mirror of
https://github.com/jokob-sk/NetAlertX.git
synced 2026-10-02 02:35:05 -04:00
Mauricio CamayoandClaude Sonnet 5
d0a3a5416b
Periodic iw-scan-based detection of the 6 heuristics that don't need monitor-mode hardware (see issue #1789): pwnagotchi/Pineapple signatures, evil-twin/open clones, baseline-AP-absent-with-clone, security downgrades, and duplicate-SSID/different-vendor - all evaluated against a user-curated trusted-AP baseline (WIFICANARY_trusted_aps). A detection creates a flagged Devices entry even for BSSIDs that never associate, per the addendum on the same issue. - WIFICANARY_TRUSTED_SECURITY is multi-select: an observed encryption exactly matching any selected value is accepted; otherwise it's flagged if weaker than the strongest selected value (deliberate - comparing against the weakest would make multi-select pointless, since anything at/above the weakest would silently pass regardless of the rest of the selection). - Added a "known device turned rogue" motor: escalate_known_devices() cross-references each detection's BSSID against the Devices table via the new DeviceInstance.getAllByMacs(). This covers the BSSID-identity half of the issue #1789 addendum's motor 10; the deauth/probe-source-MAC half still needs monitor-mode data this plugin doesn't have. - Vendor is deliberately not looked up by this plugin - any device it creates gets devVendor filled in for free by core's own vendor_update plugin on its next pass. 43 wificanary unit tests + 10 DeviceInstance.getAllByMacs() tests, all test_plugin_conventions.py checks pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011meLPKCzVpdZyAUfv5U6mm
NetAlertX modules
The original pilaert.py code is now moved to this new folder and split into different modules.
| Module | Description |
|---|---|
__main__.py |
The MAIN program of NetAlertX |
__init__.py |
an empty init file |
README.md |
this readme file |
../server/plugins |
a folder containing all plugins that publish notifications or scan for devices |
api.py |
updating the API endpoints with the relevant data. |
appevent.py |
TBC |
const.py |
A place to define the constants for NetAlertX like log path or config path. |
conf.py |
conf.py holds the configuration variables and makes them available for all modules. It is also the workaround for global variables that need to be resolved at some point |
database.py |
This module connects to the DB, makes sure the DB is up to date and defines some standard queries and interfaces. |
device.py |
The device module looks after the devices and saves the scan results into the devices |
flows.py |
TBC |
helper.py |
Helper as the name suggest contains multiple little functions and methods used in many of the other modules and helps keep things clean |
initialise.py |
Initiatlise sets up the environment and makes everything ready to go |
logger.py |
Logger is there the keep all the logs organised and looking identical. |
networscan.py |
Networkscan collects the scan results (maybe to merge with reporting.py) |
notification.py |
Creates and handles the notification object and generates ther HTML and text variants of the message |
plugin.py |
This is where the plugins get integrated into the backend of NetAlertX |
plugin_utils.py |
Helper utilities for plugin.py |
reporting.py |
Reporting collects the data for the notification reports |
scheduler.py |
All things scheduling |