From 3c306e24780353b7264e96cb062be58c294de1f6 Mon Sep 17 00:00:00 2001 From: c4ch3c4d3 Date: Wed, 19 Aug 2026 08:21:28 -0500 Subject: [PATCH] chore: bump version to 1.2; scrub personal details from docs - Version 1.1 -> 1.2 in the hak5 manifest and MCP serverInfo. - Removed leaked personal details from process docs: device root password, the user's personal iPhone SSID (authorized-test target), the local /Users/... checkout path, and the device IP where it appeared alongside the password. Replaced with , , , and placeholders. --- .../plans/2026-08-18-attacks-sync-harness.md | 6 +++--- .../plans/2026-08-19-encryption-card-redesign.md | 10 +++++----- .../specs/2026-08-18-attacks-sync-harness-design.md | 2 +- .../user/remote_access/pager-webui/_hak5_manifest.json | 2 +- payload/user/remote_access/pager-webui/server.py | 2 +- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md b/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md index 77d7357..6bf89e6 100644 --- a/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md +++ b/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md @@ -12,7 +12,7 @@ - No new Python deps; no pip; device python3-light-compatible (no urllib/http.server/sqlite3 stdlib). - Truth = device state (UCI `/etc/config/wireless`, `/etc/config/pineapd`, `iw dev`, live pineapd socket), never UI cache. -- Attacks only against `Zuccaro_iPhone_15` (authorized). No deauth blasts; band-aware inject only. +- Attacks only against `` (authorized). No deauth blasts; band-aware inject only. - SSID pool broadcast stays disabled (stock SIGSEGV bug). - Writes must be verified by re-read before success is reported. - Follow existing code style: `device_run()`, `daemon_sock_call()`, `_daemon_proxy()` helpers; `h()` DOM helper in views; routes registered with `ROUTER.add`. @@ -107,6 +107,6 @@ ### Task 6: Deploy + on-device verification - [ ] **Step 1:** Run full test suite locally (each module separately). -- [ ] **Step 2:** Deploy via `./scripts/deploy.sh --password 'Bryce9205'`. -- [ ] **Step 3:** On-device smoke: login, status, health endpoint, attacks deploy/stop round-trip (Evil WPA on 2.4GHz with `Zuccaro_iPhone_15` SSID — no deauth), enterprise deploy/stop, MCP `initialize`+`tools/list` via curl. +- [ ] **Step 2:** Deploy via `./scripts/deploy.sh --password ''`. +- [ ] **Step 3:** On-device smoke: login, status, health endpoint, attacks deploy/stop round-trip (Evil WPA on 2.4GHz with `` SSID — no deauth), enterprise deploy/stop, MCP `initialize`+`tools/list` via curl. - [ ] **Step 4:** Leave device in clean state (no active attacks, hop resumed, pool disabled, wlan1mon up). diff --git a/docs/superpowers/plans/2026-08-19-encryption-card-redesign.md b/docs/superpowers/plans/2026-08-19-encryption-card-redesign.md index 83ec694..6fb5a9a 100644 --- a/docs/superpowers/plans/2026-08-19-encryption-card-redesign.md +++ b/docs/superpowers/plans/2026-08-19-encryption-card-redesign.md @@ -6,7 +6,7 @@ **Architecture:** Single-file client-side change: the recon view in `views.js` drops the `encValue`/`encSub` text nodes, draws the doughnut with `legend:false` and a taller height, and populates a new HTML legend container from the existing `encCounts` bucket map. `chart.js`'s `MiniChart.doughnut` is unchanged (its canvas `legend` option is simply no longer used by the enc card). CSS adds flex-wrap legend styles. -**Tech Stack:** Vanilla JS (no framework), canvas via `MiniChart.doughnut` in `chart.js`, plain CSS in `app.css`. Device deploy via `scripts/deploy.sh --password 'Bryce9205'`. Tests: none exist for the frontend; verification is via the deployed device + backend test suite (must stay green). +**Tech Stack:** Vanilla JS (no framework), canvas via `MiniChart.doughnut` in `chart.js`, plain CSS in `app.css`. Device deploy via `scripts/deploy.sh --password ''`. Tests: none exist for the frontend; verification is via the deployed device + backend test suite (must