iodine	DNS tunnel
autossh	Persistent SSH tunnels
aircrack-ng	WiFi capture and cracking suite
hashcat	Password/hash cracking (if GPU available on Debian host)
evil-winrm	WinRM shell with upload/download
enum4linux-ng	SMB/NetBIOS enumeration
kerbrute	Kerberos brute-force / user enumeration
pypykatz	Mimikatz in Python (LSASS, DPAPI, registry)
ldapdomaindump	Fast AD enumeration after first credential
smbmap	SMB share enumeration and access
ROADtools	Azure/Entra ID recon (Pi 4 and Debian host only)

---

7. Core Framework

bigbrother.py — Main CLI + Interactive Menu

Single entry point. Click CLI for scripting, Rich TUI for interactive operator use.

Click Commands:
    start       — Start passive surveillance (all passive modules)
    stop        — Stop all modules gracefully
    status      — Show module status, resource usage, connectivity
    activate    — Activate a specific active module
    deactivate  — Deactivate a specific active module
    kill        — Execute kill switch (manual wipe)
    creds       — Query credential database
    intel       — Generate intelligence report
    triage      — Delta view since last check-in (new creds, hosts, anomalies, errors)
    timeline    — Show per-user activity timeline
    topology    — Generate network topology map
    baseline    — Run 48h traffic baseline capture
    config      — View/edit current configuration
    selftest    — Run pre-flight self-test

Interactive Menu (Rich-based):
    [S] Status Dashboard    — Module status, resource gauges, connectivity
    [P] Passive Modules     — Start/stop/configure each
    [A] Active Modules      — Activate/configure/deactivate each
    [C] Credentials         — Browse/search/export captured creds
    [I] Intelligence        — Topology, traffic, timelines, reports
    [N] Network             — Interface status, bridge, connectivity
    [W] Wireless            — Probe reqs, BLE scan, WPA capture
    [K] Kill Switch         — Confirmation + wipe
    [Q] Quit

core/engine.py — Module Lifecycle Manager

• Multiprocess model: each module runs as a separate process — one crash does not kill capture or other modules
• Discover, load, start, stop, and monitor all modules via process supervision
• Dependency resolution: modules declare dependencies, engine starts in order
• Resource budgeting: check remaining RAM/CPU before starting module
• Hardware tier enforcement: Pi Zero 2W gets hard module limits (4 passive max)
• Interface conflict detection: prevents two modules from claiming the same interface in incompatible modes (e.g., monitor mode vs managed mode on wlan0)
• Graceful degradation: if module fails, others continue
• Optional scope enforcement: when config/scope.yaml is loaded, active modules validate targets against in-scope IP ranges/hostnames/domains before acting
• Engagement phase gating: Configurable engagement_phase — PASSIVE_ONLY for first N days (default: 7), then ACTIVE_ALLOWED. Active modules refuse to start during passive-only phase. New device + active attacks within hours is the highest-confidence SOC detection via temporal SIEM correlation.

core/capture_bus.py — Packet Capture Bus

Single privileged AF_PACKET socket captures all traffic, demultiplexes to per-module queues by protocol/port. Reduces kernel socket overhead from N modules to 1.

• One capture process with CAP_NET_RAW opens promiscuous socket on bridge/tap interface
• Modules subscribe to packet queues by BPF filter expression (e.g., "tcp port 389" for ldap_harvester)
• Packets dispatched to per-module multiprocessing queues via shared memory
• Module crash does not affect capture process or other modules
• Queue backpressure: if a module falls behind, oldest packets dropped from its queue (not others)
• Stats: per-module packet count, queue depth, drop count

core/bus.py — Internal Event Bus

Pub/sub between modules. Event types:

CREDENTIAL_FOUND    HOST_DISCOVERED     PCAP_ROTATED
MODULE_STARTED      MODULE_STOPPED      MODULE_ERROR
RESOURCE_WARNING    RESOURCE_CRITICAL   KILL_SWITCH
CONNECTIVITY_CHANGED  VLAN_DETECTED     HANDSHAKE_CAPTURED
TICKET_HARVESTED    CLOUD_TOKEN_FOUND   BEACON_DETECTED
CHANGE_DETECTED     THERMAL_WARNING     SCOPE_VIOLATION

core/state.py — Persistent State

Single SQLite database with schema-separated tables (not multiple DB files). WAL mode with dedicated async writer thread — all modules submit writes to a queue, writer batches with 500ms coalesce window. PRAGMA synchronous=NORMAL, busy_timeout=30s. WAL files on tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure for SD longevity). Stores module states, discovered hosts, running configuration. Survives reboots. Schema versioning via metadata table — compare on startup, run migration scripts if needed. Use ALTER TABLE ADD COLUMN for backwards-compatible changes to avoid mid-engagement data loss.

core/scheduler.py — Task Scheduler

Cron-like scheduler with jitter support. Used for: PCAP rotation, periodic health checks, baseline captures, data pruning.

core/resource_monitor.py — Resource Monitor

Tracks per-module RAM/CPU/disk. Enforces hardware tier limits. Kills lowest-priority module on OOM. Alerts on disk space threshold. Reads /sys/class/thermal/thermal_zone0/temp every 30s — publishes THERMAL_WARNING at 55C, sheds non-essential modules at 70C (Pi Zero throttles at 60C, Pi 4 at 80C).

core/kill_switch.py — Kill Switch

Manual wipe tool. Operator triggers via CLI command, remote SSH, BLE, or dead man's switch (configurable).

Wipe sequence:
    1. Stop all modules
    2. Destroy LUKS header (milliseconds — data instantly unrecoverable)
    3. Shred encryption keys
    4. Shred credential database
    5. dd zero-fill data partition (belt and suspenders)
    6. Clear RAM (smemcap or /proc/sys/vm/drop_caches)
    7. Reboot

If interrupted: boot flag triggers auto-complete on next boot.

---

8. Setup & Bootstrap

setup.sh — Idempotent Bootstrap

Detects platform (Pi Zero 2W / Pi 4 / generic Debian) and installs accordingly.

System packages:

python3 python3-venv python3-dev build-essential libssl-dev libffi-dev
libpcap-dev libnetfilter-queue-dev bridge-utils ebtables iptables nftables
iproute2 net-tools tcpdump tshark nmap masscan dnsutils hostapd dnsmasq
wireless-tools wpasupplicant aircrack-ng wireguard-tools cryptsetup
curl wget git jq tmux screen autossh bluez libbluetooth-dev
ppp usb-modeswitch ghostscript iodine bettercap

Python venv (.venv/):

click rich pyyaml cryptography scapy netfilterqueue impacket certipy-ad
bloodhound dnslib requests dpkt pyjwt python-magic numpy graphviz jinja2
mitmproxy (Pi 4+ only)

Tools from GitHub/pipx (to /opt/tools/):

Responder (git clone), CrackMapExec/NetExec (pipx), Chisel (binary),
Ligolo-ng (binary), mitm6 (pipx), evil-winrm, enum4linux-ng (pipx),
kerbrute (binary), Coercer (pipx), PetitPotam.py (git clone),
pypykatz (pipx), ldapdomaindump (pipx), smbmap (pipx),
ROADtools (pipx, Pi 4+ only)

Wordlists (to /opt/tools/wordlists/):

rockyou.txt.gz, SecLists top-1M passwords,
OneRuleToRuleThemAll.rule, dive.rule

System packages (additional):

proxychains-ng socat sshuttle stunnel4

Kernel config: IP forwarding (v4+v6), no send_redirects.

Pi optimizations: gpu_mem=16, disable bluetooth/avahi, no swap.

Setup reliability:

• Pre-bundle all tool binaries in a companion tarball with SHA256 checksums (masscan requires manual build on ARM)
• Pin all pip versions in requirements.txt
• Guard conditions for every non-idempotent operation (git clone errors if directory exists)
• --reinstall flag for force-refresh
• DHCP vendor class set to match cloned MAC's vendor (e.g., "MSFT 5.0") before first network contact
• Hostname set before first DHCP request

Directories: storage/{config,pcaps,creds,dns_logs,sni_logs,emails,files,voip,print_jobs,intel,baseline,audit,logs} with mode 700.

Systemd Services

All service descriptions use innocuous names.

