#!/usr/bin/env python3
"""
Pager Decoder - POCSAG/FLEX decoder using RTL-SDR and multimon-ng
"""
import subprocess
import shutil
import re
import threading
import queue
import pty
import os
import select
import json
from flask import Flask, render_template_string, jsonify, request, Response, send_file
app = Flask(__name__)
def load_oui_database():
"""Load OUI database from external JSON file, with fallback to built-in."""
oui_file = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'oui_database.json')
try:
if os.path.exists(oui_file):
with open(oui_file, 'r') as f:
data = json.load(f)
# Remove comment fields
return {k: v for k, v in data.items() if not k.startswith('_')}
except Exception as e:
print(f"[OUI] Error loading oui_database.json: {e}, using built-in database")
return None # Will fall back to built-in
# Global process management
current_process = None
sensor_process = None
wifi_process = None
kismet_process = None
bt_process = None
output_queue = queue.Queue()
sensor_queue = queue.Queue()
wifi_queue = queue.Queue()
bt_queue = queue.Queue()
process_lock = threading.Lock()
sensor_lock = threading.Lock()
wifi_lock = threading.Lock()
bt_lock = threading.Lock()
# Logging settings
logging_enabled = False
log_file_path = 'pager_messages.log'
# WiFi state
wifi_monitor_interface = None
wifi_networks = {} # BSSID -> network info
wifi_clients = {} # Client MAC -> client info
wifi_handshakes = [] # Captured handshakes
# Bluetooth state
bt_interface = None
bt_devices = {} # MAC -> device info
bt_beacons = {} # MAC -> beacon info (AirTags, Tiles, iBeacons)
bt_services = {} # MAC -> list of services
# Known beacon prefixes for detection
AIRTAG_PREFIXES = ['4C:00'] # Apple continuity
TILE_PREFIXES = ['C4:E7', 'DC:54', 'E4:B0', 'F8:8A']
SAMSUNG_TRACKER = ['58:4D', 'A0:75']
# OUI Database for manufacturer lookup (expanded)
OUI_DATABASE = {
# Apple (extensive list)
'00:25:DB': 'Apple', '04:52:F3': 'Apple', '0C:3E:9F': 'Apple', '10:94:BB': 'Apple',
'14:99:E2': 'Apple', '20:78:F0': 'Apple', '28:6A:BA': 'Apple', '3C:22:FB': 'Apple',
'40:98:AD': 'Apple', '48:D7:05': 'Apple', '4C:57:CA': 'Apple', '54:4E:90': 'Apple',
'5C:97:F3': 'Apple', '60:F8:1D': 'Apple', '68:DB:CA': 'Apple', '70:56:81': 'Apple',
'78:7B:8A': 'Apple', '7C:D1:C3': 'Apple', '84:FC:FE': 'Apple', '8C:2D:AA': 'Apple',
'90:B0:ED': 'Apple', '98:01:A7': 'Apple', '98:D6:BB': 'Apple', 'A4:D1:D2': 'Apple',
'AC:BC:32': 'Apple', 'B0:34:95': 'Apple', 'B8:C1:11': 'Apple', 'C8:69:CD': 'Apple',
'D0:03:4B': 'Apple', 'DC:A9:04': 'Apple', 'E0:C7:67': 'Apple', 'F0:18:98': 'Apple',
'F4:5C:89': 'Apple', '78:4F:43': 'Apple', '00:CD:FE': 'Apple', '04:4B:ED': 'Apple',
'04:D3:CF': 'Apple', '08:66:98': 'Apple', '0C:74:C2': 'Apple', '10:DD:B1': 'Apple',
'14:10:9F': 'Apple', '18:EE:69': 'Apple', '1C:36:BB': 'Apple', '24:A0:74': 'Apple',
'28:37:37': 'Apple', '2C:BE:08': 'Apple', '34:08:BC': 'Apple', '38:C9:86': 'Apple',
'3C:06:30': 'Apple', '44:D8:84': 'Apple', '48:A9:1C': 'Apple', '4C:32:75': 'Apple',
'50:32:37': 'Apple', '54:26:96': 'Apple', '58:B0:35': 'Apple', '5C:F7:E6': 'Apple',
'64:A3:CB': 'Apple', '68:FE:F7': 'Apple', '6C:4D:73': 'Apple', '70:DE:E2': 'Apple',
'74:E2:F5': 'Apple', '78:67:D7': 'Apple', '7C:04:D0': 'Apple', '80:E6:50': 'Apple',
'84:78:8B': 'Apple', '88:66:A5': 'Apple', '8C:85:90': 'Apple', '94:E9:6A': 'Apple',
'9C:F4:8E': 'Apple', 'A0:99:9B': 'Apple', 'A4:83:E7': 'Apple', 'A8:5C:2C': 'Apple',
'AC:1F:74': 'Apple', 'B0:19:C6': 'Apple', 'B4:F1:DA': 'Apple', 'BC:52:B7': 'Apple',
'C0:A5:3E': 'Apple', 'C4:B3:01': 'Apple', 'CC:20:E8': 'Apple', 'D0:C5:F3': 'Apple',
'D4:61:9D': 'Apple', 'D8:1C:79': 'Apple', 'E0:5F:45': 'Apple', 'E4:C6:3D': 'Apple',
'F0:B4:79': 'Apple', 'F4:0F:24': 'Apple', 'F8:4D:89': 'Apple', 'FC:D8:48': 'Apple',
# Samsung
'00:1B:66': 'Samsung', '00:21:19': 'Samsung', '00:26:37': 'Samsung', '5C:0A:5B': 'Samsung',
'8C:71:F8': 'Samsung', 'C4:73:1E': 'Samsung', '38:2C:4A': 'Samsung', '00:1E:4C': 'Samsung',
'00:12:47': 'Samsung', '00:15:99': 'Samsung', '00:17:D5': 'Samsung', '00:1D:F6': 'Samsung',
'00:21:D1': 'Samsung', '00:24:54': 'Samsung', '00:26:5D': 'Samsung', '08:D4:2B': 'Samsung',
'10:D5:42': 'Samsung', '14:49:E0': 'Samsung', '18:3A:2D': 'Samsung', '1C:66:AA': 'Samsung',
'24:4B:81': 'Samsung', '28:98:7B': 'Samsung', '2C:AE:2B': 'Samsung', '30:96:FB': 'Samsung',
'34:C3:AC': 'Samsung', '38:01:95': 'Samsung', '3C:5A:37': 'Samsung', '40:0E:85': 'Samsung',
'44:4E:1A': 'Samsung', '4C:BC:A5': 'Samsung', '50:01:BB': 'Samsung', '50:A4:D0': 'Samsung',
'54:88:0E': 'Samsung', '58:C3:8B': 'Samsung', '5C:2E:59': 'Samsung', '60:D0:A9': 'Samsung',
'64:B3:10': 'Samsung', '68:48:98': 'Samsung', '6C:2F:2C': 'Samsung', '70:F9:27': 'Samsung',
'74:45:8A': 'Samsung', '78:47:1D': 'Samsung', '7C:0B:C6': 'Samsung', '84:11:9E': 'Samsung',
'88:32:9B': 'Samsung', '8C:77:12': 'Samsung', '90:18:7C': 'Samsung', '94:35:0A': 'Samsung',
'98:52:B1': 'Samsung', '9C:02:98': 'Samsung', 'A0:0B:BA': 'Samsung', 'A4:7B:85': 'Samsung',
'A8:06:00': 'Samsung', 'AC:5F:3E': 'Samsung', 'B0:72:BF': 'Samsung', 'B4:79:A7': 'Samsung',
'BC:44:86': 'Samsung', 'C0:97:27': 'Samsung', 'C4:42:02': 'Samsung', 'CC:07:AB': 'Samsung',
'D0:22:BE': 'Samsung', 'D4:87:D8': 'Samsung', 'D8:90:E8': 'Samsung', 'E4:7C:F9': 'Samsung',
'E8:50:8B': 'Samsung', 'F0:25:B7': 'Samsung', 'F4:7B:5E': 'Samsung', 'FC:A1:3E': 'Samsung',
# Google
'54:60:09': 'Google', '00:1A:11': 'Google', 'F4:F5:D8': 'Google', '94:EB:2C': 'Google',
'64:B5:C6': 'Google', '3C:5A:B4': 'Google', 'F8:8F:CA': 'Google', '20:DF:B9': 'Google',
'54:27:1E': 'Google', '58:CB:52': 'Google', 'A4:77:33': 'Google', 'F4:0E:22': 'Google',
# Sony
'00:13:A9': 'Sony', '00:1D:28': 'Sony', '00:24:BE': 'Sony', '04:5D:4B': 'Sony',
'08:A9:5A': 'Sony', '10:4F:A8': 'Sony', '24:21:AB': 'Sony', '30:52:CB': 'Sony',
'40:B8:37': 'Sony', '58:48:22': 'Sony', '70:9E:29': 'Sony', '84:00:D2': 'Sony',
'AC:9B:0A': 'Sony', 'B4:52:7D': 'Sony', 'BC:60:A7': 'Sony', 'FC:0F:E6': 'Sony',
# Bose
'00:0C:8A': 'Bose', '04:52:C7': 'Bose', '08:DF:1F': 'Bose', '2C:41:A1': 'Bose',
'4C:87:5D': 'Bose', '60:AB:D2': 'Bose', '88:C9:E8': 'Bose', 'D8:9C:67': 'Bose',
# JBL/Harman
'00:1D:DF': 'JBL', '08:AE:D6': 'JBL', '20:3C:AE': 'JBL', '44:5E:F3': 'JBL',
