n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
180 Commits 1 Branch 0 Tags
51fff82867643b21d97847b3233d9d68de0fcd06
T
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE
Cobra 51fff82867 Ignore ARP replies in last_seen updates to block AP proxy spoofing 
AP ARP proxy sends REPLY frames with the disconnected client's MAC as
the Ethernet source. Treating those as genuine device signals kept
last_seen fresh, preventing the watchdog from detecting departure.

Only ARP REQUEST (opcode 1) frames originate from the device itself.
Skip _update_last_seen() for opcode 2 (REPLY) frames.
2026-04-14 15:57:56 -04:00
config
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
core
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
data
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
2026-03-18 08:11:25 -04:00
modules
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
net_alerter
Ignore ARP replies in last_seen updates to block AP proxy spoofing
2026-04-14 15:57:56 -04:00
presence
Add bounds checks to netlink and DHCP parsers — prevent exception flood on malformed packets
2026-04-10 15:49:03 -04:00
scripts
Support wpa_supplicant config format on OPi/Armbian targets
2026-04-14 13:14:35 -04:00
services
Fix firstboot service startup: GOPATH env, enable all services, add bettercap passive caplet
2026-04-08 10:51:09 -04:00
storage
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
2026-03-18 08:11:25 -04:00
templates
Phase 4: Active modules, templates, and operator scripts
2026-03-18 13:48:11 -04:00
tests
Deploy presence daemon to OPi Zero 3 test implant
2026-04-10 15:49:03 -04:00
utils
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
.devtrack_context
Add audit artifacts from #671 review pipeline
2026-04-14 13:18:35 -04:00
.gitignore
Encrypt sensitive credential fields before event bus emission (#215)
2026-04-06 11:43:46 -04:00
bigbrother.py
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
IMPLEMENTATION_PLAN.md
Document comprehensive fix plan for daemon initialization failures
2026-04-06 09:15:40 -04:00
OPERATIONAL_WORKFLOW.md
Update hardware platform to Orange Pi Zero 3 (4GB) as primary implant
2026-03-18 08:04:24 -04:00
operator_setup.sh
Add three dynamic infrastructure auto-suppression mechanisms to net_alerter
2026-04-10 22:57:40 -04:00
requirements.txt
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
2026-03-18 08:11:25 -04:00
SECURITY_REVIEW.md
Apply QA corrections to consolidated security review: deconflict APT-001 triage, add deduplication transparency, document exploit chain dependencies
2026-04-10 15:49:03 -04:00
setup.sh
Add NET_ALERTER_INFRA_IPS config to setup.sh .env template and operator_setup.sh prompt
2026-04-10 22:50:56 -04:00
S
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
4.3 MiB
Languages
Python 89.2%
Shell 8.5%
HTML 1.1%
C 0.9%
Jinja 0.3%