Cobra d4f95a550c Add BLE GATT Device Name probing and WiFi+BLE arrival correlation ...

ble_alerter.py: probe Apple BLE devices via GATT characteristic 0x2A00
to discover device names (iPhone, Apple TV, etc). Names persist to
ble_names.json with last_seen timestamps. GATT_PROBE=1 enables active
probing; without it, Apple device last_seen timestamps still tracked.

net_alerter.py: on WiFi device arrival, read ble_names.json and log
any Apple BLE devices seen within the last 60s as correlation candidates.
Gives operator visibility into which BLE MACs co-arrived with a WiFi device.

Shared state file: /opt/net_alerter/ble_names.json

2026-04-15 00:03:35 -04:00

config

Strip OPSEC tool identity fingerprints

2026-04-08 22:18:35 -04:00

core

Strip OPSEC tool identity fingerprints

2026-04-08 22:18:35 -04:00

data

Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api

2026-03-18 08:11:25 -04:00

modules

Strip OPSEC tool identity fingerprints

2026-04-08 22:18:35 -04:00

net_alerter

Add BLE GATT Device Name probing and WiFi+BLE arrival correlation

2026-04-15 00:03:35 -04:00

presence

Add bounds checks to netlink and DHCP parsers — prevent exception flood on malformed packets

2026-04-10 15:49:03 -04:00

scripts

Support wpa_supplicant config format on OPi/Armbian targets

2026-04-14 13:14:35 -04:00

services

Fix firstboot service startup: GOPATH env, enable all services, add bettercap passive caplet

2026-04-08 10:51:09 -04:00

storage

Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api

2026-03-18 08:11:25 -04:00

templates

Phase 4: Active modules, templates, and operator scripts

2026-03-18 13:48:11 -04:00

tests

Deploy presence daemon to OPi Zero 3 test implant

2026-04-10 15:49:03 -04:00

utils

Strip OPSEC tool identity fingerprints

2026-04-08 22:18:35 -04:00

.devtrack_context

Add audit artifacts from #671 review pipeline

2026-04-14 13:18:35 -04:00

.gitignore

Encrypt sensitive credential fields before event bus emission (#215)

2026-04-06 11:43:46 -04:00

bigbrother.py

Strip OPSEC tool identity fingerprints

2026-04-08 22:18:35 -04:00

IMPLEMENTATION_PLAN.md

Document comprehensive fix plan for daemon initialization failures

2026-04-06 09:15:40 -04:00

OPERATIONAL_WORKFLOW.md

Update hardware platform to Orange Pi Zero 3 (4GB) as primary implant

2026-03-18 08:04:24 -04:00

operator_setup.sh

Add three dynamic infrastructure auto-suppression mechanisms to net_alerter

2026-04-10 22:57:40 -04:00

requirements.txt

Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api

2026-03-18 08:11:25 -04:00

SECURITY_REVIEW.md

Apply QA corrections to consolidated security review: deconflict APT-001 triage, add deduplication transparency, document exploit chain dependencies

2026-04-10 15:49:03 -04:00

setup.sh

Add NET_ALERTER_INFRA_IPS config to setup.sh .env template and operator_setup.sh prompt

2026-04-10 22:50:56 -04:00

S

Description

Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.

4.3 MiB

Languages

Python 89.2%

Shell 8.5%

HTML 1.1%

C 0.9%

Jinja 0.3%