'50:C9:71': 'JBL', '74:5E:1C': 'JBL', '88:C6:26': 'JBL', 'AC:12:2F': 'JBL',
# Beats (Apple subsidiary)
'00:61:71': 'Beats', '48:D6:D5': 'Beats', '9C:64:8B': 'Beats', 'A4:E9:75': 'Beats',
# Jabra/GN Audio
'00:13:17': 'Jabra', '1C:48:F9': 'Jabra', '50:C2:ED': 'Jabra', '70:BF:92': 'Jabra',
'74:5C:4B': 'Jabra', '94:16:25': 'Jabra', 'D0:81:7A': 'Jabra', 'E8:EE:CC': 'Jabra',
# Sennheiser
'00:1B:66': 'Sennheiser', '00:22:27': 'Sennheiser', 'B8:AD:3E': 'Sennheiser',
# Xiaomi
'04:CF:8C': 'Xiaomi', '0C:1D:AF': 'Xiaomi', '10:2A:B3': 'Xiaomi', '18:59:36': 'Xiaomi',
'20:47:DA': 'Xiaomi', '28:6C:07': 'Xiaomi', '34:CE:00': 'Xiaomi', '38:A4:ED': 'Xiaomi',
'44:23:7C': 'Xiaomi', '50:64:2B': 'Xiaomi', '58:44:98': 'Xiaomi', '64:09:80': 'Xiaomi',
'74:23:44': 'Xiaomi', '78:02:F8': 'Xiaomi', '7C:1C:4E': 'Xiaomi', '84:F3:EB': 'Xiaomi',
'8C:BE:BE': 'Xiaomi', '98:FA:E3': 'Xiaomi', 'A4:77:58': 'Xiaomi', 'AC:C1:EE': 'Xiaomi',
'B0:E2:35': 'Xiaomi', 'C4:0B:CB': 'Xiaomi', 'C8:47:8C': 'Xiaomi', 'D4:97:0B': 'Xiaomi',
'E4:46:DA': 'Xiaomi', 'F0:B4:29': 'Xiaomi', 'FC:64:BA': 'Xiaomi',
# Huawei
'00:18:82': 'Huawei', '00:1E:10': 'Huawei', '00:25:68': 'Huawei', '04:B0:E7': 'Huawei',
'08:63:61': 'Huawei', '10:1B:54': 'Huawei', '18:DE:D7': 'Huawei', '20:A6:80': 'Huawei',
'28:31:52': 'Huawei', '34:12:98': 'Huawei', '3C:47:11': 'Huawei', '48:00:31': 'Huawei',
'4C:50:77': 'Huawei', '5C:7D:5E': 'Huawei', '60:DE:44': 'Huawei', '70:72:3C': 'Huawei',
'78:F5:57': 'Huawei', '80:B6:86': 'Huawei', '88:53:D4': 'Huawei', '94:04:9C': 'Huawei',
'A4:99:47': 'Huawei', 'B4:15:13': 'Huawei', 'BC:76:70': 'Huawei', 'C8:D1:5E': 'Huawei',
'DC:D2:FC': 'Huawei', 'E4:68:A3': 'Huawei', 'F4:63:1F': 'Huawei',
# OnePlus/BBK
'64:A2:F9': 'OnePlus', 'C0:EE:FB': 'OnePlus', '94:65:2D': 'OnePlus',
# Fitbit
'2C:09:4D': 'Fitbit', 'C4:D9:87': 'Fitbit', 'E4:88:6D': 'Fitbit',
# Garmin
'00:1C:D1': 'Garmin', 'C4:AC:59': 'Garmin', 'E8:0F:C8': 'Garmin',
# Microsoft
'00:50:F2': 'Microsoft', '28:18:78': 'Microsoft', '60:45:BD': 'Microsoft',
'7C:1E:52': 'Microsoft', '98:5F:D3': 'Microsoft', 'B4:0E:DE': 'Microsoft',
# Intel
'00:1B:21': 'Intel', '00:1C:C0': 'Intel', '00:1E:64': 'Intel', '00:21:5C': 'Intel',
'08:D4:0C': 'Intel', '18:1D:EA': 'Intel', '34:02:86': 'Intel', '40:74:E0': 'Intel',
'48:51:B7': 'Intel', '58:A0:23': 'Intel', '64:D4:DA': 'Intel', '80:19:34': 'Intel',
'8C:8D:28': 'Intel', 'A4:4E:31': 'Intel', 'B4:6B:FC': 'Intel', 'C8:D0:83': 'Intel',
# Qualcomm/Atheros
'00:03:7F': 'Qualcomm', '00:24:E4': 'Qualcomm', '04:F0:21': 'Qualcomm',
'1C:4B:D6': 'Qualcomm', '88:71:B1': 'Qualcomm', 'A0:65:18': 'Qualcomm',
# Broadcom
'00:10:18': 'Broadcom', '00:1A:2B': 'Broadcom', '20:10:7A': 'Broadcom',
# Realtek
'00:0A:EB': 'Realtek', '00:E0:4C': 'Realtek', '48:02:2A': 'Realtek',
'52:54:00': 'Realtek', '80:EA:96': 'Realtek',
# Logitech
'00:1F:20': 'Logitech', '34:88:5D': 'Logitech', '6C:B7:49': 'Logitech',
# Lenovo
'00:09:2D': 'Lenovo', '28:D2:44': 'Lenovo', '54:EE:75': 'Lenovo', '98:FA:9B': 'Lenovo',
# Dell
'00:14:22': 'Dell', '00:1A:A0': 'Dell', '18:DB:F2': 'Dell', '34:17:EB': 'Dell',
'78:2B:CB': 'Dell', 'A4:BA:DB': 'Dell', 'E4:B9:7A': 'Dell',
# HP
'00:0F:61': 'HP', '00:14:C2': 'HP', '10:1F:74': 'HP', '28:80:23': 'HP',
'38:63:BB': 'HP', '5C:B9:01': 'HP', '80:CE:62': 'HP', 'A0:D3:C1': 'HP',
# Tile
'F8:E4:E3': 'Tile', 'C4:E7:BE': 'Tile', 'DC:54:D7': 'Tile', 'E4:B0:21': 'Tile',
# Raspberry Pi
'B8:27:EB': 'Raspberry Pi', 'DC:A6:32': 'Raspberry Pi', 'E4:5F:01': 'Raspberry Pi',
# Amazon
'00:FC:8B': 'Amazon', '10:CE:A9': 'Amazon', '34:D2:70': 'Amazon', '40:B4:CD': 'Amazon',
'44:65:0D': 'Amazon', '68:54:FD': 'Amazon', '74:C2:46': 'Amazon', '84:D6:D0': 'Amazon',
'A0:02:DC': 'Amazon', 'AC:63:BE': 'Amazon', 'B4:7C:9C': 'Amazon', 'FC:65:DE': 'Amazon',
# Skullcandy
'00:01:00': 'Skullcandy', '88:E6:03': 'Skullcandy',
# Bang & Olufsen
'00:21:3E': 'Bang & Olufsen', '78:C5:E5': 'Bang & Olufsen',
# Audio-Technica
'A0:E9:DB': 'Audio-Technica', 'EC:81:93': 'Audio-Technica',
# Plantronics/Poly
'00:1D:DF': 'Plantronics', 'B0:B4:48': 'Plantronics', 'E8:FC:AF': 'Plantronics',
# Anker
'AC:89:95': 'Anker', 'E8:AB:FA': 'Anker',
# Misc/Generic
'00:00:0A': 'Omron', '00:1A:7D': 'Cyber-Blue', '00:1E:3D': 'Alps Electric',
'00:0B:57': 'Silicon Wave', '00:02:72': 'CC&C',
}
# Try to load from external file (easier to update)
_external_oui = load_oui_database()
if _external_oui:
OUI_DATABASE = _external_oui
print(f"[OUI] Loaded {len(OUI_DATABASE)} entries from oui_database.json")
else:
print(f"[OUI] Using built-in database with {len(OUI_DATABASE)} entries")
HTML_TEMPLATE = '''
INTERCEPT // Signal Intelligence
⚠️
DISCLAIMER
INTERCEPT is a signal intelligence tool designed for educational purposes only .
By using this software, you acknowledge and agree that:
This tool is intended for use by cyber security professionals and researchers only
You will only use this software in a controlled environment with proper authorization
Intercepting communications without consent may be illegal in your jurisdiction
You are solely responsible for ensuring compliance with all applicable laws and regulations
The developers assume no liability for misuse of this software
Only proceed if you understand and accept these terms.
I UNDERSTAND & ACCEPT
DECLINE
█████╗ ██████╗ ██████╗███████╗███████╗███████╗
██╔══██╗██╔════╝██╔════╝██╔════╝██╔════╝██╔════╝
███████║██║ ██║ █████╗ ███████╗███████╗
██╔══██║██║ ██║ ██╔══╝ ╚════██║╚════██║
██║ ██║╚██████╗╚██████╗███████╗███████║███████║
╚═╝ ╚═╝ ╚═════╝ ╚═════╝╚══════╝╚══════╝╚══════╝
██████╗ ███████╗███╗ ██╗██╗███████╗██████╗
██╔══██╗██╔════╝████╗ ██║██║██╔════╝██╔══██╗
██║ ██║█████╗ ██╔██╗ ██║██║█████╗ ██║ ██║
██║ ██║██╔══╝ ██║╚██╗██║██║██╔══╝ ██║ ██║
██████╔╝███████╗██║ ╚████║██║███████╗██████╔╝
╚═════╝ ╚══════╝╚═╝ ╚═══╝╚═╝╚══════╝╚═════╝
root@intercepted: ~# sudo access --grant-permission
[sudo] password for user: ********
Error: User is not in the sudoers file.
This incident will be reported.
"In a world of locked doors, the man with the key is king.
And you, my friend, just threw away the key."
TRY AGAIN
Channel Utilization (2.4 GHz)
Target Signal
No target selected
-- dBm
Bluetooth Proximity Radar
Device intelligence data will appear here as signals are intercepted.
Configure settings and click "Start Decoding" to begin.