Service File	Visible Description	Actual Function
bigbrother-core.service	System Thermal Management Daemon	Main daemon
bigbrother-watchdog.service	System Health Monitor	Watchdog
bigbrother-capture.service	Network Interface Statistics Collector	Packet capture
bigbrother-passive.service	Network Device Monitor	All passive surveillance
bigbrother-bridge.service	Network Bridge Service	Transparent bridge
bigbrother-tailscale.timer	VPN Health Check Timer	Tailscale health

Resource limits via systemd:

• Core: MemoryMax=400M, CPUQuota=70%
• Watchdog: MemoryMax=50M, CPUQuota=5%
• Capture: MemoryMax=100M, CPUQuota=20%
• Passive: MemoryMax=200M, CPUQuota=30%

---

9. Configuration

config/bigbrother.yaml — Master Config (Plaintext FS)

Contains ONLY non-sensitive defaults. All keys, auth tokens, and engagement-identifying data live in storage/config/ inside the LUKS container.

device:
  platform: "auto"              # auto | pi_zero | pi4 | generic
  hostname: "iot-sensor-03"
  install_path: "/opt/.cache/bb"

network:
  primary_interface: "auto"
  bridge:
    enabled: false
    internal: "eth0"
    external: "eth1"
  wifi:
    interface: "wlan0"
  cellular:
    enabled: false
    modem_device: "/dev/ttyUSB0"
    apn: "internet"

connectivity:
  primary: "tailscale"
  failover_chain:
    - tailscale
    - wireguard
    - reverse_tunnel
    - cellular_backup

security:
  encryption_key_derive: "argon2id"  # argon2id | pbkdf2 (Pi Zero)
  dead_man_switch:
    enabled: false
    interval_hours: 24
    action: "wipe"

capture:
  pcap_rotation_mb: 100
  pcap_rotation_hours: 1
  pcap_compression: "zstd"      # zstd max compression on rotation
  pcap_compression_level: 19    # 1-22, default 19 (max practical). Pi Zero: auto-downgrade to 3
  pcap_format: "pcapng"         # pcapng (preferred) or pcap
  snap_length: "auto"           # auto (by hardware tier) | 96 | 65535
  bpf_filter: "full_capture"    # full_capture | credentials | dns | custom
  custom_bpf: ""
  disk_max_pct: 85              # Purge oldest PCAPs above this (128GB+ gives headroom)

operating_hours:
  enabled: false
  timezone: "America/New_York"
  active_start: "08:00"
  active_end: "18:00"
  weekend_active: false

baseline:
  duration_hours: 48
  auto_start: true

engagement_phase:
  mode: "passive_only"          # passive_only | active_allowed
  passive_days: 7               # Days before active modules are permitted
  auto_transition: true         # Auto-transition to active_allowed after N days

storage/config/ — Sensitive Config (Inside LUKS)

Created at deployment, populated before first network connection. Destroyed with LUKS header.

# storage/config/engagement.yaml
engagement:
  name: "op-example"
  client: ""

# storage/config/connectivity.yaml
tailscale:
  auth_key: "tskey-..."
  hostname: "iot-sensor-03"
wireguard:
  private_key: ""
  peer_public_key: ""
  endpoint: ""
  allowed_ips: "10.100.0.0/24"
reverse_tunnel:
  server: ""
  port: 443
  key_path: ""
wifi:
  client_ssid: ""
  client_passphrase: ""
kill_passphrase_hash: ""

config/modules.yaml — Module Configuration

All passive modules default to enabled: true, autostart: true (except wireless_intel which requires a monitor mode adapter). All active modules default to enabled: false and require operator activation.

