diff --git a/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md b/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md new file mode 100644 index 0000000..6bf89e6 --- /dev/null +++ b/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md @@ -0,0 +1,112 @@ +# Attacks + Sync + Harness Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Ship a trustworthy Mark VIII: one-click Evil WPA/Open/Enterprise attacks, device-truth state sync with a pineapd health monitor, and an on-device MCP harness. + +**Architecture:** Extend the existing single-file `server.py` (pure-socket HTTP/JSON, no deps — the device python3 has no pip) with attack orchestration, a health-monitor thread, UCI-truth state reads, and a Streamable-HTTP MCP endpoint. Extend the vanilla-JS SPA (`www/js/views.js`, `app.js`) with an Attacks section and a Harness page. Tests are stdlib `unittest` with module-level monkeypatching (`tests/test_*.py`), run one module per process. + +**Tech Stack:** Python 3.11 (stdlib only), vanilla JS, UCI (`uci show/set`), daemon unix-socket API (`/tmp/api.sock`), `hak5cmd`/`_pineap`, `iw`, `logread`, `hcxpcapngtool` (on device), MCP Streamable HTTP (2025-06-18). + +## Global Constraints + +- No new Python deps; no pip; device python3-light-compatible (no urllib/http.server/sqlite3 stdlib). +- Truth = device state (UCI `/etc/config/wireless`, `/etc/config/pineapd`, `iw dev`, live pineapd socket), never UI cache. +- Attacks only against `` (authorized). No deauth blasts; band-aware inject only. +- SSID pool broadcast stays disabled (stock SIGSEGV bug). +- Writes must be verified by re-read before success is reported. +- Follow existing code style: `device_run()`, `daemon_sock_call()`, `_daemon_proxy()` helpers; `h()` DOM helper in views; routes registered with `ROUTER.add`. +- Tests: `python3 -m unittest tests.test_` (one module per process). + +## File Structure + +- `payload/user/remote_access/pager-webui/server.py` — all backend: attacks API, health monitor, truth reads, MCP endpoint. +- `payload/user/remote_access/pager-webui/www/js/views.js` — Attacks + Harness views. +- `payload/user/remote_access/pager-webui/www/js/app.js` — routes + side-menu items. +- `payload/user/remote_access/pager-webui/www/css/app.css` — small additions for launchers. +- `tests/test_attacks.py`, `tests/test_health.py`, `tests/test_mcp.py`, `tests/test_getap.py` — new tests. +- `scripts/harness_stdio.py` — optional stdio MCP wrapper for stdio-only agents. + +--- + +### Task 1: Backend truth reads — `get_ap` dual-radio + enterprise + mode derivation + +**Files:** +- Modify: `payload/user/remote_access/pager-webui/server.py` (h_pineap_wifi_get_ap, h_pineap_mode_get) + +**Interfaces:** +- Produces: `GET /api/pineap/wifi/get_ap` → `{open: {...radio0...}, wpa: {...radio0...}, radio1_open: {...}, radio1_wpa: {...}, enterprise: {enabled, ssid, enctype, key}, pool: {...}, radios: {radio0: {band,channel,...}, radio1: {...}}}` +- Produces: `GET /api/pineap/mode` → mode derived from live state; never `"unknown"` when `pineap_disabled`/`autossidpool` readable. + +- [ ] **Step 1:** Rework `h_pineap_wifi_get_ap` to read all three AP pairs from UCI (wlan0open/wlan0wpa on radio0, wlan1open/wlan1wpa on radio1, wlan0ent enterprise) and return them as separate objects; include radio device info per radio. +- [ ] **Step 2:** Rework `h_pineap_mode_get`: derive mode = `advanced` if `autossidpool is False` or engine mismatch with preset; `passive`/`active` from stored preset ONLY when consistent with live `enabled`+`collect`+`advertise`; else `advanced` (never `unknown`). +- [ ] **Step 3:** Update `tests/test_pineap_modes.py` + new `tests/test_getap.py` for the new shapes; run all test modules; commit. + +### Task 2: Attack orchestration backend + +**Files:** +- Modify: `payload/user/remote_access/pager-webui/server.py` (new handlers + ROUTER.add) +- Test: `tests/test_attacks.py` + +**Interfaces:** +- `POST /api/attacks/deploy` body `{kind: 'wpa'|'open'|'enterprise', ...fields}` → applies UCI + daemon, returns `{ok, verified: bool, detail}` +- `POST /api/attacks/stop` body `{kind}` → disables AP(s), resumes hop, returns `{ok, verified}` +- `GET /api/attacks/status` → per-kind `{active, ssid, iface, channel, band, live (iw dev check), handshakes: n}` +- `GET /api/attacks/handshakes` (reuse `h_handshakes_get`), `GET /api/attacks/hc22000` → runs `hcxpcapngtool -o` on captured pcap(s) into `/root/loot/hc22000/` and returns download +- `POST /api/attacks/deauth` `{bssid, client, band}` → band-aware inject: 2.4 → `_pineap INTERFACE INJECT wlan0mon` then `PINEAPPLE_DEAUTH_CLIENT`; 5/6 → `wlan1mon` +- `POST /api/attacks/enterprise` toggles PineAPE (`pineape_disabled`, `pineape_auth_pass`) + +- [ ] **Step 1:** Write failing tests for deploy/stop/status/deauth (mock `device_run`, `daemon_sock_call`, `hak5`). +- [ ] **Step 2:** Implement handlers; verify tests pass; commit. + +### Task 3: Health monitor + stabilization + +**Files:** +- Modify: `payload/user/remote_access/pager-webui/server.py` (thread + helpers) +- Test: `tests/test_health.py` + +**Interfaces:** +- `health_check()` — `_pineap PING`; on failure twice in a row: count SIGSEGV in `logread`; if growing → `uci set pineapd.@ssidpool[0].disable=1`, restart pineapd; bring `wlan1mon` up (`ip link set wlan1mon up`) if `iw dev` shows it down; only one fix action per interval (cooldown 20s). +- `start_health_monitor()` — daemon thread every 15s, started on server boot. +- `GET /api/health` → `{pineap: 'up'|'down', sigsegv_count, pool_disabled, wlan1mon_up, last_action, fixes: n}` + +- [ ] **Step 1:** Failing tests for health logic (mock `device_run`, `hak5`). +- [ ] **Step 2:** Implement; verify on-device that SIGSEGV count stops climbing; commit. + +### Task 4: Attacks UI + +**Files:** +- Modify: `www/js/views.js` (3 launchers + shared shell), `www/js/app.js` (routes + menu), `www/css/app.css` + +**Interfaces:** +- Menu: `Attacks` (icon `attack`) → `#/attacks` with tabs `#/attacks/wpa`, `#/attacks/open`, `#/attacks/enterprise`. +- Each launcher: fields + Deploy/Stop + status card (live from `/api/attacks/status`) + handshake/cred table + export buttons + deauth table of target clients. + +- [ ] **Step 1:** Implement shared launcher shell + Evil WPA page (deploy/stop/status/export/deauth). +- [ ] **Step 2:** Evil Open page; Evil Enterprise page (creds table + clear + toggles). +- [ ] **Step 3:** Wire routes + menu; manual browser smoke test against device; commit. + +### Task 5: MCP harness server + Harness UI + +**Files:** +- Modify: `payload/user/remote_access/pager-webui/server.py` (`/mcp` endpoint) +- Create: `scripts/harness_stdio.py` +- Modify: `www/js/views.js`, `www/js/app.js` (Harness page) + +**Interfaces:** +- `POST /mcp` — Streamable HTTP MCP: `initialize`, `notifications/initialized` (202), `tools/list`, `tools/call`, `resources/list`, `resources/read`, `prompts/list`, `prompts/get`; JSON responses; session cookie auth + Origin validation. +- Tools wrap Task 1/2 endpoints + `recon.query` (sqlite3 CLI read-only) + `loot.*`. +- Resources: recon tables, handshake files, skill markdown (bundled copies of pineapple-control/wifi-deauth/aircrack-suite), loot listing. +- Prompts: `evil-wpa-playbook`, `evil-enterprise-playbook`, `recon-playbook`. +- `GET /api/harness/capabilities` → human-readable capability doc for the UI page. + +- [ ] **Step 1:** Failing tests for MCP JSON-RPC dispatch (`tests/test_mcp.py`). +- [ ] **Step 2:** Implement `/mcp` + capabilities endpoint; tests pass; commit. +- [ ] **Step 3:** Harness UI page (endpoint info, config snippets, capability explorer, pi.dev prompt generator); commit. + +### Task 6: Deploy + on-device verification + +- [ ] **Step 1:** Run full test suite locally (each module separately). +- [ ] **Step 2:** Deploy via `./scripts/deploy.sh --password ''`. +- [ ] **Step 3:** On-device smoke: login, status, health endpoint, attacks deploy/stop round-trip (Evil WPA on 2.4GHz with `` SSID — no deauth), enterprise deploy/stop, MCP `initialize`+`tools/list` via curl. +- [ ] **Step 4:** Leave device in clean state (no active attacks, hop resumed, pool disabled, wlan1mon up).