RECON
🔊 MUTE
⬇ AUTO-SCROLL ON
📄 CSV
📋 JSON
🔍 INTEL
Clear
'''
def check_tool(name):
"""Check if a tool is installed."""
return shutil.which(name) is not None
def is_valid_mac(mac):
"""Validate MAC address format."""
import re
if not mac:
return False
return bool(re.match(r'^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$', mac))
def is_valid_channel(channel):
"""Validate WiFi channel number."""
try:
ch = int(channel)
return 1 <= ch <= 200
except (ValueError, TypeError):
return False
def detect_devices():
"""Detect RTL-SDR devices."""
devices = []
if not check_tool('rtl_test'):
return devices
try:
result = subprocess.run(
['rtl_test', '-t'],
capture_output=True,
text=True,
timeout=5
)
output = result.stderr + result.stdout
# Parse device info
device_pattern = r'(\d+):\s+(.+?)(?:,\s*SN:\s*(\S+))?$'
for line in output.split('\n'):
line = line.strip()
match = re.match(device_pattern, line)
if match:
devices.append({
'index': int(match.group(1)),
'name': match.group(2).strip().rstrip(','),
'serial': match.group(3) or 'N/A'
})
if not devices:
found_match = re.search(r'Found (\d+) device', output)
if found_match:
count = int(found_match.group(1))
for i in range(count):
devices.append({
'index': i,
'name': f'RTL-SDR Device {i}',
'serial': 'Unknown'
})
except Exception:
pass
return devices
def parse_multimon_output(line):
"""Parse multimon-ng output line."""
# POCSAG formats:
# POCSAG512: Address: 1234567 Function: 0 Alpha: Message here
# POCSAG1200: Address: 1234567 Function: 0 Numeric: 123-456-7890
# POCSAG2400: Address: 1234567 Function: 0 (no message)
# FLEX formats:
# FLEX: NNNN-NN-NN NN:NN:NN NNNN/NN/C NN.NNN [NNNNNNN] ALN Message here
# FLEX|NNNN-NN-NN|NN:NN:NN|NNNN/NN/C|NN.NNN|NNNNNNN|ALN|Message
line = line.strip()
# POCSAG parsing - with message content
pocsag_match = re.match(
r'(POCSAG\d+):\s*Address:\s*(\d+)\s+Function:\s*(\d+)\s+(Alpha|Numeric):\s*(.*)',
line
)
if pocsag_match:
return {
'protocol': pocsag_match.group(1),
'address': pocsag_match.group(2),
'function': pocsag_match.group(3),
'msg_type': pocsag_match.group(4),
'message': pocsag_match.group(5).strip() or '[No Message]'
}
# POCSAG parsing - address only (no message content)
pocsag_addr_match = re.match(
r'(POCSAG\d+):\s*Address:\s*(\d+)\s+Function:\s*(\d+)\s*$',
line
)
if pocsag_addr_match:
return {
'protocol': pocsag_addr_match.group(1),
'address': pocsag_addr_match.group(2),
'function': pocsag_addr_match.group(3),
'msg_type': 'Tone',
'message': '[Tone Only]'
}
# FLEX parsing (standard format)
flex_match = re.match(
r'FLEX[:\|]\s*[\d\-]+[\s\|]+[\d:]+[\s\|]+([\d/A-Z]+)[\s\|]+([\d.]+)[\s\|]+\[?(\d+)\]?[\s\|]+(\w+)[\s\|]+(.*)',
line
)
if flex_match:
return {
'protocol': 'FLEX',
'address': flex_match.group(3),
'function': flex_match.group(1),
'msg_type': flex_match.group(4),
'message': flex_match.group(5).strip() or '[No Message]'
}
# Simple FLEX format
flex_simple = re.match(r'FLEX:\s*(.+)', line)
if flex_simple:
return {
'protocol': 'FLEX',
'address': 'Unknown',
'function': '',
'msg_type': 'Unknown',
'message': flex_simple.group(1).strip()
}
return None
def stream_decoder(master_fd, process):
"""Stream decoder output to queue using PTY for unbuffered output."""
global current_process
try:
output_queue.put({'type': 'status', 'text': 'started'})
buffer = ""
while True:
try:
ready, _, _ = select.select([master_fd], [], [], 1.0)
except Exception:
break
if ready:
try:
data = os.read(master_fd, 1024)
if not data:
break
buffer += data.decode('utf-8', errors='replace')
while '\n' in buffer:
line, buffer = buffer.split('\n', 1)
line = line.strip()
if not line:
continue
parsed = parse_multimon_output(line)
if parsed:
from datetime import datetime
parsed['timestamp'] = datetime.now().strftime('%H:%M:%S')
output_queue.put({'type': 'message', **parsed})
log_message(parsed)
else:
output_queue.put({'type': 'raw', 'text': line})
except OSError:
break
if process.poll() is not None:
break
except Exception as e:
output_queue.put({'type': 'error', 'text': str(e)})
finally:
try:
os.close(master_fd)
except:
pass
process.wait()
output_queue.put({'type': 'status', 'text': 'stopped'})
with process_lock:
current_process = None
@app.route('/')
def index():
tools = {
'rtl_fm': check_tool('rtl_fm'),
'multimon': check_tool('multimon-ng'),
'rtl_433': check_tool('rtl_433')
}
devices = detect_devices()
return render_template_string(HTML_TEMPLATE, tools=tools, devices=devices)
@app.route('/favicon.svg')
def favicon():
return send_file('favicon.svg', mimetype='image/svg+xml')
@app.route('/devices')
def get_devices():
return jsonify(detect_devices())
@app.route('/start', methods=['POST'])
def start_decoding():
global current_process
with process_lock:
if current_process:
return jsonify({'status': 'error', 'message': 'Already running'})
data = request.json
freq = data.get('frequency', '929.6125')
gain = data.get('gain', '0')
squelch = data.get('squelch', '0')
ppm = data.get('ppm', '0')
device = data.get('device', '0')
protocols = data.get('protocols', ['POCSAG512', 'POCSAG1200', 'POCSAG2400', 'FLEX'])
# Clear queue
while not output_queue.empty():
try:
output_queue.get_nowait()
except:
break
# Build multimon-ng decoder arguments
decoders = []
for proto in protocols:
if proto == 'POCSAG512':
decoders.extend(['-a', 'POCSAG512'])
elif proto == 'POCSAG1200':
decoders.extend(['-a', 'POCSAG1200'])
elif proto == 'POCSAG2400':
decoders.extend(['-a', 'POCSAG2400'])
elif proto == 'FLEX':
decoders.extend(['-a', 'FLEX'])
# Build rtl_fm command
# rtl_fm -d -f M -M fm -s 22050 -g -p -l - | multimon-ng -t raw -a POCSAG512 -a POCSAG1200 -a FLEX -f alpha -
rtl_cmd = [
'rtl_fm',
'-d', str(device),
'-f', f'{freq}M',
'-M', 'fm',
'-s', '22050',
]
if gain and gain != '0':
rtl_cmd.extend(['-g', str(gain)])
if ppm and ppm != '0':
rtl_cmd.extend(['-p', str(ppm)])
if squelch and squelch != '0':
rtl_cmd.extend(['-l', str(squelch)])
rtl_cmd.append('-')
multimon_cmd = ['multimon-ng', '-t', 'raw'] + decoders + ['-f', 'alpha', '-']
# Log the command being run
full_cmd = ' '.join(rtl_cmd) + ' | ' + ' '.join(multimon_cmd)
print(f"Running: {full_cmd}")
try:
# Create pipe: rtl_fm | multimon-ng
# Use PTY for multimon-ng to get unbuffered output
rtl_process = subprocess.Popen(
rtl_cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE
)
# Start a thread to monitor rtl_fm stderr for errors
def monitor_rtl_stderr():
for line in rtl_process.stderr:
err_text = line.decode('utf-8', errors='replace').strip()
if err_text:
print(f"[RTL_FM] {err_text}", flush=True)
output_queue.put({'type': 'raw', 'text': f'[rtl_fm] {err_text}'})
rtl_stderr_thread = threading.Thread(target=monitor_rtl_stderr)
rtl_stderr_thread.daemon = True
rtl_stderr_thread.start()
# Create a pseudo-terminal for multimon-ng output
# This tricks it into thinking it's connected to a terminal,
# which disables output buffering
master_fd, slave_fd = pty.openpty()
multimon_process = subprocess.Popen(
multimon_cmd,
stdin=rtl_process.stdout,
stdout=slave_fd,
stderr=slave_fd,
close_fds=True
)
os.close(slave_fd) # Close slave fd in parent process
rtl_process.stdout.close() # Allow rtl_process to receive SIGPIPE
current_process = multimon_process
current_process._rtl_process = rtl_process # Store reference to kill later
current_process._master_fd = master_fd # Store for cleanup
# Start output thread with PTY master fd
thread = threading.Thread(target=stream_decoder, args=(master_fd, multimon_process))
thread.daemon = True
thread.start()
# Send the command info to the client
output_queue.put({'type': 'info', 'text': f'Command: {full_cmd}'})
return jsonify({'status': 'started', 'command': full_cmd})
except FileNotFoundError as e:
return jsonify({'status': 'error', 'message': f'Tool not found: {e.filename}'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/stop', methods=['POST'])
def stop_decoding():
global current_process
with process_lock:
if current_process:
# Kill rtl_fm process first
if hasattr(current_process, '_rtl_process'):
try:
current_process._rtl_process.terminate()
current_process._rtl_process.wait(timeout=2)
except:
try:
current_process._rtl_process.kill()
except:
pass
# Close PTY master fd
if hasattr(current_process, '_master_fd'):
try:
os.close(current_process._master_fd)
except:
pass
# Kill multimon-ng
current_process.terminate()
try:
current_process.wait(timeout=2)
except subprocess.TimeoutExpired:
current_process.kill()
current_process = None
return jsonify({'status': 'stopped'})
return jsonify({'status': 'not_running'})
@app.route('/status')
def get_status():
"""Check if decoder is currently running."""
with process_lock:
if current_process and current_process.poll() is None:
return jsonify({'running': True, 'logging': logging_enabled, 'log_file': log_file_path})
return jsonify({'running': False, 'logging': logging_enabled, 'log_file': log_file_path})
@app.route('/logging', methods=['POST'])
def toggle_logging():
"""Toggle message logging."""