stay green). ## Global Constraints @@ -156,17 +156,17 @@ Expected: exit 0, no output. - [ ] **Step 6: Run the backend test suite** -Run: `cd /Users/bzuccaro/Documents/AI/Mark-VIII && python3 -m pytest tests/ -q 2>&1 | tail -3` +Run: `cd && python3 -m pytest tests/ -q 2>&1 | tail -3` Expected: `291 passed` (or the current passing count) — no regressions from unrelated files. - [ ] **Step 7: Deploy to the device** -Run: `cd /Users/bzuccaro/Documents/AI/Mark-VIII && ./scripts/deploy.sh --password 'Bryce9205'` +Run: `cd && ./scripts/deploy.sh --password ''` Expected: deploy completes with `EXTRACT_OK` / success output. - [ ] **Step 8: Verify the enc card on the device** -Recreate the CDP venv if absent (`python3 -m venv /tmp/cdpenv2 && /tmp/cdpenv2/bin/pip install -q websocket-client`), then drive headless Chrome against http://172.16.52.1:8080 (login `Bryce9205`, go to `#/recon`, wait ~20s) and assert: +Recreate the CDP venv if absent (`python3 -m venv /tmp/cdpenv2 && /tmp/cdpenv2/bin/pip install -q websocket-client`), then drive headless Chrome against http://:8080 (login ``, go to `#/recon`, wait ~20s) and assert: 1. `document.getElementById('recon-encryption')` canvas has non-zero `width` attribute and the card is visible (not `.hidden`). 2. `document.getElementById('recon-enc-legend')` contains entries whose text matches `/WPA2/` and `/\d+/`, and no `recon-card-value` element exists inside the enc card. 3. Zero `Runtime.exceptionThrown` events. @@ -175,5 +175,5 @@ Expected: all three pass; screenshots unavailable, text-state assertions only. - [ ] **Step 9: Commit** ```bash -cd /Users/bzuccaro/Documents/AI/Mark-VIII && git add payload/user/remote_access/pager-webui/www/js/views.js payload/user/remote_access/pager-webui/www/css/app.css && git commit -m "ui: encryption landscape card — ring + HTML legend with counts" +cd && git add payload/user/remote_access/pager-webui/www/js/views.js payload/user/remote_access/pager-webui/www/css/app.css && git commit -m "ui: encryption landscape card — ring + HTML legend with counts" ``` diff --git a/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md b/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md index d49d5e2..133da72 100644 --- a/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md +++ b/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md @@ -93,7 +93,7 @@ Stop button, and a post-write poll (UCI + `iw dev`) before success toast. ## Constraints -- Authorized target: `Zuccaro_iPhone_15` only (intermittent). Non-client +- Authorized target: `` only (intermittent). Non-client environment; no deauth blasts; verify on-wire via monitor capture when needed. - SSID pool stays disabled (stock bug; re-enabling re-crashes pineapd). diff --git a/payload/user/remote_access/pager-webui/_hak5_manifest.json b/payload/user/remote_access/pager-webui/_hak5_manifest.json index f760ade..90578e8 100644 --- a/payload/user/remote_access/pager-webui/_hak5_manifest.json +++ b/payload/user/remote_access/pager-webui/_hak5_manifest.json @@ -8,7 +8,7 @@ "title": "Mark VIII", "author": "c4ch3c4d3", "description": "Mark VII-style web management UI for the WiFi Pineapple Pager", - "version": "1.1", + "version": "1.2", "category": "remote_access", "tags": ["remote-access", "web-interface", "device-management", "pineap"], "firmware": "Pineapple Pager 24.10.1" diff --git a/payload/user/remote_access/pager-webui/server.py b/payload/user/remote_access/pager-webui/server.py index e1173b4..feac7a0 100644 --- a/payload/user/remote_access/pager-webui/server.py +++ b/payload/user/remote_access/pager-webui/server.py @@ -3953,7 +3953,7 @@ def _mcp_dispatch(msg): 'resources': {'listChanged': False, 'subscribe': False}, 'prompts': {'listChanged': False}, }, - 'serverInfo': {'name': 'mark-viii', 'version': '1.1'}}} + 'serverInfo': {'name': 'mark-viii', 'version': '1.2'}}} if method == 'notifications/initialized': return 202, None if method == 'ping':