Wireless Network Security Analyzer | Nebula Forge Detection Suite v2
WifiForge passively scans wireless networks, assesses security posture, detects deauth attacks and rogue configurations, maps findings to MITRE ATT&CK techniques, and exports results to the Nebula Forge LogNorm pipeline.
WifiForge upgrades passive WiFi scanning from raw packet capture to structured security intelligence. Every detected network is assessed for vulnerabilities — open encryption, WEP, WPS exposure, deauth activity, hidden SSIDs — and mapped to ATT&CK techniques for downstream detection workflows.
- Passive scanning — 802.11 beacon frame capture via Scapy, no active probing
- Encryption detection — WEP, WPA, WPA2, WPA3, Open — parsed from beacon RSN/vendor IEs
- Deauth detection — flags networks receiving deauth frames (active attack indicator)
- WPS detection — identifies WPS-enabled networks vulnerable to brute force
- Hidden SSID detection — flags networks broadcasting empty SSIDs
- MITRE ATT&CK mapping — per-finding technique tags (T1040, T1110, T1499, T1583)
- Severity scoring — CRITICAL / HIGH / MEDIUM / LOW per network
- LogNorm export — ECS-lite NDJSON for the Nebula Forge normalization pipeline
- Mock mode — runs without hardware for UI testing and demos
- Dark UI — Nebula Forge dark theme, consistent with the full suite
WifiForge is part of Nebula Forge — an open-source SOC platform covering the full detection engineering workflow.
| Tool | Port | Role |
|---|---|---|
| LogNorm | 5006 | Log normalization (ECS-lite) |
| HuntForge | 5007 | ATT&CK hunt playbook generation |
| DriftWatch | 5008 | Sigma rule drift analysis |
| ClusterIQ | 5009 | Alert clustering and triage |
| AtomicLoop | 5011 | Atomic Red Team test runner |
| VulnForge | 5012 | Vulnerability & exploit intelligence |
| WifiForge | 5013 | Wireless network security analysis |
git clone https://github.com/Rootless-Ghost/WifiForge.git
cd WifiForge
pip install -r requirements.txtPlatform requirements:
- Linux: Run as root or with
CAP_NET_RAW. Put interface in monitor mode first:sudo airmon-ng start wlan0 - Windows: Install Npcap before running
- macOS: Run as root
sudo python app.py # Linux/macOS
python app.py # Windows (as Administrator)Access at http://localhost:5013
This tool runs as a containerized service in the Nebula Forge suite. The recommended way to start everything together:
# From the Nebula-Forge repo root
cp .env.example .env # add secrets (NVD_API_KEY, ATOMICLOOP_API_KEY, POSTGRES_PASSWORD — all required)
docker compose up -d # starts all services including wififorgeAccess:http://localhost:5013
Standalone container:
docker build -t wififorge .
docker run -p 5013:5013 \
wififorge- Select wireless interface from dropdown
- Set scan duration (default 60 seconds)
- Click Start Scan
- Monitor live network discovery in real time
- Click View Results when scan completes
- Export findings to LogNorm NDJSON
No wireless hardware required for testing. If no interface is available, WifiForge loads a mock dataset of 3 networks demonstrating CRITICAL, HIGH, and MEDIUM severity findings.
| Finding | Technique | Tactic |
|---|---|---|
| Open/WEP network | T1040 — Network Sniffing | Discovery |
| WPS enabled | T1110 — Brute Force | Credential Access |
| Deauth frames detected | T1499 — Endpoint Denial of Service | Impact |
| Hidden SSID | T1583 — Acquire Infrastructure | Resource Development |
{
"event.kind": "alert",
"event.category": "network",
"network.ssid": "TargetNetwork",
"network.bssid": "AA:BB:CC:DD:EE:FF",
"network.channel": 6,
"network.encryption": "WEP",
"network.wps_enabled": true,
"vulnerability.severity": "CRITICAL",
"threat.technique.id": "T1040",
"threat.technique.name": "Network Sniffing",
"source.tool": "WifiForge",
"@timestamp": "2026-04-15T00:00:00Z"
}- Python 3.10+
flask,scapy,python-dotenv- Npcap (Windows) or root privileges (Linux/macOS)
- Wireless interface with monitor mode support (optional — mock mode available)
WifiForge is intended for authorized security testing of networks you own or have explicit written permission to test. Passive scanning may still be regulated in some jurisdictions. Unauthorized wireless scanning may violate laws and regulations.
- WPA3 security assessment
This project is licensed under the MIT License — see the LICENSE file for details.
Built by Rootless-Ghost