global logging_enabled, log_file_path
data = request.json
if 'enabled' in data:
logging_enabled = data['enabled']
if 'log_file' in data and data['log_file']:
log_file_path = data['log_file']
return jsonify({'logging': logging_enabled, 'log_file': log_file_path})
def log_message(msg):
"""Log a message to file if logging is enabled."""
if not logging_enabled:
return
try:
with open(log_file_path, 'a') as f:
from datetime import datetime
timestamp = datetime.now().strftime('%Y-%m-%d %H:%M:%S')
f.write(f"{timestamp} | {msg.get('protocol', 'UNKNOWN')} | {msg.get('address', '')} | {msg.get('message', '')}\n")
except Exception as e:
print(f"[ERROR] Failed to log message: {e}", flush=True)
@app.route('/killall', methods=['POST'])
def kill_all():
"""Kill all decoder and WiFi processes."""
global current_process, sensor_process, wifi_process, kismet_process
killed = []
processes_to_kill = [
'rtl_fm', 'multimon-ng', 'rtl_433',
'airodump-ng', 'aireplay-ng', 'airmon-ng', 'kismet'
]
for proc in processes_to_kill:
try:
result = subprocess.run(['pkill', '-f', proc], capture_output=True)
if result.returncode == 0:
killed.append(proc)
except:
pass
with process_lock:
current_process = None
with sensor_lock:
sensor_process = None
with wifi_lock:
wifi_process = None
kismet_process = None
return jsonify({'status': 'killed', 'processes': killed})
@app.route('/stream')
def stream():
def generate():
import json
while True:
try:
msg = output_queue.get(timeout=1)
yield f"data: {json.dumps(msg)}\n\n"
except queue.Empty:
yield f"data: {json.dumps({'type': 'keepalive'})}\n\n"
response = Response(generate(), mimetype='text/event-stream')
response.headers['Cache-Control'] = 'no-cache'
response.headers['X-Accel-Buffering'] = 'no'
response.headers['Connection'] = 'keep-alive'
return response
# ============== RTL_433 SENSOR ROUTES ==============
def stream_sensor_output(process):
"""Stream rtl_433 JSON output to queue."""
global sensor_process
import json as json_module
try:
sensor_queue.put({'type': 'status', 'text': 'started'})
for line in iter(process.stdout.readline, b''):
line = line.decode('utf-8', errors='replace').strip()
if not line:
continue
try:
# rtl_433 outputs JSON objects, one per line
data = json_module.loads(line)
data['type'] = 'sensor'
sensor_queue.put(data)
# Log if enabled
if logging_enabled:
try:
with open(log_file_path, 'a') as f:
from datetime import datetime
timestamp = datetime.now().strftime('%Y-%m-%d %H:%M:%S')
f.write(f"{timestamp} | {data.get('model', 'Unknown')} | {json_module.dumps(data)}\n")
except Exception:
pass
except json_module.JSONDecodeError:
# Not JSON, send as raw
sensor_queue.put({'type': 'raw', 'text': line})
except Exception as e:
sensor_queue.put({'type': 'error', 'text': str(e)})
finally:
process.wait()
sensor_queue.put({'type': 'status', 'text': 'stopped'})
with sensor_lock:
sensor_process = None
@app.route('/start_sensor', methods=['POST'])
def start_sensor():
global sensor_process
with sensor_lock:
if sensor_process:
return jsonify({'status': 'error', 'message': 'Sensor already running'})
data = request.json
freq = data.get('frequency', '433.92')
gain = data.get('gain', '0')
ppm = data.get('ppm', '0')
device = data.get('device', '0')
# Clear queue
while not sensor_queue.empty():
try:
sensor_queue.get_nowait()
except:
break
# Build rtl_433 command
# rtl_433 -d -f M -g -p -F json
cmd = [
'rtl_433',
'-d', str(device),
'-f', f'{freq}M',
'-F', 'json'
]
if gain and gain != '0':
cmd.extend(['-g', str(gain)])
if ppm and ppm != '0':
cmd.extend(['-p', str(ppm)])
full_cmd = ' '.join(cmd)
print(f"Running: {full_cmd}")
try:
sensor_process = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
bufsize=1
)
# Start output thread
thread = threading.Thread(target=stream_sensor_output, args=(sensor_process,))
thread.daemon = True
thread.start()
# Monitor stderr
def monitor_stderr():
for line in sensor_process.stderr:
err = line.decode('utf-8', errors='replace').strip()
if err:
print(f"[rtl_433] {err}")
sensor_queue.put({'type': 'info', 'text': f'[rtl_433] {err}'})
stderr_thread = threading.Thread(target=monitor_stderr)
stderr_thread.daemon = True
stderr_thread.start()
sensor_queue.put({'type': 'info', 'text': f'Command: {full_cmd}'})
return jsonify({'status': 'started', 'command': full_cmd})
except FileNotFoundError:
return jsonify({'status': 'error', 'message': 'rtl_433 not found. Install with: brew install rtl_433'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/stop_sensor', methods=['POST'])
def stop_sensor():
global sensor_process
with sensor_lock:
if sensor_process:
sensor_process.terminate()
try:
sensor_process.wait(timeout=2)
except subprocess.TimeoutExpired:
sensor_process.kill()
sensor_process = None
return jsonify({'status': 'stopped'})
return jsonify({'status': 'not_running'})
@app.route('/stream_sensor')
def stream_sensor():
def generate():
import json
while True:
try:
msg = sensor_queue.get(timeout=1)
yield f"data: {json.dumps(msg)}\n\n"
except queue.Empty:
yield f"data: {json.dumps({'type': 'keepalive'})}\n\n"
response = Response(generate(), mimetype='text/event-stream')
response.headers['Cache-Control'] = 'no-cache'
response.headers['X-Accel-Buffering'] = 'no'
response.headers['Connection'] = 'keep-alive'
return response
# ============== WIFI RECONNAISSANCE ROUTES ==============
def detect_wifi_interfaces():
"""Detect available WiFi interfaces."""
interfaces = []
import platform
if platform.system() == 'Darwin': # macOS
try:
# Get list of network interfaces
result = subprocess.run(['networksetup', '-listallhardwareports'],
capture_output=True, text=True, timeout=5)
lines = result.stdout.split('\n')
current_device = None
for i, line in enumerate(lines):
if 'Wi-Fi' in line or 'AirPort' in line:
# Next line should have the device
for j in range(i+1, min(i+3, len(lines))):
if 'Device:' in lines[j]:
device = lines[j].split('Device:')[1].strip()
interfaces.append({
'name': device,
'type': 'internal',
'monitor_capable': False, # macOS internal usually can't
'status': 'up'
})
break
except Exception as e:
print(f"[WiFi] Error detecting macOS interfaces: {e}")
# Check for USB WiFi adapters
try:
result = subprocess.run(['system_profiler', 'SPUSBDataType'],
capture_output=True, text=True, timeout=10)
if 'Wireless' in result.stdout or 'WLAN' in result.stdout or '802.11' in result.stdout:
interfaces.append({
'name': 'USB WiFi Adapter',
'type': 'usb',
'monitor_capable': True,
'status': 'detected'
})
except Exception:
pass
else: # Linux
try:
# Use iw to list wireless interfaces
result = subprocess.run(['iw', 'dev'], capture_output=True, text=True, timeout=5)
current_iface = None
for line in result.stdout.split('\n'):
line = line.strip()
if line.startswith('Interface'):
current_iface = line.split()[1]
elif current_iface and 'type' in line:
iface_type = line.split()[-1]
interfaces.append({
'name': current_iface,
'type': iface_type,
'monitor_capable': True,
'status': 'up'
})
current_iface = None
except FileNotFoundError:
# Try iwconfig instead
try:
result = subprocess.run(['iwconfig'], capture_output=True, text=True, timeout=5)
for line in result.stdout.split('\n'):
if 'IEEE 802.11' in line:
iface = line.split()[0]
interfaces.append({
'name': iface,
'type': 'managed',
'monitor_capable': True,
'status': 'up'
})
except Exception:
pass
except Exception as e:
print(f"[WiFi] Error detecting Linux interfaces: {e}")
return interfaces
@app.route('/wifi/interfaces')
def get_wifi_interfaces():
"""Get available WiFi interfaces."""
interfaces = detect_wifi_interfaces()
tools = {
'airmon': check_tool('airmon-ng'),
'airodump': check_tool('airodump-ng'),
'aireplay': check_tool('aireplay-ng'),
'kismet': check_tool('kismet'),
'iw': check_tool('iw')
}
return jsonify({'interfaces': interfaces, 'tools': tools, 'monitor_interface': wifi_monitor_interface})
@app.route('/wifi/monitor', methods=['POST'])
def toggle_monitor_mode():
"""Enable or disable monitor mode on an interface."""
