An active cyber defense & honeypot system for OpenWrt routers running from a USB drive.
# WiFi-SpiderWeb V2.0 — OpenWrt Active Cyber Defense & Honeypot Ecosystem
> **Dynamic Wi-Fi Deauthentication Detector, Active Countermeasures Engine & Real-Time Web Dashboard with RSSI Triangulation Radar.**
> Designed for low-resource OpenWrt routers running completely from USB ExtRoot.
---
## 🏗️ Advanced Architecture
The system operates using a multi-threaded, low-overhead architecture designed to minimize CPU cycles on embedded hardware via kernel-side BPF filters and a thread-safe IPC infrastructure:
wlan0mon (Monitor Mode)
│
▼
[spider_core.py] ───► /tmp/spider_ipc.sock ───► [spider_attacker.py]
│ │
▼ (Kernel BPF Filter) ├─► Tarpit Engine (Freeze Tools)
[IPCSocketReader] ├─► Captive Portal Trap
│ └─► Hardware Ban (iptables)
▼
[spider_web.py] (Lightweight ThreadingTCPServer on :8080)
│
▼ (Server-Sent Events - SSE Stream)
[index.html Dashboard] ───► Real-Time Radar Sweep & Attacker Profiles Map
---
## ⚡ Feature Summary
| Feature | Details |
|---|---|
| **Core Protocol** | IEEE 802.11 Deauth/Disassoc detection via Scapy (`store=False` zero packet buffering). |
| **Web Dashboard** | 66 KB self-contained UI utilizing Tailwind CSS & Vanilla JS (Zero external heavy frameworks). |
| **Radar Triangulation** | Real-time `requestAnimationFrame` canvas mapping attacker proximity based on RSSI values. |
| **Offensive Tarpit** | Raw socket flood loop designed to freeze stream dissection tables in Wireshark, Nmap, and Masscan. |
| **Captive Portal Trap** | ThreadingTCPServer serving fake firmware update page to extract WebRTC IP leaks and system fingerprints. |
| **Automated Deployment**| POSIX-compliant `usb_autorun.sh` with a built-in process watchdog daemon for auto-recovery. |
---
## 🚀 Quick Start (Plug & Play via USB)
1. Format your USB flash drive to **ext4** and ensure ExtRoot is configured on your OpenWrt device.
2. Drop all project files (`spider_core.py`, `spider_attacker.py`, `spider_web.py`, `index.html`, and `usb_autorun.sh`) into the root directory of your USB.
3. Plug the USB into the router.
4. Access your router via SSH and run the hotplug installer:
```sh
sh usb_autorun.sh --install-hotplug
python3 spider_web.py --patch-core
python3 spider_web.py --patch-html
python3 spider_web.py --port 8080
http://YOUR_ROUTER_IP:8080 to access the live dashboard. Click "Activate Spider-Web Defense" to launch the automated daemon pool.The internal micro-server handles state replication across the following lightweight endpoints:
GET / : Serves the self-contained monitoring UI.GET /api/status : Returns current system CPU/RAM and process health metrics.GET /api/alerts : Persistent Server-Sent Events (SSE) pipe streaming telemetry on incoming bursts.POST /api/toggle : Starts/terminates background defense daemons cleanly.| Wireless Driver | Max Supported Virtual VAPs |
|---|---|
ath9k | 8 VAPs |
ath10k | 8–16 VAPs |
mt76 | 16 VAPs |
Note: If your hardware chipset stability degrades during high hostapd VAP allocation, adjust the HONEYPOT_VAP_COUNT variable inside spider_core.py to match your driver's maximum VAP constraints.
MIT — Free for personal, research, and defensive security auditing. Unauthorized packet capture and hardware manipulation may violate local cybercrime regulations (CFAA, GDPR, Computer Misuse Act). Always test inside authorized laboratory environments.