Key active module parameters:

active:
  arp_spoof:
    targets: []                 # Operator specifies target IPs
    gateway: "auto"
  dns_poison:
    domains: {}                 # domain: redirect_ip
    mode: "selective"           # selective | wildcard
  dhcp_spoof:
    pool_start: ""
    pool_end: ""
  evil_twin:
    ssid: ""
    channel: 6
    portal: "corporate_login"   # Template from templates/captive_portals/
  responder_mgr:
    protocols: {llmnr: true, nbtns: true, mdns: true}
  ssl_downgrade:
    explicit_enable: false      # Double opt-in required
  http_logger:
    log_bodies: true
    max_body_size_kb: 1024
  file_extractor:
    file_types: ["all"]         # all | document | executable | archive | image
  js_injector:
    payload: "keylogger"        # keylogger | beef | custom
    target_domains: []
  ntlm_relay:
    targets: []
    attack: "smb"               # smb | ldap | ldaps | http | adcs

config/scope.yaml — Optional Scope Enforcement

Not mandatory. When loaded, active modules validate targets before acting. Operator's choice to use it.

# scope.yaml — optional, loaded via `bigbrother.py config --scope scope.yaml`
enabled: false
networks:
  - 10.10.0.0/16
  - 10.0.0.0/24
hosts:
  - dc01.corp.local
  - 10.10.1.50
domains:
  - corp.local
  - subsidiary.local
exclude:
  - 10.10.99.0/24              # OT segment — do not touch

When enabled: ARP spoof validates each target IP, DHCP spoof only responds to in-scope MACs, dns_poison only redirects in-scope domains. Passive modules are never scope-restricted — they observe everything.

---

10. Hardware Tiers

Minimum SD card: 128GB (high-endurance industrial). With zstd -19 compression (10-15x on PCAPs), 128GB provides ~1.2TB effective PCAP storage. Compressed PCAPs also transfer 10-15x faster when operator pulls data over C2 channel. SD card write endurance: use tmpfs for SQLite WAL files, buffer PCAP writes through tmpfs with async flush. Accept up to 30 minutes data loss on power failure for SD longevity.

Power requirements: Minimum 5V/3A dedicated supply. Pi Zero 2W + USB Ethernet + USB WiFi draws 1.9-4.7W. USB 2.0 hubs provide only 2.5W per port — underpowered deployments cause USB resets, disconnecting bridge ethernet mid-operation. Consider PoE splitter for power (blends with existing cable plant). selftest checks power source and warns if running from USB hub.

Pi hardware fingerprint: Even with MAC randomization, Pi is fingerprinted through DHCP Option 60 (vendor class "dhcpcd-..."), hostname patterns, TCP stack (nmap OS fingerprint), and TTL values. NAC platforms and Forescout specifically profile device types. setup.sh sets DHCP vendor class to match cloned MAC's vendor and tunes TCP stack parameters in anti_forensics to match target OS profile.

Physical detection: Extra ethernet cable/USB adapter in a cable run, continuous power draw, thermal signature in confined spaces, LED activity — all detectable by facilities staff. Disable all LEDs. Use purpose-built enclosure matching physical environment. MAC spoofing must happen in pre-init before first frame.

Capability	Pi Zero 2W (512MB)	Pi 4 (4GB)	Debian Host
Max passive modules	4	All 22	All 22
Max active modules	1	6	Unlimited
Snap length	96 bytes	65535	65535
Flow table max	5,000	50,000	100,000
PCAP compression	zstd -3 (fast)	zstd -19 (max)	zstd -19 (max)
Key derivation	pbkdf2	argon2id	argon2id
mitmproxy	No	Yes	Yes
file_extractor	No	Yes	Yes
voip audio capture	No (metadata only)	Yes	Yes
LKM rootkit	No	No	Yes
Cellular modem	No (power)	Yes	Yes
BLE	Yes	Yes	Adapter needed
overlayfs	Yes (30MB)	Yes (200MB)	N/A
ROADtools	No	Yes	Yes

Pi Zero 2W Memory Budget (Passive Mode)

Python 3 + scapy + impacket + cryptography runs 60-80MB for the interpreter, not 25MB. Budget corrected accordingly. Only 4 passive modules on Pi Zero.

Component	RAM (MB)
OS + kernel	~110
Python interpreter + libs	~70
Core framework + capture_bus	~20
packet_capture (96B snap)	~30
dns_logger	~15
credential_sniffer	~20
host_discovery	~15
stealth modules	~20
encrypted_storage	~10
overlayfs overhead	~30
connectivity	~25
TOTAL	~365
Headroom	~35

Active module on Pi Zero takes from headroom. Only one active module at a time. Modules like tls_sni_extractor, os_fingerprint, traffic_analyzer, and the new passive modules (ldap_harvester, rdp_monitor, quic_analyzer, db_interceptor) require Pi 4 or Debian host.