global wifi_monitor_interface
data = request.json
interface = data.get('interface')
action = data.get('action', 'start') # 'start' or 'stop'
if not interface:
return jsonify({'status': 'error', 'message': 'No interface specified'})
if action == 'start':
# Try airmon-ng first
if check_tool('airmon-ng'):
try:
# Kill interfering processes
subprocess.run(['airmon-ng', 'check', 'kill'], capture_output=True, timeout=10)
# Start monitor mode
result = subprocess.run(['airmon-ng', 'start', interface],
capture_output=True, text=True, timeout=15)
# Parse output to find monitor interface name
output = result.stdout + result.stderr
# Common patterns: wlan0mon, wlp3s0mon, etc.
import re
# Look for "on mon" pattern first (most reliable)
match = re.search(r'\bon\s+(\w+mon)\b', output, re.IGNORECASE)
if not match:
# Fallback: look for interface pattern like wlan0mon, wlp3s0mon (must have a digit)
match = re.search(r'\b(\w*\d+\w*mon)\b', output)
if not match:
# Second fallback: look for the original interface + mon in output
iface_pattern = re.escape(interface) + r'mon'
match = re.search(r'\b(' + iface_pattern + r')\b', output)
if match:
wifi_monitor_interface = match.group(1)
else:
# Assume it's interface + 'mon'
wifi_monitor_interface = interface + 'mon'
wifi_queue.put({'type': 'info', 'text': f'Monitor mode enabled on {wifi_monitor_interface}'})
return jsonify({'status': 'success', 'monitor_interface': wifi_monitor_interface})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
# Fallback to iw (Linux)
elif check_tool('iw'):
try:
subprocess.run(['ip', 'link', 'set', interface, 'down'], capture_output=True)
subprocess.run(['iw', interface, 'set', 'monitor', 'control'], capture_output=True)
subprocess.run(['ip', 'link', 'set', interface, 'up'], capture_output=True)
wifi_monitor_interface = interface
return jsonify({'status': 'success', 'monitor_interface': interface})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
else:
return jsonify({'status': 'error', 'message': 'No monitor mode tools available. Install aircrack-ng (brew install aircrack-ng) or iw.'})
else: # stop
if check_tool('airmon-ng'):
try:
result = subprocess.run(['airmon-ng', 'stop', wifi_monitor_interface or interface],
capture_output=True, text=True, timeout=15)
wifi_monitor_interface = None
return jsonify({'status': 'success', 'message': 'Monitor mode disabled'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
elif check_tool('iw'):
try:
subprocess.run(['ip', 'link', 'set', interface, 'down'], capture_output=True)
subprocess.run(['iw', interface, 'set', 'type', 'managed'], capture_output=True)
subprocess.run(['ip', 'link', 'set', interface, 'up'], capture_output=True)
wifi_monitor_interface = None
return jsonify({'status': 'success', 'message': 'Monitor mode disabled'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
return jsonify({'status': 'error', 'message': 'Unknown action'})
def parse_airodump_csv(csv_path):
"""Parse airodump-ng CSV output file."""
networks = {}
clients = {}
try:
with open(csv_path, 'r', errors='replace') as f:
content = f.read()
# Split into networks and clients sections
sections = content.split('\n\n')
for section in sections:
lines = section.strip().split('\n')
if not lines:
continue
header = lines[0] if lines else ''
if 'BSSID' in header and 'ESSID' in header:
# Networks section
for line in lines[1:]:
parts = [p.strip() for p in line.split(',')]
if len(parts) >= 14:
bssid = parts[0]
if bssid and ':' in bssid:
networks[bssid] = {
'bssid': bssid,
'first_seen': parts[1],
'last_seen': parts[2],
'channel': parts[3],
'speed': parts[4],
'privacy': parts[5],
'cipher': parts[6],
'auth': parts[7],
'power': parts[8],
'beacons': parts[9],
'ivs': parts[10],
'lan_ip': parts[11],
'essid': parts[13] or 'Hidden'
}
elif 'Station MAC' in header:
# Clients section
for line in lines[1:]:
parts = [p.strip() for p in line.split(',')]
if len(parts) >= 6:
station = parts[0]
if station and ':' in station:
clients[station] = {
'mac': station,
'first_seen': parts[1],
'last_seen': parts[2],
'power': parts[3],
'packets': parts[4],
'bssid': parts[5],
'probes': parts[6] if len(parts) > 6 else ''
}
except Exception as e:
print(f"[WiFi] Error parsing CSV: {e}")
return networks, clients
def stream_airodump_output(process, csv_path):
"""Stream airodump-ng output to queue."""
global wifi_process, wifi_networks, wifi_clients
import time
import select
try:
wifi_queue.put({'type': 'status', 'text': 'started'})
last_parse = 0
start_time = time.time()
csv_found = False
while process.poll() is None:
# Check for stderr output (non-blocking)
try:
import fcntl
# Make stderr non-blocking
fd = process.stderr.fileno()
fl = fcntl.fcntl(fd, fcntl.F_GETFL)
fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
stderr_data = process.stderr.read()
if stderr_data:
stderr_text = stderr_data.decode('utf-8', errors='replace').strip()
if stderr_text:
# Filter out progress updates, report actual errors
for line in stderr_text.split('\n'):
line = line.strip()
if line and not line.startswith('CH') and not line.startswith('Elapsed'):
wifi_queue.put({'type': 'error', 'text': f'airodump-ng: {line}'})
except Exception:
pass
# Parse CSV file periodically
current_time = time.time()
if current_time - last_parse >= 2: # Parse every 2 seconds
csv_file = csv_path + '-01.csv'
if os.path.exists(csv_file):
csv_found = True
networks, clients = parse_airodump_csv(csv_file)
# Detect new networks
for bssid, net in networks.items():
if bssid not in wifi_networks:
wifi_queue.put({
'type': 'network',
'action': 'new',
**net
})
else:
# Update existing
wifi_queue.put({
'type': 'network',
'action': 'update',
**net
})
# Detect new clients
for mac, client in clients.items():
if mac not in wifi_clients:
wifi_queue.put({
'type': 'client',
'action': 'new',
**client
})
wifi_networks = networks
wifi_clients = clients
last_parse = current_time
if current_time - start_time > 5 and not csv_found:
# No CSV after 5 seconds - likely a problem
wifi_queue.put({'type': 'error', 'text': 'No scan data after 5 seconds. Check if monitor mode is properly enabled.'})
start_time = current_time + 30 # Don't spam this message
time.sleep(0.5)
# Process exited - capture any remaining stderr
try:
remaining_stderr = process.stderr.read()
if remaining_stderr:
stderr_text = remaining_stderr.decode('utf-8', errors='replace').strip()
if stderr_text:
wifi_queue.put({'type': 'error', 'text': f'airodump-ng exited: {stderr_text}'})
except Exception:
pass
# Check exit code
exit_code = process.returncode
if exit_code != 0 and exit_code is not None:
wifi_queue.put({'type': 'error', 'text': f'airodump-ng exited with code {exit_code}'})
except Exception as e:
wifi_queue.put({'type': 'error', 'text': str(e)})
finally:
process.wait()
wifi_queue.put({'type': 'status', 'text': 'stopped'})
with wifi_lock:
wifi_process = None
@app.route('/wifi/scan/start', methods=['POST'])
def start_wifi_scan():
"""Start WiFi scanning with airodump-ng."""
global wifi_process, wifi_networks, wifi_clients
with wifi_lock:
if wifi_process:
return jsonify({'status': 'error', 'message': 'Scan already running'})
data = request.json
interface = data.get('interface') or wifi_monitor_interface
channel = data.get('channel') # None = channel hopping
band = data.get('band', 'abg') # 'a' = 5GHz, 'bg' = 2.4GHz, 'abg' = both
if not interface:
return jsonify({'status': 'error', 'message': 'No monitor interface available. Enable monitor mode first.'})
# Clear previous data
wifi_networks = {}
wifi_clients = {}
# Clear queue
while not wifi_queue.empty():
try:
wifi_queue.get_nowait()
except:
break
# Build airodump-ng command
csv_path = '/tmp/intercept_wifi'
# Remove old files
for f in [f'/tmp/intercept_wifi-01.csv', f'/tmp/intercept_wifi-01.cap',
f'/tmp/intercept_wifi-01.kismet.csv', f'/tmp/intercept_wifi-01.kismet.netxml']:
try:
os.remove(f)
except:
pass
cmd = [
'airodump-ng',
'-w', csv_path,
'--output-format', 'csv,pcap',
'--band', band,
interface
]
if channel:
cmd.extend(['-c', str(channel)])
print(f"[WiFi] Running: {' '.join(cmd)}")
try:
wifi_process = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE
)
# Wait briefly to check if process fails immediately
import time
time.sleep(0.5)
if wifi_process.poll() is not None:
# Process already exited - capture error
stderr_output = wifi_process.stderr.read().decode('utf-8', errors='replace').strip()
stdout_output = wifi_process.stdout.read().decode('utf-8', errors='replace').strip()
exit_code = wifi_process.returncode
wifi_process = None
error_msg = stderr_output or stdout_output or f'Process exited with code {exit_code}'
# Common error explanations
if 'No such device' in error_msg or 'No such interface' in error_msg:
error_msg = f'Interface "{interface}" not found. Make sure monitor mode is enabled.'
elif 'Operation not permitted' in error_msg:
error_msg = 'Permission denied. Try running with sudo.'
elif 'monitor mode' in error_msg.lower():
error_msg = f'Interface "{interface}" is not in monitor mode. Enable monitor mode first.'
return jsonify({'status': 'error', 'message': error_msg})
# Start parsing thread
thread = threading.Thread(target=stream_airodump_output, args=(wifi_process, csv_path))
thread.daemon = True
thread.start()
wifi_queue.put({'type': 'info', 'text': f'Started scanning on {interface}'})
return jsonify({'status': 'started', 'interface': interface})
except FileNotFoundError:
return jsonify({'status': 'error', 'message': 'airodump-ng not found. Install aircrack-ng suite (brew install aircrack-ng).'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/wifi/scan/stop', methods=['POST'])
def stop_wifi_scan():
"""Stop WiFi scanning."""
global wifi_process
with wifi_lock:
if wifi_process:
wifi_process.terminate()
try:
wifi_process.wait(timeout=3)
except subprocess.TimeoutExpired:
wifi_process.kill()
wifi_process = None
return jsonify({'status': 'stopped'})
return jsonify({'status': 'not_running'})
@app.route('/wifi/deauth', methods=['POST'])
def send_deauth():
"""Send deauthentication packets to force handshake capture."""
data = request.json
target_bssid = data.get('bssid')
target_client = data.get('client', 'FF:FF:FF:FF:FF:FF') # Broadcast by default
count = data.get('count', 5)
interface = data.get('interface') or wifi_monitor_interface
if not target_bssid:
return jsonify({'status': 'error', 'message': 'Target BSSID required'})
# Validate MAC addresses to prevent command injection
if not is_valid_mac(target_bssid):
return jsonify({'status': 'error', 'message': 'Invalid BSSID format'})
if not is_valid_mac(target_client):
return jsonify({'status': 'error', 'message': 'Invalid client MAC format'})
# Validate count to prevent abuse
try:
count = int(count)
if count < 1 or count > 100:
count = 5
except (ValueError, TypeError):
count = 5
if not interface:
return jsonify({'status': 'error', 'message': 'No monitor interface'})
if not check_tool('aireplay-ng'):
return jsonify({'status': 'error', 'message': 'aireplay-ng not found'})
try:
# aireplay-ng --deauth -a -c
cmd = [
'aireplay-ng',
'--deauth', str(count),
'-a', target_bssid,
'-c', target_client,
interface
]
wifi_queue.put({'type': 'info', 'text': f'Sending {count} deauth packets to {target_bssid}'})
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
if result.returncode == 0:
return jsonify({'status': 'success', 'message': f'Sent {count} deauth packets'})
else:
return jsonify({'status': 'error', 'message': result.stderr})
except subprocess.TimeoutExpired:
return jsonify({'status': 'success', 'message': 'Deauth sent (timed out waiting for completion)'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/wifi/handshake/capture', methods=['POST'])
def capture_handshake():
"""Start targeted handshake capture."""
