n0mad1k
ab27aa968b
Phase 2 batch 2: protocol-specific passive modules for deep network visibility. Each module subscribes to capture_bus, parses protocol structures with struct (no scapy), buffers SQLite writes, and publishes bus events for cross-module correlation. - vlan_discovery: 802.1Q/DTP/CDP/LLDP/STP/EAPOL layer-2 parsing - network_mapper: communication graph with role classification and DOT output - auth_flow_tracker: Kerberos/NTLM/SSH/LDAP auth correlation per user - smb_monitor: SMB2/3 tree connect, file access, GPP/SYSVOL detection - cloud_token_harvester: regex scan cleartext HTTP for AWS/JWT/OAuth/SAML/GCP tokens - ldap_harvester: BER/ASN.1 LDAP parsing for AD object inventory and LAPS detection - rdp_monitor: RDP cookie + CredSSP NTLM extraction, admin workstation detection - quic_analyzer: QUIC Initial packet parsing with RFC 9001 key derivation for SNI - db_interceptor: MSSQL TDS, MySQL, PostgreSQL, Redis RESP, MongoDB OP_MSG parsing
40 lines
1.4 KiB
Python
40 lines
1.4 KiB
Python
"""BigBrother passive modules — zero-noise network observation."""
|
|
|
|
from modules.passive.packet_capture import PacketCapture
|
|
from modules.passive.dns_logger import DNSLogger
|
|
from modules.passive.tls_sni_extractor import TLSSNIExtractor
|
|
from modules.passive.credential_sniffer import CredentialSniffer
|
|
from modules.passive.kerberos_harvester import KerberosHarvester
|
|
from modules.passive.host_discovery import HostDiscovery
|
|
from modules.passive.os_fingerprint import OSFingerprint
|
|
from modules.passive.traffic_analyzer import TrafficAnalyzer
|
|
from modules.passive.vlan_discovery import VLANDiscovery
|
|
from modules.passive.network_mapper import NetworkMapper
|
|
from modules.passive.auth_flow_tracker import AuthFlowTracker
|
|
from modules.passive.smb_monitor import SMBMonitor
|
|
from modules.passive.cloud_token_harvester import CloudTokenHarvester
|
|
from modules.passive.ldap_harvester import LDAPHarvester
|
|
from modules.passive.rdp_monitor import RDPMonitor
|
|
from modules.passive.quic_analyzer import QUICAnalyzer
|
|
from modules.passive.db_interceptor import DBInterceptor
|
|
|
|
__all__ = [
|
|
"PacketCapture",
|
|
"DNSLogger",
|
|
"TLSSNIExtractor",
|
|
"CredentialSniffer",
|
|
"KerberosHarvester",
|
|
"HostDiscovery",
|
|
"OSFingerprint",
|
|
"TrafficAnalyzer",
|
|
"VLANDiscovery",
|
|
"NetworkMapper",
|
|
"AuthFlowTracker",
|
|
"SMBMonitor",
|
|
"CloudTokenHarvester",
|
|
"LDAPHarvester",
|
|
"RDPMonitor",
|
|
"QUICAnalyzer",
|
|
"DBInterceptor",
|
|
]
|