HACKING PROJECT · wireless · Intermediate
Wi-Fi Probe-Request Logger
Passively collect and analyze 802.11 probe-request frames to produce device-presence and RF reconnaissance intelligence.
Mobile devices continuously broadcast 802.11 probe-request frames advertising the SSIDs they have previously joined, leaking user movement patterns, home/work network names, and device presence to anyone passively listening. Enterprises and venues have poor visibility into this unmanaged RF-layer data exfiltration, and physical-security teams cannot correlate device presence with authorized personnel. The gap is a lack of low-cost, privacy-aware passive telemetry that turns ambient probe traffic into actionable presence and reconnaissance intelligence.
**What you'll build**
Build a monitor-mode capture pipeline that ingests probe requests, extracts source MAC (handling MAC randomization), directed SSID lists, signal strength (RSSI), and timestamps, then normalizes them into a time-series store with dashboards for device tracking, dwell-time analytics, and randomization detection. Layer in OUI vendor lookup, randomized-vs-global MAC classification, and configurable retention with hashing to keep the tool privacy-respecting and defensible under policy.
**Objective** — Passively collect and analyze 802.11 probe-request frames to produce device-presence and RF reconnaissance intelligence.
**Expected outcome** — A working monitor-mode logger with a time-series database and dashboard that classifies devices, resolves vendor OUIs, detects MAC randomization, and reports SSID leakage.
**Difficulty** — Intermediate — requires monitor-mode drivers, 802.11 frame parsing, and privacy handling, but no active injection or crypto attacks.
**Primary category** — Wireless Security / Reconnaissance; Secondary = Threat Hunting, OSINT, Physical Security Monitoring
**Security domains** — Primary = Security Research; Secondary = Red Team, Blue Team, Threat Intelligence, Digital Forensics
**Technical focus** — 802.11 management frames, monitor mode, MAC randomization analysis, RSSI/trilateration, OUI fingerprinting, RF telemetry, time-series analytics, presence detection, privacy engineering
**Core technologies** — Languages: Python, Bash; Frameworks/Libraries: Scapy, dpkt, pandas; Security Tools: aircrack-ng (airodump-ng), Wireshark/tshark, Kismet; Cloud/Infra: Raspberry Pi with external Wi-Fi adapter (Atheros/Ralink monitor-capable), Docker; AI/Data: scikit-learn (clustering for device fingerprinting), Grafana; Databases: InfluxDB/TimescaleDB, SQLite
**Where it's valued** — Retail analytics, physical/corporate security, smart venues and stadiums, law enforcement/forensics, red-team consultancies
**Careers it builds toward** — Wireless Security Engineer, Red Team Operator, Security Researcher, Threat Intelligence Analyst, RF/SIGINT Analyst
**Framework alignment**
• MITRE ATT&CK: Reconnaissance TA0043 — Gather Victim Host Information T1592, Gather Victim Identity Information T1589; ATT&CK for Mobile — Network Service Scanning / device discovery via RF passive collection (map as passive recon tactic)
• NIST CSF 2.0: Identify (asset/device discovery), Detect (anomalous device presence); supports Govern for privacy policy
• OWASP: N/A (non-web); relates to MASVS-PRIVACY concepts for mobile data leakage
• CIS Controls v8: Control 1 (Inventory of Enterprise Assets), Control 12 (Network Infrastructure Management), Control 13 (Network Monitoring and Defense)
**Innovation** — Improved Existing Solution — probe logging exists (Kismet, Wigle), but privacy-aware randomization classification and presence analytics add value. Scores: Innovation 5/10, Startup 5/10, Enterprise-Readiness 4/10, Patent = No.