global wifi_process
data = request.json
target_bssid = data.get('bssid')
channel = data.get('channel')
interface = data.get('interface') or wifi_monitor_interface
if not target_bssid or not channel:
return jsonify({'status': 'error', 'message': 'BSSID and channel required'})
# Validate inputs to prevent command injection
if not is_valid_mac(target_bssid):
return jsonify({'status': 'error', 'message': 'Invalid BSSID format'})
if not is_valid_channel(channel):
return jsonify({'status': 'error', 'message': 'Invalid channel'})
with wifi_lock:
if wifi_process:
return jsonify({'status': 'error', 'message': 'Scan already running. Stop it first.'})
# Safe to use in path after validation
capture_path = f'/tmp/intercept_handshake_{target_bssid.replace(":", "")}'
cmd = [
'airodump-ng',
'-c', str(channel),
'--bssid', target_bssid,
'-w', capture_path,
'--output-format', 'pcap',
interface
]
try:
wifi_process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
wifi_queue.put({'type': 'info', 'text': f'Capturing handshakes for {target_bssid} on channel {channel}'})
return jsonify({'status': 'started', 'capture_file': capture_path + '-01.cap'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/wifi/kismet/start', methods=['POST'])
def start_kismet():
"""Start Kismet for passive reconnaissance."""
global kismet_process
data = request.json
interface = data.get('interface') or wifi_monitor_interface
if not interface:
return jsonify({'status': 'error', 'message': 'No interface specified'})
if not check_tool('kismet'):
return jsonify({'status': 'error', 'message': 'Kismet not found. Install with: brew install kismet'})
with wifi_lock:
if kismet_process:
return jsonify({'status': 'error', 'message': 'Kismet already running'})
try:
# Start Kismet with REST API enabled
cmd = [
'kismet',
'-c', interface,
'--no-ncurses',
'--override', 'httpd_bind_address=127.0.0.1',
'--override', 'httpd_port=2501'
]
kismet_process = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE
)
wifi_queue.put({'type': 'info', 'text': 'Kismet started. API available at http://127.0.0.1:2501'})
return jsonify({'status': 'started', 'api_url': 'http://127.0.0.1:2501'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/wifi/kismet/stop', methods=['POST'])
def stop_kismet():
"""Stop Kismet."""
global kismet_process
with wifi_lock:
if kismet_process:
kismet_process.terminate()
try:
kismet_process.wait(timeout=5)
except subprocess.TimeoutExpired:
kismet_process.kill()
kismet_process = None
return jsonify({'status': 'stopped'})
return jsonify({'status': 'not_running'})
@app.route('/wifi/kismet/devices')
def get_kismet_devices():
"""Get devices from Kismet REST API."""
import urllib.request
import json as json_module
try:
# Kismet REST API endpoint for devices
url = 'http://127.0.0.1:2501/devices/views/all/devices.json'
req = urllib.request.Request(url)
req.add_header('KISMET', 'admin:admin') # Default credentials
with urllib.request.urlopen(req, timeout=5) as response:
data = json_module.loads(response.read().decode())
return jsonify({'devices': data})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/wifi/networks')
def get_wifi_networks():
"""Get current list of discovered networks."""
return jsonify({
'networks': list(wifi_networks.values()),
'clients': list(wifi_clients.values()),
'handshakes': wifi_handshakes,
'monitor_interface': wifi_monitor_interface
})
@app.route('/wifi/stream')
def stream_wifi():
"""SSE stream for WiFi events."""
def generate():
import json
while True:
try:
msg = wifi_queue.get(timeout=1)
yield f"data: {json.dumps(msg)}\n\n"
except queue.Empty:
yield f"data: {json.dumps({'type': 'keepalive'})}\n\n"
response = Response(generate(), mimetype='text/event-stream')
response.headers['Cache-Control'] = 'no-cache'
response.headers['X-Accel-Buffering'] = 'no'
response.headers['Connection'] = 'keep-alive'
return response
# ============== BLUETOOTH RECONNAISSANCE ROUTES ==============
def get_manufacturer(mac):
"""Look up manufacturer from MAC address OUI."""
prefix = mac[:8].upper()
result = OUI_DATABASE.get(prefix, 'Unknown')
return result
def classify_bt_device(name, device_class, services, manufacturer=None):
"""Classify Bluetooth device type based on available info."""
name_lower = (name or '').lower()
mfr_lower = (manufacturer or '').lower()
# Audio devices - extensive patterns
audio_patterns = [
'airpod', 'earbud', 'headphone', 'headset', 'speaker', 'audio', 'beats', 'bose',
'jbl', 'sony wh', 'sony wf', 'sennheiser', 'jabra', 'soundcore', 'anker', 'buds',
'earphone', 'pod', 'soundbar', 'subwoofer', 'amp', 'dac', 'hifi', 'stereo',
'skullcandy', 'marshall', 'b&o', 'bang', 'olufsen', 'harman', 'akg', 'shure',
'audio-technica', 'plantronics', 'poly', 'soundlink', 'soundsport', 'quietcomfort',
'freebuds', 'galaxy buds', 'wf-', 'wh-', 'linkbuds', 'momentum', 'px7', 'px8',
'liberty', 'life', 'enco', 'oppo enco', 'nothing ear', 'ear (', 'studio buds',
'powerbeats', 'solo', 'flex', 'tour', 'tune', 'reflect', 'endurance', 'soundpeats'
]
if any(x in name_lower for x in audio_patterns):
return 'audio'
# Wearables - watches, bands, fitness
wearable_patterns = [
'watch', 'band', 'fitbit', 'garmin', 'mi band', 'miband', 'amazfit', 'huawei band',
'galaxy watch', 'gear', 'versa', 'sense', 'charge', 'inspire', 'vivosmart',
'vivoactive', 'venu', 'forerunner', 'fenix', 'instinct', 'polar', 'suunto',
'whoop', 'oura', 'ring', 'wristband', 'fitness', 'tracker', 'activity',
'apple watch', 'iwatch', 'samsung watch', 'ticwatch', 'fossil', 'withings'
]
if any(x in name_lower for x in wearable_patterns):
return 'wearable'
# Phones - mobile devices
phone_patterns = [
'iphone', 'galaxy', 'pixel', 'phone', 'android', 'oneplus', 'huawei', 'xiaomi',
'redmi', 'poco', 'realme', 'oppo', 'vivo', 'motorola', 'moto', 'nokia', 'lg',
'sony xperia', 'xperia', 'asus', 'rog phone', 'zenfone', 'nothing phone',
'samsung sm-', 'sm-g', 'sm-a', 'sm-s', 'sm-n', 'sm-f'
]
if any(x in name_lower for x in phone_patterns):
return 'phone'
# Trackers - location devices
tracker_patterns = [
'airtag', 'tile', 'smarttag', 'chipolo', 'find my', 'findmy', 'locator',
'gps', 'pet tracker', 'key finder', 'nut', 'trackr', 'pebblebee', 'cube'
]
if any(x in name_lower for x in tracker_patterns):
return 'tracker'
# Input devices - keyboards, mice, controllers
input_patterns = [
'keyboard', 'mouse', 'controller', 'gamepad', 'joystick', 'remote', 'trackpad',
'magic mouse', 'magic keyboard', 'mx master', 'mx keys', 'logitech', 'razer',
'dualshock', 'dualsense', 'xbox', 'switch pro', 'joycon', 'joy-con', '8bitdo',
'steelseries', 'corsair', 'hyperx'
]
if any(x in name_lower for x in input_patterns):
return 'input'
# Media devices - TVs, streaming
media_patterns = [
'tv', 'roku', 'chromecast', 'firestick', 'fire tv', 'appletv', 'apple tv',
'nvidia shield', 'android tv', 'smart tv', 'lg tv', 'samsung tv', 'sony tv',
'tcl', 'hisense', 'vizio', 'projector', 'beam', 'soundbase'
]
if any(x in name_lower for x in media_patterns):
return 'media'
# Computers - laptops, desktops
computer_patterns = [
'macbook', 'imac', 'mac mini', 'mac pro', 'thinkpad', 'latitude', 'xps',
'pavilion', 'envy', 'spectre', 'surface', 'chromebook', 'ideapad', 'legion',
'predator', 'rog', 'alienware', 'desktop', 'laptop', 'notebook', 'pc'
]
if any(x in name_lower for x in computer_patterns):
return 'computer'
# Use manufacturer to infer type
if mfr_lower in ['bose', 'jbl', 'sony', 'sennheiser', 'jabra', 'beats', 'bang & olufsen', 'audio-technica', 'plantronics', 'skullcandy', 'anker']:
return 'audio'
if mfr_lower in ['fitbit', 'garmin']:
return 'wearable'
if mfr_lower == 'tile':
return 'tracker'
if mfr_lower == 'logitech':
return 'input'
# Check device class if available
if device_class:
major_class = (device_class >> 8) & 0x1F
if major_class == 1: # Computer
return 'computer'
elif major_class == 2: # Phone
return 'phone'
elif major_class == 4: # Audio/Video
return 'audio'
elif major_class == 5: # Peripheral
return 'input'
elif major_class == 6: # Imaging
return 'imaging'
elif major_class == 7: # Wearable
return 'wearable'
return 'other'
def detect_tracker(mac, name, manufacturer_data=None):
"""Detect if device is a known tracker (AirTag, Tile, etc)."""