---

11. Implementation Phases

Phase 1: Foundation + Stealth (Weeks 1-2)

Core infrastructure, multiprocess module lifecycle, capture bus, stealth layer. OPSEC before any network activity.

Files:
- bigbrother.py (CLI skeleton, Click groups, basic menu, triage command)
- core/ (engine, capture_bus, bus, state, scheduler, resource_monitor, kill_switch)
- modules/base.py
- modules/stealth/ (all 12 modules)
- utils/ (all 7 utility modules)
- config/ (bigbrother.yaml, modules.yaml, stealth.yaml, hardware_tiers.yaml, scope.yaml)
- services/ (all systemd units)
- setup.sh (core packages, tool installation incl. Coercer, proxychains-ng, wordlists, stunnel4)
- data/dhcp_fingerprints.db, data/wordlists/
- tests/ (engine, bus, crypto, resource)

Validation: Module lifecycle works (multiprocess). Capture bus demuxes packets.
Encrypted storage with LUKS network-derived unlock. Sensitive config inside LUKS.
Process disguised. Kill switch wipes all data. Watchdog restarts crashed module.
Overlayfs on Pi. Hardware tier detection accurate. Thermal monitoring active.
SQLite single-DB with async writer. Interface conflict detection works.

Phase 2: Passive Surveillance (Weeks 3-5)

All 22 passive modules. Zero network noise. 24/7 unsupervised collection.

Files:
- modules/passive/ (all 22 modules incl. ldap_harvester, rdp_monitor,
  quic_analyzer, db_interceptor)
- modules/intel/ (credential_db, topology_mapper, user_timeline,
  change_detector, security_posture, operator_audit)
- data/ (oui.db, os_sigs.db, dhcp_fingerprints.db, bpf_filters/)

Validation: All hosts discovered (with DHCP fingerprinting). Credentials
captured from test services. DNS queries logged per host (DoH hosts flagged).
TLS SNI extracted (TCP + QUIC). LDAP queries parsed, AD objects inventoried.
RDP sessions tracked. Database queries intercepted. Kerberos tickets harvested.
Email captured from cleartext SMTP. SMB file access logged. VoIP metadata
captured. Print jobs intercepted. Network map generated. Change detection
operational. Security posture mapped. Operator audit trail logging.
Zero IDS alerts.

Phase 3: Connectivity + Baseline (Weeks 6-7)

All connectivity modules including data exfil pipeline. Bridge hardening (STP/CDP suppression, watchdog failsafe). Traffic baseline capture. Reliable operator access.

Files:
- modules/connectivity/ (all 8 modules incl. data_exfil)
- modules/stealth/traffic_mimicry.py (baseline capture phase)
- scripts/setup_bridge.sh, teardown_bridge.sh

Validation: Failover chain works: Tailscale > WireGuard > SSH > Cellular.
Bridge transparent with STP/BPDU/CDP/LLDP suppression. C watchdog failsafe
triggers passthrough in <15s. WiFi client connected. 48h baseline captured.
BLE emergency access functional. Data exfil pipeline pushes creds on capture,
nightly intel sync. Engagement phase gating enforced.

Phase 4: Active Surveillance (Weeks 8-9)

All 14 active modules. MITM capabilities. Credential harvesting at scale. Scope enforcement integration.

Files:
- modules/active/ (all 14 modules)
- modules/intel/ (report_generator, net_intel, supply_chain_detect)
- templates/ (captive_portals, dns_zones, hostapd, responder, beef)

Validation: ARP spoof + HTTP logging chain works (scope-validated when enabled).
DNS poisoning redirects. DHCP spoof respects scope. Evil twin captures credentials.
Responder captures NTLMv2 hashes. ntlmrelayx relays to ADCS (Coercer integration
tested). mitmproxy decrypts HTTPS. File extraction from traffic. JS injection
into HTTP. Session tokens captured. DoH blocking forces plaintext DNS when in MITM.

Phase 5: Polish + Hardening (Weeks 10-12)

Integration testing, Pi Zero optimization (4-module limit), soak testing, TUI polish.

