Overview
The PiRogue is a Raspberry Pi-based network router that captures and analyzes network traffic in real time. It is the foundation of the PiRogue Tool Suite, and it can also run on a regular computer or a server.
Quick start
Turn a Debian 12 machine into a PiRogue and watch its dashboard light up.
Architecture
The PiRogue network router acts as a packet inspection system (PIS) that is used to detect potentially malicious network traffic of any device connected to its Wi-Fi access-point. It relies on the following components:
Installation
PiRogue supports three operating modes, depending on your needs. Pick the setup that matches your hardware below.
Dashboard
Your PiRogue runs a Grafana dashboard that shows, in near real time, the network connections of the connected devices and the security alerts raised by Suricata.
Capture network traffic
The dashboard shows the last 5 days of traffic. To keep the traffic for longer, or to open it in a tool like Wireshark, record it in a PCAP file.
Network traffic analysis
The PiRogue analyzes, continuously and automatically, the network traffic of every device connected to it. You do not have to start anything: the results appear in the dashboard within minutes.
Mobile app analysis
Encrypted traffic looks like noise from the outside. To see what a mobile app really sends, the PiRogue can instrument the app on a connected Android device: it records the network traffic, extracts the TLS keys and traces the cryptographic operations, even when the app uses certificate pinning.
Consensual device forensics
Consensual mobile device forensic analysis is the process of examining a mobile device with the owner's consent to identify signs of compromise or active spying. This involves analyzing data stored on the device, such as call logs, text messages, and browsing history, as well as examining installed apps and system configurations. The goal is to uncover any unauthorized access, surveillance activities, or malicious software that may be compromising the device's security and privacy.
Cheatsheet
Not sure which version you run? See Installation.
Useful commands
Find the IP address of your PiRogue
Version 1.x
1 artículo
Version 2.x
3 artículos
Advanced
7 artículos