mac_prefix = mac[:5].upper()
# AirTag detection (Apple Find My)
if any(mac_prefix.startswith(p) for p in AIRTAG_PREFIXES):
if manufacturer_data and b'\\x4c\\x00' in manufacturer_data:
return {'type': 'airtag', 'name': 'Apple AirTag', 'risk': 'high'}
# Tile detection
if any(mac_prefix.startswith(p) for p in TILE_PREFIXES):
return {'type': 'tile', 'name': 'Tile Tracker', 'risk': 'medium'}
# Samsung SmartTag
if any(mac_prefix.startswith(p) for p in SAMSUNG_TRACKER):
return {'type': 'smarttag', 'name': 'Samsung SmartTag', 'risk': 'medium'}
# Name-based detection
name_lower = (name or '').lower()
if 'airtag' in name_lower:
return {'type': 'airtag', 'name': 'Apple AirTag', 'risk': 'high'}
if 'tile' in name_lower:
return {'type': 'tile', 'name': 'Tile Tracker', 'risk': 'medium'}
if 'smarttag' in name_lower:
return {'type': 'smarttag', 'name': 'Samsung SmartTag', 'risk': 'medium'}
if 'chipolo' in name_lower:
return {'type': 'chipolo', 'name': 'Chipolo Tracker', 'risk': 'medium'}
return None
def detect_bt_interfaces():
"""Detect available Bluetooth interfaces."""
interfaces = []
import platform
if platform.system() == 'Linux':
try:
# Use hciconfig to list interfaces
result = subprocess.run(['hciconfig'], capture_output=True, text=True, timeout=5)
output = result.stdout
# Parse hciconfig output - "UP RUNNING" appears on a separate line
import re
# Split by interface blocks
blocks = re.split(r'(?=^hci\d+:)', output, flags=re.MULTILINE)
for block in blocks:
if block.strip():
# Get interface name from first line
first_line = block.split('\n')[0]
match = re.match(r'(hci\d+):', first_line)
if match:
iface_name = match.group(1)
# Check if UP appears anywhere in the block
is_up = 'UP RUNNING' in block or '\tUP ' in block
interfaces.append({
'name': iface_name,
'type': 'hci',
'status': 'up' if is_up else 'down'
})
except FileNotFoundError:
pass
except Exception as e:
print(f"[BT] Error detecting interfaces: {e}")
elif platform.system() == 'Darwin': # macOS
# macOS uses different Bluetooth stack
interfaces.append({
'name': 'default',
'type': 'macos',
'status': 'available'
})
return interfaces
@app.route('/bt/reload-oui', methods=['POST'])
def reload_oui_database():
"""Reload OUI database from external file."""
global OUI_DATABASE
new_db = load_oui_database()
if new_db:
OUI_DATABASE = new_db
return jsonify({'status': 'success', 'entries': len(OUI_DATABASE)})
return jsonify({'status': 'error', 'message': 'Could not load oui_database.json'})
@app.route('/bt/interfaces')
def get_bt_interfaces():
"""Get available Bluetooth interfaces and tools."""
interfaces = detect_bt_interfaces()
tools = {
'hcitool': check_tool('hcitool'),
'bluetoothctl': check_tool('bluetoothctl'),
'hciconfig': check_tool('hciconfig'),
'l2ping': check_tool('l2ping'),
'sdptool': check_tool('sdptool')
}
return jsonify({
'interfaces': interfaces,
'tools': tools,
'current_interface': bt_interface
})
def parse_hcitool_output(line):
"""Parse hcitool scan output line."""
# Format: "AA:BB:CC:DD:EE:FF Device Name"
parts = line.strip().split('\t')
if len(parts) >= 2:
mac = parts[0].strip()
name = parts[1].strip() if len(parts) > 1 else ''
if ':' in mac and len(mac) == 17:
return {'mac': mac, 'name': name}
return None
def stream_bt_scan(process, scan_mode):
"""Stream Bluetooth scan output to queue."""
global bt_process, bt_devices
import time
try:
bt_queue.put({'type': 'status', 'text': 'started'})
start_time = time.time()
device_found = False
# Set up non-blocking stderr reading
try:
import fcntl
fd = process.stderr.fileno()
fl = fcntl.fcntl(fd, fcntl.F_GETFL)
fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
except Exception:
pass
if scan_mode == 'hcitool':
# hcitool lescan output
for line in iter(process.stdout.readline, b''):
line = line.decode('utf-8', errors='replace').strip()
if not line or 'LE Scan' in line:
continue
# Parse BLE device
parts = line.split()
if len(parts) >= 1 and ':' in parts[0]:
mac = parts[0]
name = ' '.join(parts[1:]) if len(parts) > 1 else ''
manufacturer = get_manufacturer(mac)
device = {
'mac': mac,
'name': name or '[Unknown]',
'manufacturer': manufacturer,
'type': classify_bt_device(name, None, None, manufacturer),
'rssi': None,
'last_seen': time.time()
}
# Check for tracker
tracker = detect_tracker(mac, name)
if tracker:
device['tracker'] = tracker
is_new = mac not in bt_devices
bt_devices[mac] = device
queue_data = {
**device,
'type': 'device', # Must come after **device to not be overwritten
'device_type': device.get('type', 'other'),
'action': 'new' if is_new else 'update',
}
bt_queue.put(queue_data)
elif scan_mode == 'bluetoothctl':
# bluetoothctl scan output - read from pty
import os
import select
import time
import re
master_fd = getattr(process, '_master_fd', None)
if not master_fd:
bt_queue.put({'type': 'error', 'text': 'bluetoothctl pty not available'})
return
buffer = ''
while process.poll() is None:
# Check if data available
readable, _, _ = select.select([master_fd], [], [], 1.0)
if readable:
try:
data = os.read(master_fd, 4096)
if not data:
break
buffer += data.decode('utf-8', errors='replace')
# Process complete lines
while '\n' in buffer:
line, buffer = buffer.split('\n', 1)
line = line.strip()
# Remove ANSI escape codes
line = re.sub(r'\x1b\[[0-9;]*m', '', line)
line = re.sub(r'\x1b\[\?.*?[a-zA-Z]', '', line)
line = re.sub(r'\x1b\[K', '', line) # Clear line escape
line = re.sub(r'\r', '', line) # Remove carriage returns
# Debug: print what we're receiving
if line and 'Device' in line:
print(f"[BT] bluetoothctl: {line}")
# Parse [NEW] Device or [CHG] Device lines
# Format: [NEW] Device AA:BB:CC:DD:EE:FF DeviceName
if 'Device' in line:
match = re.search(r'([0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2})\s*(.*)', line)
if match:
mac = match.group(1).upper()
name = match.group(2).strip()
manufacturer = get_manufacturer(mac)
device = {
'mac': mac,
'name': name or '[Unknown]',
'manufacturer': manufacturer,
'type': classify_bt_device(name, None, None, manufacturer),
'rssi': None,
'last_seen': time.time()
}
tracker = detect_tracker(mac, name)
if tracker:
device['tracker'] = tracker
is_new = mac not in bt_devices
bt_devices[mac] = device
queue_data = {
**device,
'type': 'device', # Must come after **device to not be overwritten
'device_type': device.get('type', 'other'),
'action': 'new' if is_new else 'update',
}
print(f"[BT] Queuing device: {mac} - {name}")
bt_queue.put(queue_data)
except OSError:
break
# Close master_fd
try:
os.close(master_fd)
except:
pass
except Exception as e:
bt_queue.put({'type': 'error', 'text': str(e)})
finally:
# Capture any remaining stderr
try:
remaining_stderr = process.stderr.read()
if remaining_stderr:
stderr_text = remaining_stderr.decode('utf-8', errors='replace').strip()
if stderr_text:
bt_queue.put({'type': 'error', 'text': f'Bluetooth scan: {stderr_text}'})
except Exception:
pass
# Check exit code
process.wait()
exit_code = process.returncode
if exit_code != 0 and exit_code is not None:
bt_queue.put({'type': 'error', 'text': f'Bluetooth scan exited with code {exit_code}'})
bt_queue.put({'type': 'status', 'text': 'stopped'})
with bt_lock:
bt_process = None
@app.route('/bt/scan/start', methods=['POST'])
def start_bt_scan():
"""Start Bluetooth scanning."""
global bt_process, bt_devices, bt_interface
with bt_lock:
# Check if process is actually still running (not just set)
if bt_process:
if bt_process.poll() is None:
# Process is actually running
return jsonify({'status': 'error', 'message': 'Scan already running'})
else:
# Process died, clear the state
bt_process = None
data = request.json
scan_mode = data.get('mode', 'hcitool')
interface = data.get('interface', 'hci0')
duration = data.get('duration', 30)
scan_ble = data.get('scan_ble', True)
scan_classic = data.get('scan_classic', True)
bt_interface = interface
bt_devices = {}
# Clear queue
while not bt_queue.empty():
try:
bt_queue.get_nowait()
except:
break
try:
if scan_mode == 'hcitool':
if scan_ble:
cmd = ['hcitool', '-i', interface, 'lescan', '--duplicates']
else:
cmd = ['hcitool', '-i', interface, 'scan']
bt_process = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE
)
elif scan_mode == 'bluetoothctl':
# Use bluetoothctl for BLE scanning with pty for proper output
import pty
import os
import time
master_fd, slave_fd = pty.openpty()
bt_process = subprocess.Popen(
['bluetoothctl'],
stdin=slave_fd,
stdout=slave_fd,
stderr=slave_fd,
close_fds=True
)
os.close(slave_fd)
# Store master_fd for reading
bt_process._master_fd = master_fd
# Wait for bluetoothctl to initialize
time.sleep(0.5)
# Power on and start LE scan (compatible with Bluetooth 5.x)
os.write(master_fd, b'power on\n')
time.sleep(0.3)
os.write(master_fd, b'scan on\n')
else:
return jsonify({'status': 'error', 'message': f'Unknown scan mode: {scan_mode}'})
# Wait briefly to check if process fails immediately
import time
time.sleep(0.5)
if bt_process.poll() is not None:
# Process already exited - capture error
stderr_output = bt_process.stderr.read().decode('utf-8', errors='replace').strip()
stdout_output = bt_process.stdout.read().decode('utf-8', errors='replace').strip()
exit_code = bt_process.returncode
bt_process = None
error_msg = stderr_output or stdout_output or f'Process exited with code {exit_code}'
# Common error explanations and auto-recovery
if 'No such device' in error_msg or 'hci0' in error_msg.lower():
error_msg = f'Bluetooth interface "{interface}" not found or not available.'