Tasks:
- Full integration test on Pi Zero 2W (4 passive modules), Pi 4 (all 22), Debian
- 72-hour soak test (memory leaks, disk usage, thermal, stability)
- Pi Zero performance optimization pass (verify 365MB budget, thermal under 55C)
- Capture bus stress test (packet throughput, queue backpressure)
- SQLite contention test (22 modules writing concurrently)
- LUKS network-derived unlock test (C2 reachable and unreachable scenarios)
- Rich TUI interactive menu polish (triage command)
- setup.sh validation on clean OS images (all tools install, wordlists present, stunnel4 available)
- setup.sh idempotency test (run twice, no errors)
- USB power budget verification per tier
- Schema migration test (upgrade mid-engagement without data loss)
- Crypto implementation review
- LKM rootkit compile and test on target kernels
- IDS tester validation against current rulesets
- zstd PCAP compression verification on 128GB storage
- Error handling audit

---

12. OPSEC Notes

Pre-Deployment

1. Sanitize hardware — Remove all identifying labels. Generic enclosure.
2. MAC address — Change from Pi OUI to common vendor (Dell, HP, Intel) BEFORE connecting.
3. Hostname — Generic IoT name. Never "kali", "attack", "pentest".
4. SSH keys — Fresh per engagement. Neutral key comment.
5. Tailscale — Per-engagement auth key. Hostname matches device disguise.
6. SD card — 128GB minimum, high-endurance industrial card. Enable overlayfs.
7. Pre-bundle everything — All tools, databases, signatures installed before deployment. Zero package installs on target network.
8. Test kill switch — Verify wipe works before deploying in the field.

During Operation

9. Passive-only phase — Enforce 1-2 week passive-only phase minimum. New device + active attacks within hours is the highest-confidence SIEM correlation for implant detection. Let the device age into the network baseline.
10. Working hours — Active modules during business hours only. After-hours activity is anomalous.
11. Traffic blending — Use traffic_mimicry to shape implant traffic to baseline.
12. JA3 — All outbound HTTPS uses ja3_spoofer.
13. Rate limiting — All active modules use jitter. No fixed intervals.
14. Selective targeting — ARP spoof specific hosts, not entire subnets.
15. IDS self-test — Run ids_tester before new active module activation.
16. C2 rotation — Use failover chain. Rotate primary channel periodically.

Host Forensics

17. Process names — All processes match legitimate system services.
18. File paths — Installed in /opt/.cache/bb/ — looks like system cache.
19. Log suppression — rsyslog filters, auditd exclusions, no bash history.
20. Encrypted storage — LUKS for all sensitive data. Physical seizure without key = nothing.
21. tmpfs — Active operations in RAM. Power loss = instant destruction.
22. overlayfs — SD card sees zero write activity except LUKS container.
23. Timestamps — All created files timestomped to match OS install date.

Kill Switch

24. Manual only — Operator's decision to wipe.
25. CLI command — bigbrother.py kill with passphrase confirmation.
26. Remote — Via SSH over any connectivity channel.
27. BLE — Emergency kill via Bluetooth if physically near.
28. Dead man's switch — Optional: operator configures interval, auto-wipes if no check-in.
29. Speed — LUKS header destruction in milliseconds. Data instantly unrecoverable.
30. Resilient — If interrupted, boot flag auto-completes wipe on next boot.

Network Footprint

31. Bridge mode — No IP, no MAC on network. Physical inspection only detection.
32. Tailscale — Looks like HTTPS to Derp servers. But Tailscale destinations are publicly documented — check during baseline whether target network already has Tailscale traffic before using.
33. WireGuard — Encrypted UDP on single port to self-hosted endpoint. Preferred when Tailscale would be a new destination.
34. Reverse SSH — Must be SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl). Never raw SSH on 443 — DPI detects SSH banner (content:"SSH-"; port 443).
35. Cellular — Completely out-of-band. Bypasses target network entirely.
36. DNS tunneling — Low rate, randomized, multiple domains.
37. Data exfil — Automated credential push, nightly intel sync. Timed to match baseline upload patterns via traffic_mimicry.