Spoof Toolkit v2.1

Professional-grade async Python network spoofing suite Interactive menu-driven UI · Full IPv4/IPv6 coverage · Responder-style poisoning Authorized security testing only — by amibhai

Disclaimer: This tool is for educational purposes and authorized security auditing only. The authors assume no liability and are not responsible for any misuse or damage caused by this program. Do not use this tool on networks you do not own or do not have explicit, written permission to test.

---

What's New in v2.1

Module	Description
attacks/deauth.py	802.11 Deauthentication — kick clients, capture WPA handshakes
attacks/beacon_flood.py	802.11 Beacon Flood — fake SSID storm
attacks/llmnr_nbt.py	LLMNR + NBT-NS + mDNS poisoning (Responder-style hash capture)
attacks/icmpv6_ra.py	ICMPv6 Router Advertisement spoof — IPv6 gateway hijack
attacks/ndp_spoof.py	IPv6 NDP Neighbor Advertisement poison — IPv6 ARP spoof
attacks/captive_portal.py	Captive portal (hotel/corporate/cafe/ISP templates)
attacks/wpad.py	WPAD proxy auto-config injection
core/platform_compat.py	macOS pf + Linux iptables + Windows netsh abstraction
Timing jitter	±N-second random delay on every packet burst for IDS evasion
GitHub Actions CI	pytest + mypy + coverage gate (≥80%) across Python 3.10–3.12
Docker	docker build + docker-compose up for portable deployment
pyproject.toml	Modern packaging, mypy strict config, ruff lint, coverage config

---

Features at a Glance

Feature	Details
Authorization	Rules-of-engagement scope file — live fire is refused for any out-of-scope or out-of-window target; no scope ⇒ dry-run only
Architecture	100% async Python 3.10+ — zero threading.Thread
UI	Animated 256-color banner + numbered menus + breadcrumbs
Dashboard	PRISM live 3-panel TUI (attack log / packet stats / credentials)
Logging	HMAC-SHA256-chained structlog audit trail (tamper-evident)
Reports	Auto-generated JSON + Markdown + HTML after every session
Languages	Auto-detect from LANG + manual switch (en, hi, ar, zh, fr, es)
Preflight	17-check system (scope, root, Python, deps, interfaces, terminal)
Cleanup	Always restores ARP/NDP tables, iptables/pf rules in finally
Platform	Linux (full) · macOS (pf backend) · Windows (Npcap, limited)

---

Rules of Engagement (Authorization & Scope Control)

Real engagements are defined by a signed scope. This toolkit enforces one in code: it will not transmit a single packet at a target that is not explicitly authorized, inside an open engagement window. This is the difference between a professional red-team instrument and an indiscriminate script.

How it works

• Declare the engagement once in a JSON (or YAML) scope file — see rules/engagement.example.json.
• Point the toolkit at it via the SPOOF_TOOLKIT_SCOPE environment variable.
• Every attack module calls Session.guard(...) before touching a target. A target outside the authorized ranges — or an engagement window that has closed — raises AuthorizationError and the attack is refused.
• No scope loaded ⇒ dry-run only. Packets are still crafted and validated (great for training, demos, and CI) but are never put on the wire.
• The authorization in force — including a SHA-256 fingerprint — is written into the HMAC-chained audit log and every session report, so the report proves exactly what was authorized.

# 1. Copy and edit the template with your engagement details + authorized targets
cp rules/engagement.example.json rules/my-engagement.json

# 2. Point the toolkit at it (enables live fire for in-scope targets only)
export SPOOF_TOOLKIT_SCOPE=rules/my-engagement.json

# 3. Verify it loaded and the window is open
sudo -E python3 spoof_toolkit.py --preflight

Scope file fields

Field	Meaning
engagement_id	required — unique engagement identifier
authorized_by	required — named party authorizing the test (SOW / ticket)
client, operator, contact, notes	engagement metadata for the audit trail
start, end	ISO-8601 window (UTC assumed if no offset); either bound may be omitted for open-ended
authorized_networks	IPv4/IPv6 CIDRs or bare hosts that may be targeted
authorized_macs / authorized_ssids / authorized_bssids	allowlists for L2 / wireless targeting
denied_networks / denied_macs	no-strike lists — always override the allowlists

Fail-closed by design: an empty allowlist authorizes nothing, and an in-range host on a denied_networks entry (e.g. a domain controller inside an otherwise-authorized /24) is refused.

Safe mode. session.safe_mode = True forces dry-run even with a valid scope loaded — use it to rehearse an engagement end-to-end without transmitting.

---

Attack Modules

Layer 2 / 3 (Ethernet · IP)

Module	File	Description
ARP Spoofing	attacks/arp_spoof.py	Cache poison — MitM, DoS, one-way, gateway-only
DNS Spoofing	attacks/dns_spoof.py	Response injection — selective, spoof-all, rules file, NXDOMAIN
Combined MitM	attacks/combined_mitm.py	Full ARP + DNS + credential capture (asyncio.TaskGroup)
SSL Strip	attacks/ssl_strip.py	Transparent HTTPS downgrade proxy (Linux/macOS)
Rogue DHCP	attacks/rogue_dhcp.py	Hijack default gateway via fake DHCP server (stealthy)
LLMNR/NBT-NS	attacks/llmnr_nbt.py	NEW — LLMNR + NBT-NS + mDNS poisoning, NTLMv2 hash capture
WPAD	attacks/wpad.py	NEW — Browser proxy auto-config injection
Captive Portal	attacks/captive_portal.py	NEW — Fake login page with 4 templates

802.11 Wireless

Module	File	Description
Deauth	attacks/deauth.py	NEW — 802.11 deauthentication (targeted + broadcast), WPA handshake capture
Beacon Flood	attacks/beacon_flood.py	NEW — Flood airwaves with hundreds of fake SSIDs
AP Scanner	attacks/deauth.py	NEW — Passive 802.11 beacon scanner
Client Scanner	attacks/deauth.py	NEW — Detect clients associated with an AP

IPv6

Module	File	Description
RA Spoof	attacks/icmpv6_ra.py	NEW — ICMPv6 Router Advertisement (default gateway hijack)
NDP Spoof	attacks/ndp_spoof.py	NEW — Neighbor Advertisement poison (IPv6 ARP equivalent)
Full IPv6 MitM	(combo)	NEW — RA + NDP + IPv6 forwarding for complete IPv6 intercept

---

Quick Start

# 1. Install
sudo bash install.sh

# 1b. Authorize an engagement (required for live fire — otherwise dry-run only)
cp rules/engagement.example.json rules/my-engagement.json   # then edit it
export SPOOF_TOOLKIT_SCOPE=rules/my-engagement.json

# 2. Run (interactive menu)
sudo -E spoof-toolkit

# 3. Or run directly
sudo python3 spoof_toolkit.py

# 4. Preflight check
sudo python3 spoof_toolkit.py --preflight

# 5. Launch PRISM dashboard directly
sudo python3 spoof_toolkit.py --prism

# 6. Docker (no install needed)
docker build -t spoof-toolkit .
docker run --rm -it --network host --cap-add NET_RAW --cap-add NET_ADMIN spoof-toolkit

---

Main Menu (v2.1)