elif 'Operation not permitted' in error_msg or 'Permission denied' in error_msg:
error_msg = 'Permission denied. Try running with sudo or add user to bluetooth group.'
elif 'busy' in error_msg.lower():
error_msg = f'Bluetooth interface "{interface}" is busy. Stop other Bluetooth operations first.'
elif 'set scan parameters failed' in error_msg.lower() or 'input/output error' in error_msg.lower():
# Try to auto-reset the adapter
try:
subprocess.run(['hciconfig', interface, 'down'], capture_output=True, timeout=5)
subprocess.run(['hciconfig', interface, 'up'], capture_output=True, timeout=5)
error_msg = f'Adapter error - attempted auto-reset. Click "Reset Adapter" and try again.'
except:
error_msg = 'Bluetooth adapter I/O error. Click "Reset Adapter" to reset the adapter and try again.'
return jsonify({'status': 'error', 'message': error_msg})
# Start streaming thread
thread = threading.Thread(target=stream_bt_scan, args=(bt_process, scan_mode))
thread.daemon = True
thread.start()
bt_queue.put({'type': 'info', 'text': f'Started {scan_mode} scan on {interface}'})
return jsonify({'status': 'started', 'mode': scan_mode, 'interface': interface})
except FileNotFoundError as e:
tool_name = e.filename or scan_mode
return jsonify({'status': 'error', 'message': f'Tool "{tool_name}" not found. Install required Bluetooth tools.'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/bt/scan/stop', methods=['POST'])
def stop_bt_scan():
"""Stop Bluetooth scanning."""
global bt_process
with bt_lock:
if bt_process:
bt_process.terminate()
try:
bt_process.wait(timeout=3)
except subprocess.TimeoutExpired:
bt_process.kill()
bt_process = None
return jsonify({'status': 'stopped'})
return jsonify({'status': 'not_running'})
@app.route('/bt/reset', methods=['POST'])
def reset_bt_adapter():
"""Reset Bluetooth adapter and clear scan state."""
global bt_process
data = request.json
interface = data.get('interface', 'hci0')
with bt_lock:
# Force clear the process state
if bt_process:
try:
bt_process.terminate()
bt_process.wait(timeout=2)
except:
try:
bt_process.kill()
except:
pass
bt_process = None
# Reset the adapter
try:
import time
import os
# Kill any processes that might be using the adapter
subprocess.run(['pkill', '-f', 'hcitool'], capture_output=True, timeout=2)
subprocess.run(['pkill', '-f', 'bluetoothctl'], capture_output=True, timeout=2)
time.sleep(0.5)
# Check if running as root
is_root = os.geteuid() == 0
# Try rfkill unblock first
subprocess.run(['rfkill', 'unblock', 'bluetooth'], capture_output=True, timeout=5)
# Reset the adapter with a delay between down and up
if is_root:
down_result = subprocess.run(['hciconfig', interface, 'down'], capture_output=True, text=True, timeout=5)
time.sleep(1)
up_result = subprocess.run(['hciconfig', interface, 'up'], capture_output=True, text=True, timeout=5)
else:
# Try with sudo
down_result = subprocess.run(['sudo', '-n', 'hciconfig', interface, 'down'], capture_output=True, text=True, timeout=5)
time.sleep(1)
up_result = subprocess.run(['sudo', '-n', 'hciconfig', interface, 'up'], capture_output=True, text=True, timeout=5)
time.sleep(0.5)
# Check if adapter is up
result = subprocess.run(['hciconfig', interface], capture_output=True, text=True, timeout=5)
is_up = 'UP RUNNING' in result.stdout
# If still not up, try bluetoothctl
if not is_up:
subprocess.run(['bluetoothctl', 'power', 'off'], capture_output=True, timeout=5)
time.sleep(1)
subprocess.run(['bluetoothctl', 'power', 'on'], capture_output=True, timeout=5)
time.sleep(0.5)
result = subprocess.run(['hciconfig', interface], capture_output=True, text=True, timeout=5)
is_up = 'UP RUNNING' in result.stdout
if is_up:
bt_queue.put({'type': 'info', 'text': f'Bluetooth adapter {interface} reset successfully'})
else:
bt_queue.put({'type': 'error', 'text': f'Adapter {interface} may need manual reset. Try: sudo hciconfig {interface} up'})
return jsonify({
'status': 'success' if is_up else 'warning',
'message': f'Adapter {interface} reset' if is_up else f'Reset attempted but adapter still down. Run: sudo hciconfig {interface} up',
'is_up': is_up
})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/bt/enum', methods=['POST'])
def enum_bt_services():
"""Enumerate services on a Bluetooth device."""
data = request.json
target_mac = data.get('mac')
if not target_mac:
return jsonify({'status': 'error', 'message': 'Target MAC required'})
try:
# Try sdptool for classic BT
result = subprocess.run(
['sdptool', 'browse', target_mac],
capture_output=True, text=True, timeout=30
)
services = []
current_service = {}
for line in result.stdout.split('\n'):
line = line.strip()
if line.startswith('Service Name:'):
if current_service:
services.append(current_service)
current_service = {'name': line.split(':', 1)[1].strip()}
elif line.startswith('Service Description:'):
current_service['description'] = line.split(':', 1)[1].strip()
elif line.startswith('Service Provider:'):
current_service['provider'] = line.split(':', 1)[1].strip()
elif 'Protocol Descriptor' in line:
current_service['protocol'] = line
if current_service:
services.append(current_service)
bt_services[target_mac] = services
return jsonify({
'status': 'success',
'mac': target_mac,
'services': services
})
except subprocess.TimeoutExpired:
return jsonify({'status': 'error', 'message': 'Connection timed out'})
except FileNotFoundError:
return jsonify({'status': 'error', 'message': 'sdptool not found'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/bt/ping', methods=['POST'])
def ping_bt_device():
"""Ping a Bluetooth device using l2ping."""
data = request.json
target_mac = data.get('mac')
count = data.get('count', 5)
if not target_mac:
return jsonify({'status': 'error', 'message': 'Target MAC required'})
# Validate MAC address
if not is_valid_mac(target_mac):
return jsonify({'status': 'error', 'message': 'Invalid MAC address format'})
# Validate count
try:
count = int(count)
if count < 1 or count > 50:
count = 5
except (ValueError, TypeError):
count = 5
try:
result = subprocess.run(
['l2ping', '-c', str(count), target_mac],
capture_output=True, text=True, timeout=30
)
return jsonify({
'status': 'success',
'output': result.stdout,
'reachable': result.returncode == 0
})
except subprocess.TimeoutExpired:
return jsonify({'status': 'error', 'message': 'Ping timed out'})
except FileNotFoundError:
return jsonify({'status': 'error', 'message': 'l2ping not found'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/bt/dos', methods=['POST'])
def dos_bt_device():
"""Flood ping a Bluetooth device (DoS test)."""
data = request.json
target_mac = data.get('mac')
count = data.get('count', 100)
size = data.get('size', 600)
if not target_mac:
return jsonify({'status': 'error', 'message': 'Target MAC required'})
# Validate MAC address
if not is_valid_mac(target_mac):
return jsonify({'status': 'error', 'message': 'Invalid MAC address format'})
# Validate count and size to prevent abuse
try:
count = int(count)
if count < 1 or count > 1000:
count = 100
except (ValueError, TypeError):
count = 100
try:
size = int(size)
if size < 1 or size > 1500:
size = 600
except (ValueError, TypeError):
size = 600
try:
# l2ping flood with large packets
result = subprocess.run(
['l2ping', '-c', str(count), '-s', str(size), '-f', target_mac],
capture_output=True, text=True, timeout=60
)
bt_queue.put({'type': 'info', 'text': f'DoS test complete on {target_mac}'})
return jsonify({
'status': 'success',
'output': result.stdout
})
except subprocess.TimeoutExpired:
return jsonify({'status': 'success', 'message': 'DoS test timed out (expected)'})
except FileNotFoundError:
return jsonify({'status': 'error', 'message': 'l2ping not found'})
except Exception as e:
return jsonify({'status': 'error', 'message': str(e)})
@app.route('/bt/devices')
def get_bt_devices():
"""Get current list of discovered Bluetooth devices."""
return jsonify({
'devices': list(bt_devices.values()),
'beacons': list(bt_beacons.values()),
'interface': bt_interface
})
@app.route('/bt/stream')
def stream_bt():
"""SSE stream for Bluetooth events."""
print("[BT Stream] Client connected")
def generate():
import json
print("[BT Stream] Generator started, waiting for queue...")
while True:
try:
msg = bt_queue.get(timeout=1)
print(f"[BT Stream] Got from queue: {msg.get('type')}")
if msg.get('type') == 'device':
print(f"[BT Stream] Sending device: {msg.get('mac')}")
yield f"data: {json.dumps(msg)}\n\n"
except queue.Empty:
yield f"data: {json.dumps({'type': 'keepalive'})}\n\n"
response = Response(generate(), mimetype='text/event-stream')
response.headers['Cache-Control'] = 'no-cache'
response.headers['X-Accel-Buffering'] = 'no'
response.headers['Connection'] = 'keep-alive'
return response
def main():
print("=" * 50)
print(" INTERCEPT // Signal Intelligence")
print(" POCSAG / FLEX / 433MHz / WiFi / Bluetooth")
print("=" * 50)
print()
print("Open http://localhost:5050 in your browser")
print()
print("Press Ctrl+C to stop")
print()
app.run(host='0.0.0.0', port=5050, debug=False, threaded=True)
if __name__ == '__main__':
main()