Installation

python3.10 -m venv venv

source venv/bin/activate

pip install -r requirements.txt

System dependencies

Module	Linux	macOS	Windows
WiFi scan	nmcli or iwlist	airport (built-in)	netsh (built-in)
BT Classic	hcitool (bluez)
NFC	nfc-poll (libnfc-bin)
RF 433MHz	rtl_433 + RTL-SDR dongle
RFID Badge	proxmark3
Sniffer	airmon-ng (aircrack-ng)	limited
Deauth/Evil Twin	aircrack-ng + injection-capable card

---

Usage

Interactive menu

python main.py

Direct CLI

python main.py --wifi                          # WiFi scan + OUI lookup
python main.py --bt                            # Bluetooth scan
python main.py --nfc                           # NFC scan
python main.py --rf                            # RF/Badge scan
python main.py --all                           # all recon modules
python main.py --sniff --sniff-dur 60          # monitor mode sniffer
python main.py --update-oui                    # download full IEEE OUI database
python main.py --output recon_siteA.txt        # custom log file
python main.py --no-oui                        # disable OUI lookup

---

Modules

[1] WiFi Scan

Scans nearby WiFi networks. Auto-detects the OS and uses the appropriate system tool.

• Captures: SSID, BSSID, channel, RSSI, security (WPA/WPA2/WPA3), country code
• Enriches each BSSID with vendor name via OUI lookup

[2] Bluetooth Scan

• BLE via bleak (multi-platform, no root required)
• Classic via hcitool on Linux
• Captures: device name, MAC, RSSI, type

[3] NFC Scan

Reads NFC tags via USB reader (ACR122U, PN532, etc.).

• Uses nfcpy, falls back to nfc-poll (libnfc)
• Reads: tag type, ID, NDEF records

[4] RF / Badge Scan

• RF 315/433/868/915 MHz via rtl_433 (requires RTL-SDR dongle)
• RFID badges (125kHz HID/EM4100, 13.56MHz Mifare) via Proxmark3
• If no hardware is present, displays setup instructions

[6] WiFi Sniffer (monitor mode)

Captures raw WiFi packets in monitor mode using scapy.

• Requires root/sudo and a monitor-mode capable card
• Captures: Beacons, Probe Requests/Responses, data frames
• Automatic channel hopping across all 2.4GHz + 5GHz channels
• Optional .pcap file saving

sudo python main.py --sniff --sniff-dur 60 --save-pcap capture.pcap

[7] Deauth Attack

Sends 802.11 deauthentication packets toward an AP or specific client. Requires a WiFi card with injection mode (e.g. Alfa AWUS036ACH) and explicit double confirmation before execution.

# 1. Find your AP's BSSID
python main.py --wifi

# 2. Enable monitor mode (Linux)
sudo airmon-ng start wlan0

# 3. Run the deauth
sudo python main.py --deauth --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon --deauth-count 50

Parameter	Default	Description
--bssid	—	Target router MAC (required)
--client	FF:FF:FF:FF:FF:FF	Specific client MAC (broadcast = all devices)
--deauth-count	100	Number of packets to send
--continuous	off	Loop continuously until Ctrl+C
--iface	wlan0	Monitor mode interface

[8] Evil Twin

Creates a fake AP mimicking a legitimate SSID. Uses airbase-ng, falls back to hostapd. Requires injection-capable card and explicit double confirmation.

sudo python main.py --eviltwin --ssid "NetworkName" --channel 6 --bssid AA:BB:CC:DD:EE:FF --eviltwin-dur 120

[9] Report (HTML + JSON + TXT)

Automatically generated at the end of every session that captured data.

• TXT: raw timestamped log (always active)
• HTML: dark-theme report with tables, color-coded RSSI, security badges
• JSON: structured data for parsing or integration

Open the .html file in any browser to view the full report.

[u] Update OUI Database

Downloads the full IEEE vendor database (~30,000 entries) and saves it locally as oui_db.txt. Without this file, a built-in dictionary of the most common vendors is used.

python main.py --update-oui

---

Recommended Hardware

Module	Hardware	Approx.
WiFi scan	Built-in WiFi card	—
Bluetooth	Built-in BT adapter	—
NFC	ACR122U or PN532 USB reader
RF 433/868MHz	RTL-SDR dongle + antenna
RFID Badge	Proxmark3
Sniffer / Deauth / Evil Twin	Alfa AWUS036ACH or AWUS036NHA

---

Output Files

After each session you will find in the same folder:

rf_recon_TIMESTAMP.txt     ← raw log
rf_recon_TIMESTAMP.html    ← visual report (open in browser)
rf_recon_TIMESTAMP.json    ← structured data
capture.pcap               ← optional, sniffer only with --save-pcap
oui_db.txt                 ← optional, after --update-oui

---

Legal Disclaimer

This tool is intended exclusively for:

• Testing on networks and devices you own
• Red teaming engagements with explicit written authorization
• Educational purposes in controlled lab environments

Unauthorized use violates art. 615-ter of the Italian Penal Code and equivalent laws in other countries. Offensive modules (deauth, evil twin) require explicit double confirmation before execution.