[Open-Source] WiFi-SpiderWeb: Turn any OpenWrt Router into an Active Cyber Defense & Honeypot System via USB 🕷️🔥
Source Reddit Cybersecurity
Discussion
WiFi-SpiderWeb is an open-source active cyber defense and honeypot system designed for OpenWrt routers. It detects Wi-Fi deauthentication and disassociation attacks by monitoring wireless traffic and triggers active countermeasures when an attack threshold is met. The system deploys virtual honeypots with fake SSIDs, blocks attacker MAC addresses at the kernel level, and floods attackers with junk packets to stall their scanning tools. It is intended for use on low-resource OpenWrt routers with USB storage and supports multiple wireless chipsets. The tool is designed for defensive security and requires explicit authorization for use. No known exploits in the wild or vendor patches are applicable as this is a defensive tool rather than a vulnerability.
r/cybersecurity (opens in a new tab)u/Badriix0 points0 comments
[Technical Breakdown] Building an Active Cyber Defense & Honeypot Daemon for OpenWrt via USB
Hey everyone,
I've been working on a lightweight technical concept to handle Wi-Fi Deauthentication attacks on low-resource hardware (specifically OpenWrt routers running on embedded architectures like MIPS/ARM).
I wanted to shift the defense from passive logging to active countermeasures, so I designed a dual-engine workflow:
- Handling Low Resources: Using Python with Scapy, but setting store=False and utilizing kernel-side BPF filters so packet capturing doesn't overflow the router's limited RAM.
- The Defense Loop: When a burst threshold is met, the system dynamically communicates via a thread-safe IPC UNIX socket (/tmp/spider_ipc.sock) to spin up dynamic virtual honeypots via native UCI commands, while simultaneously dropping the source at the ebtables/iptables level.
- Anti-Scanner Measures: Implemented a raw socket loop to flood the attacker with junk packets designed to specifically stall the stream-state dissecting mechanism of Wireshark/Nmap.
I'm looking for peer feedback on the architectural approach, especially regarding handling CPU spikes on older ath9k chipsets during hostapd reloads.
The full production-ready implementation, including the POSIX deployment scripts, is completely open-source for auditing and testing here: https://github.com/badrrx/WiFi-SpiderWeb
Would love to hear your thoughts on optimization or potential legal/technical oversights in this implementation!
Links cited in the discussion
Also discussed in r/cybersecurity