AhmadHassan-BTed/SilentSniffer

Most internet users assume that unless they explicitly click "Allow" on a browser permission prompt, their session remains private and contained. In reality, standard Web APIs grant websites extensive access to hardware characteristics, timing vectors, network topologies, and sensor behaviors silently under the hood.

SilentSniffer was created as an educational eye-opener. By running diagnostic and demonstration modules in a completely safe, local-only sandbox environment, users can visually grasp the true surface area of web exposure permitted by modern browsers—without any risk of data leaving their device.

The toolkit is built on a Zero-Coupling Dynamic Plugin Architecture. The core engine remains entirely agnostic of individual module logic, discovering and loading tools at runtime via a centralized manifest.

graph TD
    A[index.html / debug.html] -->|Bootstrap| B[src/core/engine.js]
    B -->|Fetch Discovery| C[src/config/modules.json]
    C -->|Return Payload Paths| B
    B -->|Dynamic import| D[src/modules/level_X/*.js]
    D -->|Self-Register| B
    B -->|Render Grid| UI[Dynamic Command Center]

• 0% Coupling: Core engine logic and diagnostic payloads remain decoupled.
• 100% Cohesion: Each module is a self-contained unit with its own metadata and execution logic.
• Local Sandbox Guarantee: All processing occurs strictly within the local client DOM/IndexedDB environment—no external data transmission.

Tools are categorized into six distinct levels, reflecting the severity of information exposure.

This framework is maintained strictly for educational research, awareness, and browser capability auditing. All 54 modules across Levels 1 through 6 run strictly within your browser. Remote exfiltration servers and malicious payloads are excluded; all captured metrics and visual feedback remain strictly local to your machine.

📖 Detailed Technical Specification: For a complete list of excluded offensive function signatures, vectors, and their safe diagnostic replacements, view the Excluded Vectors Specification Document.

All UI components, registration manifests, core infrastructure engines (transmitter.js, persistence.js, evasion.js), and 54 diagnostic modules are 100% complete and operational in a sandboxed capacity:

All diagnostic queries execute strictly in the local browser context and store execution data in an isolated local IndexedDB (SilentSnifferAuditLogDB). No data ever leaves the user's browser.

When a module is executed, it follows a strict lifecycle from initialization to local rendering.

sequenceDiagram
    participant U as UI (Command Center)
    participant E as Engine.js
    participant M as Module.js
    participant API as Browser Web API

    U->>E: User triggers Execution
    E->>E: Initializing Sequence
    E->>M: run() async
    M->>API: Native Web API Probe / Inspection
    API-->>M: Local Diagnostic State
    M-->>E: Structured Payload
    E->>U: Render to Local Terminal UI

SilentSniffer/
├── src/
│   ├── core/
│   │   ├── engine.js         # Framework Orchestrator
│   │   └── transmitter.js    # Data Storage & Audit Logger
│   ├── config/
│   │   └── modules.json      # Discovery Manifest
│   ├── modules/              # Diagnostic & Awareness Modules
│   │   ├── level1/           # Standard Recon
│   │   ├── level2/           # Fingerprinting
│   │   ├── level3/           # Intelligence
│   │   ├── level4/           # Bypass Lab
│   │   ├── level5/           # Advanced Vectors
│   │   └── level6/           # Social Engineering & Media
│   └── styles/               # Global Design System
├── debug.html                # Command & Diagnostic Center
└── index.html                # Dashboard Interface

Every module adheres to a unified interface to ensure clean execution within the dynamic sandbox.

/**
 * SilentSniffer Module Template
 */
export default {
    id: 'unique_identifier',
    title: 'Display_Name',
    level: 4, // Level 1-6
    info: "Description of the browser capability or security exposure.",
    steps: [
        "Phase 1 Recon...",
        "Phase 2 Local Probe...",
        "Phase 3 State Analysis..."
    ],
    run: async () => {
        // Local diagnostic logic
        return { data: 'captured_intel' };
    }
};

The repository is maintained with a focus on web security education and research. Contributors are welcome to expand the toolkit by implementing new browser capability auditors.

1. Draft: Implement the diagnostic module using the standard template.
2. Locate: Place the script in the corresponding src/modules/levelX/ folder.
3. Register: Add the file path to src/config/modules.json.
4. Verify: Open debug.html to confirm the tool is automatically rendered and functional.