Topics

#browser-security #cybersecurity #de-anonymization #ethical-hacking #ethical-hacking-tool #fingerprinting #forensics #intelligence-gathering #javascript #osint #penetration-testing #red-team #security-research #toolkit #vulnerability-assessment

Language breakdown

JavaScript 91.5%

HTML 8.5%

▸ Files click to expand

README

SilentSniffer

Educational Research & Web Security Diagnostic Sandbox

-9d00ff.svg?style=flat-square)

Engineered by Ahmad Hassan (B-Ted)

[!NOTE]

Browser Privacy & Awareness Notice: Modern web applications operate under the widespread assumption that browsing is inherently safe, private, and isolated by default. SilentSniffer is built to challenge this false sense of security. Operating strictly as a self-contained, client-side sandbox, zero data is exported or transmitted anywhere. Instead, it offers a real-time, visual demonstration of just how much ambient device state, hardware telemetry, and behavioral data can slip out of a user's control without explicit consent—simply because modern browser specifications permit it by default.

💡 The Philosophy Behind SilentSniffer

Most internet users assume that unless they explicitly click "Allow" on a browser permission prompt, their session remains private and contained. In reality, standard Web APIs grant websites extensive access to hardware characteristics, timing vectors, network topologies, and sensor behaviors silently under the hood.

SilentSniffer was created as an educational eye-opener. By running diagnostic and demonstration modules in a completely safe, local-only sandbox environment, users can visually grasp the true surface area of web exposure permitted by modern browsers—without any risk of data leaving their device.

🏗 Architecture Overview

The toolkit is built on a Zero-Coupling Dynamic Plugin Architecture. The core engine remains entirely agnostic of individual module logic, discovering and loading tools at runtime via a centralized manifest.

graph TD
    A[index.html / debug.html] -->|Bootstrap| B[src/core/engine.js]
    B -->|Fetch Discovery| C[src/config/modules.json]
    C -->|Return Payload Paths| B
    B -->|Dynamic import| D[src/modules/level_X/*.js]
    D -->|Self-Register| B
    B -->|Render Grid| UI[Dynamic Command Center]

Key Design Principles:

0% Coupling: Core engine logic and diagnostic payloads remain decoupled.
100% Cohesion: Each module is a self-contained unit with its own metadata and execution logic.
Local Sandbox Guarantee: All processing occurs strictly within the local client DOM/IndexedDB environment—no external data transmission.

⚡ Threat Escalation Hierarchy

Tools are categorized into six distinct levels, reflecting the severity of information exposure.

🔒 Security & Local Execution Scope

This framework is maintained strictly for educational research, awareness, and browser capability auditing. All 54 modules across Levels 1 through 6 run strictly within your browser. Remote exfiltration servers and malicious payloads are excluded; all captured metrics and visual feedback remain strictly local to your machine.

📖 Detailed Technical Specification: For a complete list of excluded offensive function signatures, vectors, and their safe diagnostic replacements, view the Excluded Vectors Specification Document.

Component Implementation Specification:

All UI components, registration manifests, core infrastructure engines (transmitter.js, persistence.js, evasion.js), and 54 diagnostic modules are 100% complete and operational in a sandboxed capacity:

All diagnostic queries execute strictly in the local browser context and store execution data in an isolated local IndexedDB (SilentSnifferAuditLogDB). No data ever leaves the user's browser.

🔄 System Workflow & Data Flow

When a module is executed, it follows a strict lifecycle from initialization to local rendering.

sequenceDiagram
    participant U as UI (Command Center)
    participant E as Engine.js
    participant M as Module.js
    participant API as Browser Web API
U->>E: User triggers Execution     E->>E: Initializing Sequence     E->>M: run() async     M->>API: Native Web API Probe / Inspection     API-->>M: Local Diagnostic State     M-->>E: Structured Payload     E->>U: Render to Local Terminal UI

📁 Repository Structure

SilentSniffer/
├── src/
│   ├── core/
│   │   ├── engine.js         # Framework Orchestrator
│   │   └── transmitter.js    # Data Storage & Audit Logger
│   ├── config/
│   │   └── modules.json      # Discovery Manifest
│   ├── modules/              # Diagnostic & Awareness Modules
│   │   ├── level1/           # Standard Recon
│   │   ├── level2/           # Fingerprinting
│   │   ├── level3/           # Intelligence
│   │   ├── level4/           # Bypass Lab
│   │   ├── level5/           # Advanced Vectors
│   │   └── level6/           # Social Engineering & Media
│   └── styles/               # Global Design System
├── debug.html                # Command & Diagnostic Center
└── index.html                # Dashboard Interface

🛠 Internal Module Structure

Every module adheres to a unified interface to ensure clean execution within the dynamic sandbox.

View Module Template (JavaScript)

/**
 * SilentSniffer Module Template
 */
export default {
    id: 'unique_identifier',
    title: 'Display_Name',
    level: 4, // Level 1-6
    info: "Description of the browser capability or security exposure.",
    steps: [
        "Phase 1 Recon...",
        "Phase 2 Local Probe...",
        "Phase 3 State Analysis..."
    ],
    run: async () => {
        // Local diagnostic logic
        return { data: 'captured_intel' };
    }
};

🤝 Development & Contribution

The repository is maintained with a focus on web security education and research. Contributors are welcome to expand the toolkit by implementing new browser capability auditors.

Draft: Implement the diagnostic module using the standard template.
Locate: Place the script in the corresponding src/modules/levelX/ folder.
Register: Add the file path to src/config/modules.json.
Verify: Open debug.html to confirm the tool is automatically rendered and functional.

_{Developed & Documented by Ahmad Hassan (B-Ted)}
^{Maintained for Cybersecurity Awareness, Web API Research & Education}

🔗 More in this category